1306621 - Crash in BuildFlatReplacement with AdBlock Plus

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect, P5)

Description

[Marco Castelluccio [:marco]]

This bug was filed from the Socorro interface and is 
report bp-656f554a-dc01-4e37-b120-0fe9c2160930.
=============================================================

#2 in the startup top crashers list for 49.0.1.

(93.71% in signature vs 01.74% overall) cpu_info = GenuineIntel family 6 model 61 stepping 4 | 4
(92.24% in signature vs 01.64% overall) adapter_device_id = 0x1616
(100.0% in signature vs 20.15% overall) Addon "Adblock Plus" = true
(95.18% in signature vs 21.17% overall) startup = true
(72.54% in signature vs 06.10% overall) platform_version = 6.3.9600
(72.54% in signature vs 06.10% overall) platform_pretty_version = Windows 8.1
(99.79% in signature vs 49.04% overall) adapter_vendor_id = 0x8086
(53.88% in signature vs 07.87% overall) has dual GPUs = true
(51.78% in signature vs 09.04% overall) reason = EXCEPTION_ACCESS_VIOLATION_WRITE
(07.55% in signature vs 39.88% overall) reason = EXCEPTION_BREAKPOINT
(38.36% in signature vs 07.71% overall) useragent_locale = de

For some reason, this is exclusively happening on 49.0.1, but looks like its
first appearance was a long time ago (2011-01-10). Perhaps it only appears
for some specific builds.

Comment 1

[Sylvestre Ledru [:Sylvestre]]

[Tracking Requested - why for this release]:
We should act on this as it is spiking and it is a startup crash.
NI liz to make sure you see it

Andrei, could you try if you can reproduce that?

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

#29 topcrash overall. 
Jimm, can you take a look or suggest someone who might investigate? Thanks!

Comment 3

[Wladimir Palant]

Interesting how this appears to affect mostly devices with Intel(R) HD Graphics 5500 even though this is a regexp engine crash. Adblock Plus creates lots of regular expressions so it is somewhat obvious how it triggers this crash. I don't know of any user reports concerning this crash yet.

Comment 4

[Jim Mathies [:jimm]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #2)
> #29 topcrash overall. 
> Jimm, can you take a look or suggest someone who might investigate? Thanks!

startup crash in the js engine related to regexp. ni'ing Naveed.

Comment 5

[[:philipp]]

these correlations here (GenuineIntel family 6 model 61 stepping 4 | 4, win 8.1) remind me of the patterns in bug 1296630.

Comment 6

[Naveed Ihsanullah [:naveed]]

Jan will take a look at a dump is Visual Studio. Intel family 6 model 61 appears to be Broadwell-U dual core

Comment 7

[Mihai Boldan, Desktop QA [:mboldan]]

I managed to performed some test around the Firefox 49.0.1 build, without any luck in reproducing the issue.
The tests were performed on Firefox Stub 49.0.1, Firefox 49.0.1 en_US, Firefox 49.0.1 de and on Firefox 49.0.1 fr builds, under Windows 8.1 x86 (AMD Radeon HD 7700 Series) and Windows 8.1 x64 (Intel HD Graphics 4400).
If there is someone who managed to reproduced this crash, please provide some STR, or any information related to it.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'BuildFlatReplacement':
 - nightly (version 52): 0 crashes from 2016-09-19.
 - aurora  (version 51): 0 crashes from 2016-09-19.
 - beta    (version 50): 2 crashes from 2016-09-20.
 - release (version 49): 4131 crashes from 2016-09-05.
 - esr     (version 45): 0 crashes from 2016-07-25.

Crash volume on the last weeks (Week N is from 10-17 to 10-23):
            W. N-1  W. N-2  W. N-3  W. N-4
 - nightly       0       0       0       0
 - aurora        0       0       0       0
 - beta          1       1       0       0
 - release    1221    1243    1159     160
 - esr           0       0       0       0

Affected platform: Windows

Crash rank on the last 7 days:
           Browser     Content   Plugin
 - nightly
 - aurora
 - beta    #7968
 - release #44
 - esr

Comment 9

[Jan de Mooij [:jandem]]

Is this still a topcrash? I don't see many reports when I load the crash signature URL.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.