1240542 - Crash in [@ js::InterpreterActivation::InterpreterActivation] → [@ IPCError-browser | ShutDownKill ]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[alex_mayorga]

This bug was filed from the Socorro interface and is 
report bp-3c201d64-8154-4660-b17f-4ac8b2160118.
=============================================================

¡Hola!

This crash has been happening frequently recently when loading the "Restore Session" tab the tab itself crashes.

¡Gracias!
Alex

20 other crashes in the past month at https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=js%3A%3AInterpreterActivation%3A%3AInterpreterActivation

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	js::InterpreterActivation::InterpreterActivation(js::RunState&, JSContext*, js::InterpreterFrame*) 	js/src/vm/Stack-inl.h
1 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp
2 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
3 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
4 	xul.dll 	Interpret 	js/src/vm/Interpreter.cpp
5 	xul.dll 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
6 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
7 	xul.dll 	IntlInitialize 	js/src/builtin/Intl.cpp
8 	xul.dll 	InitNumberFormatClass 	js/src/builtin/Intl.cpp
9 	xul.dll 	js::InitIntlClass(JSContext*, JS::Handle<JSObject*>) 	js/src/builtin/Intl.cpp
10 	xul.dll 	js::GlobalObject::resolveConstructor(JSContext*, JS::Handle<js::GlobalObject*>, JSProtoKey) 	js/src/vm/GlobalObject.cpp
11 	xul.dll 	js::GlobalObject::initStandardClasses(JSContext*, JS::Handle<js::GlobalObject*>) 	js/src/vm/GlobalObject.cpp
12 	xul.dll 	JS_InitStandardClasses(JSContext*, JS::Handle<JSObject*>) 	js/src/jsapi.cpp
13 	xul.dll 	XPCWrappedNative::WrapNewGlobal(xpcObjectHelper&, nsIPrincipal*, bool, JS::CompartmentOptions&, XPCWrappedNative**) 	js/xpconnect/src/XPCWrappedNative.cpp
14 	xul.dll 	nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext*, nsISupports*, nsIPrincipal*, unsigned int, JS::CompartmentOptions&, nsIXPConnectJSObjectHolder**) 	js/xpconnect/src/nsXPConnect.cpp
15 	xul.dll 	nsMessageManagerScriptExecutor::InitChildGlobalInternal(nsISupports*, nsACString_internal const&) 	dom/base/nsFrameMessageManager.cpp
16 	xul.dll 	mozilla::dom::TabChild::InitTabChildGlobal(mozilla::dom::TabChild::FrameScriptLoading) 	dom/ipc/TabChild.cpp
17 	xul.dll 	mozilla::dom::TabChild::RecvLoadRemoteScript(nsString const&, bool const&) 	dom/ipc/TabChild.cpp
18 	xul.dll 	mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PBrowserChild.cpp
19 	xul.dll 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentChild.cpp
20 	xul.dll 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
21 	xul.dll 	mozilla::ipc::MessageChannel::DispatchMessageW(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
22 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
23 	xul.dll 	RunnableMethod<mozilla::ipc::MessageChannel, bool ( mozilla::ipc::MessageChannel::*)(void), mozilla::Tuple<> >::Run() 	ipc/chromium/src/base/task.h
24 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
25 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
26 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
27 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
28 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
29 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
30 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
31 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
32 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
33 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
34 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
35 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
36 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
37 	kernel32.dll 	BaseThreadInitThunk 	
38 	ntdll.dll 	RtlUserThreadStart

Comment 1

[alex_mayorga]

Attachment: Screen capture of the crashed tab

Comment 2

[Terrence Cole [:terrence]]

Waldo, this is under IntlInitialize. Is there anything to do here without STR?

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Updating crash signature to reflect changes to signature generation made in bug 1269817 (although reports older than a week will not be reprocessed), and adding dependency to ShutDownKill metabug.

(These probably shouldn't all be separate bugs, but I'm not going to fix that up in a mass-change.)

Comment 4

[Jeff Walden [:Waldo]]

Without STR, not really.  :-\  Also, as a practical matter, some of the initialization bits are likely to be rewritten soonish (the original Intl spec let any object be initialized as an Intl object, newer specs don't allow this in quite the same way), so it's probably smarter to attempt looking into this after we make those changes.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'IPCError-browser | ShutDownKill':
 - nightly (version 50): 54812 crashes from 2016-06-06.
 - aurora  (version 49): 93627 crashes from 2016-06-07.
 - beta    (version 48): 1215 crashes from 2016-06-06.
 - release (version 47): 1004 crashes from 2016-05-31.
 - esr     (version 45): 19 crashes from 2016-04-07.

Crash volume on the last weeks:
            W. N-1  W. N-2  W. N-3  W. N-4  W. N-5  W. N-6  W. N-7
 - nightly   10822    5966    8216    6846    5875    5644    5988
 - aurora    12859   12518   13245   13035   14496   12750   10399
 - beta        193     189     225     171     117     145     103
 - release     149     166     170     131     143      99     101
 - esr           2       0       0       5       2       3       1

Affected platforms: Windows, Mac OS X, Linux

Comment 6

[Trevor Skywalker]

(In reply to Jeff Walden [:Waldo] (I'm baaaaaaack...) from comment #4)
> Without STR, not really.  :-\  Also, as a practical matter, some of the
> initialization bits are likely to be rewritten soonish (the original Intl
> spec let any object be initialized as an Intl object, newer specs don't
> allow this in quite the same way), so it's probably smarter to attempt
> looking into this after we make those changes.

Have the initialization bits been rewritten?

Comment 7

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Update_affecteds

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.