1141648 - crash in js::NewObjectWithClassProtoCommon(js::ExclusiveContext*, js::Class const*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, js::gc::AllocKind, js::NewObjectKind)

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Brogan Zumwalt [Inactive]]

This bug was filed from the Socorro interface and is 
report bp-d891bf90-5ede-4e21-ba6b-762072150310.
=============================================================
Crash occurred when sharing newly taken photo with messages app. New sms thread was created when shared from camera and crash occurred while message was sending. Messages app did not close after submitting crash and the message proceeded to send correctly.

This does not reproduce a second time if sharing in existing thread, new thread, after reboot, or after reset. Adding steps-wanted for better STR.

Initial Repro Steps (Does not reproduce):
1) Update a Flame to 20150310010227
2) Launch Camera
3) Take picture and tap image preview
4) Select share icon and choose messages app
5) Input valid number and send message

Environmental Variables:
Device: Flame 3.0
Build ID: 20150310010227
Gaia: 2fb09da0cb9cefad9c6e40f57533fafda6d12557
Gecko: 6686aacf006f
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Comment 1

[Jayme Mercado [:JMercado] (Inactive 3/4/2016)]

Spent about an hour trying to get this issue to occur with no luck.  I tried share activities between many apps (camera, gallery, video, email, sms, etc) and to put the phone into a high memory situation while in those apps.  Leaving the tag for others to try.
	
Environmental Variables:
Device: Flame 3.0
BuildID: 20150310055519
Gaia: f6a1fcd30ee6a286f3bca9d0c3cb600e21bfbf69
Gecko: c42e7e3bb0a0
Version: 39.0a1 (3.0) 
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Comment 2

[Pi Wei Cheng [:piwei] (inactive)]

I was also unable to reproduce after an hour of trying. No crash occurred with sending a photo MMS via Camera or Gallery app.

Device: Flame 3.0 Master (full flash 319MB mem)
BuildID: 20150310010227
Gaia: 2fb09da0cb9cefad9c6e40f57533fafda6d12557
Gecko: 6686aacf006f
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0 Master) 
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Steps to reproduce with B2G 3.0 20150311125826 on Flame (v18D base image):
1. Factory reset phone.
2. Skip everything in the FTU.
3. Open Settings.
4. Open Wi-Fi.
5. Select 'Manage networks'.
6. Tap on 'Join hidden network'.
7. Tap on the field for the network name.
Actual result:
Crash report shown in the moment when the keyboard gets initialized.

Maybe other or all input boxes can also trigger this, but I didn't test because this only happens for the first keyboard init in these STR.

Comment 4

[KTucker [:KTucker][Inactive 3/4/2016]]

I was unable to reproduce this on Flame 3.0 using the STR in Comment 3 on v18D or v18D-1 using today's build.

Piwei, can you please give it a try?

Comment 5

[Pi Wei Cheng [:piwei] (inactive)]

I cannot reproduce the crash following comment 3's steps/build/base. I also tried full flashing/shallow flashing. Repro rate: 0/7. Removing steps-wanted for now.

If anyone came upon this crash please provide any additional info on how the crash is encountered. So far this crash seems to be random.

Device: Flame 3.0 Master (full/shallow flash, 319/512MB mem)
BuildID: 20150311125826
Gaia: 2b87ee8e7e2ec30a9851b6b59a899006a98767ab
Gecko: bc6aeea72290
Version: 39.0a1 (3.0 Master)
Firmware Version: v18D
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Comment 6

[KTucker [:KTucker][Inactive 3/4/2016]]

Hello, we cannot seem to reproduce this issue using the steps from Comment 3. Can you provide us more information on what we might be missing here?

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

The crash I submitted yesterday was https://crash-stats.mozilla.com/report/index/db38089d-7182-4152-8f23-4064d2150311 and I can still always reproduce with today's build. This seems to be specific to that form, e.g. tapping the searchbar and typing at first doesn't cause any crash report showing up.

If you need further information, let me know. I can try to find a regression window tomorrow.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Last working:

Version=39.0a1
BuildID=20150304010324
SourceStamp=c5b90c003be8
Git Commit Info: 3fc0ac30

First bad:

Version=39.0a1
BuildID=20150304160447
SourceStamp=56492f7244a9
Git Commit Info: eff3321a

Pushlog Gecko: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c5b90c003be8&tochange=56492f7244a9

Fallout from Bug 1001691? Commits for that:
http://hg.mozilla.org/mozilla-central/rev/a48fb48db853
http://hg.mozilla.org/mozilla-central/rev/90a444476dcd

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Hi Tim, can you take a look at the crash, your commits in bug 1001691 and a look at the other checkins in http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=c5b90c003be8&tochange=56492f7244a9 (bkelly also landed worker stuff) to determine which checkin causes this crash? Thank you.

Comment 10

[Tim Taubert [:ttaubert] (inactive)]

This doesn't really look worker-related, but it might be. My patches only move code around and do not change functionality. I would suggest bisecting further to find the root cause, would be surprised if my patches are the culprit :)

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Brian, is this fallout from bug 1137497?

Comment 12

[Brian Hackett [Laid off!]]

(In reply to Archaeopteryx [:aryx] from comment #11)
> Brian, is this fallout from bug 1137497?

I doubt it, that bug reorganized code but only changed behavior for a feature that is currently shell only.

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::NewObjectWithClassProtoCommon':
 - nightly (version 50): 1 crash from 2016-06-06.
 - aurora  (version 49): 1 crash from 2016-06-07.
 - beta    (version 48): 105 crashes from 2016-06-06.
 - release (version 47): 380 crashes from 2016-05-31.
 - esr     (version 45): 107 crashes from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          0          0          0          1          0          0
 - aurora           0          0          0          0          1          0          0
 - beta            15         28         17         13         12         12          2
 - release         56         50         64         69         63         41         18
 - esr             14         14         16         13         17         13          6

Affected platforms: Windows, Mac OS X, Linux

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::NewObjectWithClassProtoCommon':
 - nightly (version 51): 7 crashes from 2016-08-01.
 - aurora  (version 50): 2 crashes from 2016-08-01.
 - beta    (version 49): 25 crashes from 2016-08-02.
 - release (version 48): 27 crashes from 2016-07-25.
 - esr     (version 45): 157 crashes from 2016-05-02.

Crash volume on the last weeks (Week N is from 08-22 to 08-28):
            W. N-1  W. N-2  W. N-3
 - nightly       2       5       0
 - aurora        0       1       0
 - beta          9      11       0
 - release      11       9       1
 - esr           9      11      12

Affected platforms: Windows, Mac OS X

Crash rank on the last 7 days:
           Browser   Content     Plugin
 - nightly
 - aurora  #1272
 - beta    #1942     #1080
 - release #1623
 - esr     #532

Comment 15

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::NewObjectWithClassProtoCommon':
 - nightly (version 54): 0 crashes from 2017-01-23.
 - aurora  (version 53): 0 crashes from 2017-01-23.
 - beta    (version 52): 54 crashes from 2017-01-23.
 - release (version 51): 242 crashes from 2017-01-16.
 - esr     (version 45): 403 crashes from 2016-08-03.

Crash volume on the last weeks (Week N is from 01-30 to 02-05):
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly       0
 - aurora        0
 - beta         35
 - release     152       0
 - esr          21      29      13      20       8      17      13

Affected platforms: Windows, Mac OS X, Linux

Crash rank on the last 7 days:
           Browser   Content   Plugin
 - nightly
 - aurora
 - beta    #155      #1032
 - release #95       #1648
 - esr     #569

Comment 16

[Julien Cristau [:jcristau]]

Too late for firefox 52, mass-wontfix.

Comment 17

[Benjamin Bouvier [:bbouvier] (inactive)]

Mass-closing JS bugs for which the platform is Gonk (Firefox OS), since Firefox OS is gone. Feel free to re-open if still valid.