Closed
Bug 1128219
Opened 5 years ago
Closed 5 years ago
uBlock add-on crash in mozilla::net::HttpBaseChannel::DoNotifyListener()
Categories
(Core :: Networking: HTTP, defect, critical)
Tracking
()
RESOLVED
FIXED
mozilla38
| Tracking | Status | |
|---|---|---|
| firefox37 | --- | unaffected |
| firefox38 | + | fixed |
People
(Reporter: cpeterson, Assigned: mayhemer)
References
Details
(Keywords: crash, regression, reproducible)
Crash Data
Attachments
(1 file, 1 obsolete file)
|
1.21 KB,
patch
|
mayhemer
:
review+
|
Details | Diff | Splinter Review |
This bug was filed from the Socorro interface and is report bp-391e4e4d-8c0e-4144-9fe3-c15e02150201. ============================================================= Frame Module Signature Source 0 XUL mozilla::net::HttpBaseChannel::DoNotifyListener() netwerk/protocol/http/HttpBaseChannel.cpp 1 XUL mozilla::net::nsHttpChannel::HandleAsyncAbort() netwerk/protocol/http/HttpBaseChannel.h 2 XUL nsRunnableMethodImpl<void (mozilla::net::nsHttpChannel::*)(), void, true>::Run() obj-firefox/x86_64/dist/include/nsThreadUtils.h 3 XUL nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 4 XUL NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp 5 XUL nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&) dom/base/nsXMLHttpRequest.cpp 6 XUL mozilla::dom::XMLHttpRequestBinding::send dom/base/nsXMLHttpRequest.h 7 XUL mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp 8 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 9 XUL js_fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 10 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 11 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 12 XUL js::jit::DoCallFallback js/src/jit/BaselineIC.cpp 13 @0x1007e040f 14 @0x113c4578f 15 @0x1007da7f0 16 XUL EnterBaseline js/src/jit/BaselineJIT.cpp 17 XUL js::jit::EnterBaselineMethod(JSContext*, js::RunState&) js/src/jit/BaselineJIT.cpp 18 XUL Interpret js/src/vm/Interpreter.cpp 19 XUL js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 20 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 21 XUL js_fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 22 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 23 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 24 XUL js::jit::DoCallFallback js/src/jit/BaselineIC.cpp 25 @0x1007e040f 26 @0x113c4578f 27 @0x1007da7f0 28 XUL EnterBaseline js/src/jit/BaselineJIT.cpp 29 XUL js::jit::EnterBaselineMethod(JSContext*, js::RunState&) js/src/jit/BaselineJIT.cpp 30 XUL js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 31 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 32 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 33 XUL JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 34 XUL mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) obj-firefox/x86_64/dom/bindings/EventHandlerBinding.cpp 35 XUL void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) obj-firefox/x86_64/dist/include/mozilla/dom/EventHandlerBinding.h 36 XUL mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) dom/events/JSEventHandler.cpp 37 XUL mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) dom/events/EventListenerManager.cpp 38 XUL mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) dom/events/EventListenerManager.cpp 39 XUL mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp 40 XUL mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) dom/events/EventDispatcher.cpp 41 XUL mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) dom/events/EventDispatcher.cpp 42 XUL nsXMLHttpRequest::ChangeState(unsigned int, bool) dom/base/nsXMLHttpRequest.h 43 XUL nsXMLHttpRequest::ChangeStateToDone() dom/base/nsXMLHttpRequest.cpp 44 XUL nsXMLHttpRequest::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) dom/base/nsXMLHttpRequest.cpp 45 XUL nsCORSListenerProxy::OnStopRequest(nsIRequest*, nsISupports*, tag_nsresult) dom/security/nsCORSListenerProxy.cpp 46 XUL nsCORSPreflightListener::OnStartRequest(nsIRequest*, nsISupports*) dom/security/nsCORSListenerProxy.cpp 47 XUL nsCORSListenerProxy::OnStartRequest(nsIRequest*, nsISupports*) dom/security/nsCORSListenerProxy.cpp 48 XUL mozilla::net::HttpBaseChannel::DoNotifyListener() netwerk/protocol/http/HttpBaseChannel.cpp 49 XUL mozilla::net::nsHttpChannel::HandleAsyncAbort() netwerk/protocol/http/HttpBaseChannel.h 50 XUL nsRunnableMethodImpl<void (mozilla::net::nsHttpChannel::*)(), void, true>::Run() obj-firefox/x86_64/dist/include/nsThreadUtils.h 51 XUL nsThread::ProcessNextEvent(bool, bool*) xpcom/threads/nsThread.cpp 52 XUL NS_ProcessNextEvent(nsIThread*, bool) xpcom/glue/nsThreadUtils.cpp 53 XUL nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&) dom/base/nsXMLHttpRequest.cpp 54 XUL mozilla::dom::XMLHttpRequestBinding::send dom/base/nsXMLHttpRequest.h 55 XUL mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) dom/bindings/BindingUtils.cpp 56 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 57 XUL js_fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 58 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 59 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 60 XUL js::jit::DoCallFallback js/src/jit/BaselineIC.cpp 61 @0x1007e040f 62 @0x113c4578f 63 @0x1007da7f0 64 XUL EnterBaseline js/src/jit/BaselineJIT.cpp 65 XUL js::jit::EnterBaselineMethod(JSContext*, js::RunState&) js/src/jit/BaselineJIT.cpp 66 XUL Interpret js/src/vm/Interpreter.cpp 67 XUL js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 68 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 69 XUL js_fun_apply(JSContext*, unsigned int, JS::Value*) js/src/jsfun.cpp 70 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h 71 XUL Interpret js/src/vm/Interpreter.cpp 72 XUL js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp 73 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/vm/Interpreter.cpp 74 XUL js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 75 XUL JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) js/src/jsapi.cpp 76 XUL mozilla::dom::OnBeforeUnloadEventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, nsString&, mozilla::ErrorResult&) obj-firefox/x86_64/dom/bindings/EventHandlerBinding.cpp 77 XUL void mozilla::dom::OnBeforeUnloadEventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, nsString&, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) obj-firefox/x86_64/dist/include/mozilla/dom/EventHandlerBinding.h 78 XUL mozilla::JSEventHandler::HandleEvent(nsIDOMEvent*) dom/events/JSEventHandler.cpp 79 XUL mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) dom/events/EventListenerManager.cpp 80 XUL mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) dom/events/EventListenerManager.cpp 81 XUL mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) dom/events/EventDispatcher.cpp 82 XUL mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) dom/events/EventDispatcher.cpp 83 XUL mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) dom/events/EventDispatcher.cpp 84 XUL nsDocumentViewer::PermitUnloadInternal(bool, bool*, bool*) layout/base/nsDocumentViewer.cpp 85 XUL nsDocumentViewer::PermitUnload(bool, bool*) layout/base/nsDocumentViewer.cpp 86 XUL NS_InvokeByIndex xpcom/reflect/xptcall/md/unix/xptcinvoke_x86_64_unix.cpp 87 XUL XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) js/xpconnect/src/XPCWrappedNative.cpp 88 XUL XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) js/xpconnect/src/XPCWrappedNativeJSOps.cpp 89 XUL js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) js/src/jscntxtinlines.h Ø 119 AppKit AppKit@0x18b450 120 XUL -[GeckoNSApplication sendEvent:] widget/cocoa/nsAppShell.mm Ø 121 AppKit AppKit@0x17607 122 XUL nsAppShell::Run() widget/cocoa/nsAppShell.mm 123 XUL nsAppStartup::Run() toolkit/components/startup/nsAppStartup.cpp 124 XUL XREMain::XRE_mainRun() toolkit/xre/nsAppRunner.cpp 125 XUL XREMain::XRE_main(int, char**, nsXREAppData const*) toolkit/xre/nsAppRunner.cpp 126 XUL XRE_main toolkit/xre/nsAppRunner.cpp 127 firefox main browser/app/nsBrowserApp.cpp 128 firefox start
|
Reporter | |
Comment 1•5 years ago
|
||
STR: 1. Install uBlock add-on: https://github.com/gorhill/uBlock/releases/tag/0.8.6.0 https://github.com/gorhill/uBlock/releases/download/0.8.6.0/uBlock.firefox.xpi 2. Open http://www.sfgate.com 3. Close sfgate.com tab RESULT: Crash!
Summary: crash in mozilla::net::HttpBaseChannel::DoNotifyListener() → uBlock add-on crash in mozilla::net::HttpBaseChannel::DoNotifyListener()
|
|
Reporter | |
Comment 2•5 years ago
|
||
I think this might be a regression in Nightly 2015-01-16. I tried to bisect this crash and hit a bunch of problems. I hit this assertion failure in the Nightly 2015-01-16 debug build: [479] ###!!! ABORT: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/nsCOMPtr.h, line 698 #01: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x383b2a] #02: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x38761f] #03: XRE_AddJarManifestLocation[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0xce1d6] #04: nsXPTCStubBase::Stub249()[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0xfbff3] #05: js::BaseProxyHandler::finalizeInBackground(JS::Value) const[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0xfddba0] #06: js::BaseProxyHandler::finalizeInBackground(JS::Value) const[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x186f444] #07: js::BaseProxyHandler::finalizeInBackground(JS::Value) const[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x17ed5a7] #08: js::BaseProxyHandler::finalizeInBackground(JS::Value) const[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x18b3418] #09: js::RegExpToSharedNonInline(JSContext*, JS::Handle<JSObject*>, js::RegExpGuard*)[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x3978d1a] #10: js::AutoWaivePolicy::~AutoWaivePolicy()[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x393a216] #11: js::ForwardToNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x377dfe8] #12: js::RegExpToSharedNonInline(JSContext*, JS::Handle<JSObject*>, js::RegExpGuard*)[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x3978d1a] #13: js::AutoWaivePolicy::~AutoWaivePolicy()[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x393a216] #14: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x395a011] #15: JS::HeapCellRelocate(js::gc::Cell**)[/Users/chris/Downloads/_FIREFOX/2015-01-16.app/Contents/MacOS/XUL +0x34eb377] Nightly 2015-01-17 and 2015-01-18 would hang my MacBook Pro, requiring a hard reboot. I hit this assertion failure in the Nightly 2015-01-17 debug build: JavaScript error: resource://gre/modules/RemoteAddonsChild.jsm, line 389: NS_ERROR_XPC_BAD_OP_ON_WN_PROTO: Illegal operation on WrappedNative prototype object JavaScript error: resource://gre/modules/RemoteAddonsChild.jsm, line 389: NS_ERROR_XPC_BAD_OP_ON_WN_PROTO: Illegal operation on WrappedNative prototype object JavaScript error: , line 0: Error: Permission denied to access property 'toString' JavaScript error: , line 0: Error: Permission denied to access property 'message' JavaScript error: , line 0: uncaught exception: unknown (can't convert to string) Assertion failure: !JS_IsExceptionPending(cx), at /builds/slave/m-cen-osx64-st-an-d-0000000000/build/src/js/xpconnect/wrappers/XrayWrapper.cpp:891 #01: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x8019eb] #02: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x807fa7] #03: js::BaseProxyHandler::hasOwn(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool*) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38ce4f7] #04: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x809009] #05: js::AppendUnique(JSContext*, JS::AutoIdVector&, JS::AutoIdVector&)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d8f48] #06: js::proxy_LookupGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38dad1c] #07: JS_CopyPropertiesFrom(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3838ee4] #08: JS::isGCEnabled()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x375bea6] #09: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x83be2f] #10: js::BaseProxyHandler::has(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, bool*) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38ce20a] #11: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x83c269] #12: js::AppendUnique(JSContext*, JS::AutoIdVector&, JS::AutoIdVector&)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d902f] #13: js::proxy_LookupGeneric(JSContext*, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JSObject*>, JS::MutableHandle<js::Shape*>)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38dad1c] #14: JS_CopyPropertiesFrom(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3838ee4] #15: js::MemoryReportingSundriesThreshold()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3975483] #16: js::RegExpToSharedNonInline(JSContext*, JS::Handle<JSObject*>, js::RegExpGuard*)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3990dc9] #17: JS_CopyPropertiesFrom(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3838f03] #18: JS_CopyPropertiesFrom(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3838ff5] #19: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x395d5b0] #20: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x39535bc] #21: js::AutoWaivePolicy::~AutoWaivePolicy()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3945306] #22: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3965141] #23: js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d382e] #24: js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d34e7] #25: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x80a52d] #26: js::BaseProxyHandler::isScripted() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x80a4b2] #27: js::AppendUnique(JSContext*, JS::AutoIdVector&, JS::AutoIdVector&)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d9e5d] #28: js::proxy_Call(JSContext*, unsigned int, JS::Value*)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38dbdc0] #29: js::RegExpToSharedNonInline(JSContext*, JS::Handle<JSObject*>, js::RegExpGuard*)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3983e1a] #30: js::AutoWaivePolicy::~AutoWaivePolicy()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x39452f6] #31: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x395cc09] #32: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x39535bc] #33: js::AutoWaivePolicy::~AutoWaivePolicy()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3945306] #34: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3965141] #35: js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d382e] #36: js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d34e7] #37: js::AppendUnique(JSContext*, JS::AutoIdVector&, JS::AutoIdVector&)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38d9e5d] #38: js::proxy_Call(JSContext*, unsigned int, JS::Value*)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x38dbdc0] #39: js::RegExpToSharedNonInline(JSContext*, JS::Handle<JSObject*>, js::RegExpGuard*)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3983e1a] #40: js::AutoWaivePolicy::~AutoWaivePolicy()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x39452f6] #41: js::ProtoKeyToClass(JSProtoKey)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3965141] #42: JS::CompileOptions::CompileOptions(JSContext*, JSVersion)[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x3765944] #43: js::BaseProxyHandler::finalizeInBackground(JS::Value) const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xf3a43d] #44: mac_plugin_interposing_child_OnShowCursor[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x1fa2357] #45: mac_plugin_interposing_child_OnShowCursor[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x1fa2450] #46: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x5140c6] #47: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x58a5a6] #48: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x477ec2] #49: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x476c3e] #50: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x4717e2] #51: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x452bf9] #52: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x452f1a] #53: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x47b1b5] #54: XRE_AddJarManifestLocation[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xcda56] #55: nsXPTCStubBase::Stub249()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xfb873] #56: XRE_AddJarManifestLocation[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xcd21e] #57: JSPrincipals::dump()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xc87589] #58: JSPrincipals::dump()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xc8703d] #59: XRE_AddJarManifestLocation[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xcda56] #60: nsXPTCStubBase::Stub249()[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0xfb77d] #61: mac_plugin_interposing_child_OnShowCursor[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x21fa717] #62: mac_plugin_interposing_child_OnShowCursor[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x224da5e] #63: __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x80681] #64: __CFRunLoopDoSources0[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x7280d] #65: __CFRunLoopRun[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x71e3f] #66: CFRunLoopRunSpecific[/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation +0x71858] #67: RunCurrentEventLoopInMode[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2eaef] #68: ReceiveNextEventCommon[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2e86a] #69: _BlockUntilNextEventMatchingListInModeWithFilter[/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox +0x2e6ab] #70: _DPSNextEvent[/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x23f81] #71: -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x23730] #72: mac_plugin_interposing_child_OnShowCursor[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x224cf06] #73: -[NSApplication run][/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit +0x17593] #74: mac_plugin_interposing_child_OnShowCursor[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x224e1ab] #75: XRE_RunAppShell[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x2d1ebb7] #76: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x47b322] #77: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x4523e0] #78: JS::CompileOptions::introductionScript() const[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x4522e0] #79: XRE_InitChildProcess[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/XUL +0x2d1e634] #80: start[/Users/chris/Downloads/_FIREFOX/2015-01-17.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x1ad8]
|
|
Reporter | |
Comment 3•5 years ago
|
||
Monica: do this HttpBaseChannel crash look like a regression from bug 1100024? I bisected inbound builds to this pushlog: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=1db2020eae48&tochange=25d9ba8ceb7a
|
Assignee | |
Comment 4•5 years ago
|
||
Actually, the code should be rewriten as: if (mListener) mListener->OnStart(..) mIsPending = false; if (mListener) mListener->OnStop() Then we are 100% safe, if it somehow happens the listener is unset from the channel, as apparently is in this case.
|
||
Comment 5•5 years ago
|
||
mayhemer would know better than me. I didn't touch that code directly but the push you mentioned could affect the callpath. Are you still seeing this regularly? I pushed a change on 1/28 that should reduce the scope of this problem. https://hg.mozilla.org/mozilla-central/rev/b6d3a8960d38
Flags: needinfo?(mmc)
|
|
Reporter | |
Comment 6•5 years ago
|
||
[Tracking Requested - why for this release]: This crash is still 100% reproducible for me in Nightly build 2015-02-02. You might need to disable e10s to reliably reproduce the crash.
status-firefox37:
--- → unaffected
tracking-firefox38:
--- → ?
|
||
Comment 7•5 years ago
|
||
Tracking since this is a recent regression and reproducible - Honza are you able to put up a potential fix for this?
Flags: needinfo?(honzab.moz)
|
|
Assignee | |
Comment 8•5 years ago
|
||
Yep, pretty easy to w/a.
Assignee: nobody → honzab.moz
Status: NEW → ASSIGNED
Flags: needinfo?(honzab.moz)
|
|
Assignee | |
Comment 9•5 years ago
|
||
Attachment #8561366 -
Flags: review?(mcmanus)
|
||
Comment 10•5 years ago
|
||
Comment on attachment 8561366 [details] [diff] [review] v1 Review of attachment 8561366 [details] [diff] [review]: ----------------------------------------------------------------- thanks honza
Attachment #8561366 -
Flags: review?(mcmanus) → review+
|
|
Assignee | |
Comment 11•5 years ago
|
||
https://treeherder.mozilla.org/#/jobs?repo=try&revision=eb4fb9d0b230
Keywords: checkin-needed
|
||
Comment 12•5 years ago
|
||
https://bugzilla.mozilla.org/show_bug.cgi?id=1079789#c28
Keywords: checkin-needed
|
|
Assignee | |
Comment 13•5 years ago
|
||
https://treeherder.mozilla.org/#/jobs?repo=try&revision=c34ac09f8042
Attachment #8561366 -
Attachment is obsolete: true
|
|
Assignee | |
Updated•5 years ago
|
Attachment #8564177 -
Flags: review+
|
|
Assignee | |
Updated•5 years ago
|
Keywords: checkin-needed
|
|
||
Comment 14•5 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/95666abd1447
Keywords: checkin-needed
|
||
Comment 15•5 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/95666abd1447
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
You need to log in
before you can comment on or make changes to this bug.
Description
•