1309608 - Crash in mozilla::dom::AutoJSAPI::Init

Status: RESOLVED DUPLICATE of bug 1309867

(Core :: JavaScript Engine, defect)

Description

[Ludovic Hirlimann [:Usul]]

This bug was filed from the Socorro interface and is 
report bp-16b5bf4a-c26f-46f6-899c-cad4a2161012.
=============================================================
0 	libxul.so 	mozilla::dom::AutoJSAPI::Init 	js/public/GCAPI.h:638
1 	libxul.so 	mozilla::dom::Promise::CreateWrapper 	dom/promise/Promise.cpp:675
2 	libxul.so 	mozilla::dom::Promise::Create 	dom/promise/Promise.cpp:533
3 	libxul.so 	mozilla::dom::FontFace::FontFace 	layout/style/FontFace.cpp:120
4 	libxul.so 	mozilla::dom::FontFace::CreateForRule 	layout/style/FontFace.cpp:163
5 	libxul.so 	mozilla::dom::FontFaceSet::UpdateRules 	layout/style/FontFaceSet.cpp:718
6 	libxul.so 	nsIDocument::FlushUserFontSet 	dom/base/nsDocument.cpp:12783
7 	libxul.so 	nsIDocument::GetUserFontSet 	dom/base/nsDocument.cpp:12741
8 	libxul.so 	nsLayoutUtils::GetFontMetricsForFrame 	layout/base/nsPresContext.cpp:2062
9 	libxul.so 	mozilla::ScrollFrameHelper::GetLineScrollAmount 	layout/base/nsLayoutUtils.h:1267
10 	libxul.so 	nsHTMLScrollFrame::GetLineScrollAmount 	layout/generic/nsGfxScrollFrame.h:811
11 	libxul.so 	nsLayoutUtils::ComputeScrollMetadata 	layout/base/nsLayoutUtils.cpp:8904
12 	libxul.so 	mozilla::ScrollFrameHelper::ComputeScrollMetadata 	layout/generic/nsGfxScrollFrame.cpp:3776
13 	libxul.so 	nsHTMLScrollFrame::ComputeScrollMetadata 	layout/generic/nsGfxScrollFrame.h:924
14 	libxul.so 	mozilla::ContainerState::SetupScrollingMetadata 	layout/base/FrameLayerBuilder.cpp:4791
15 	libxul.so 	mozilla::ContainerState::PostprocessRetainedLayers 	layout/base/FrameLayerBuilder.cpp:4846
16 	libxul.so 	mozilla::ContainerState::Finish 	layout/base/FrameLayerBuilder.cpp:4927
17 	libxul.so 	mozilla::FrameLayerBuilder::BuildContainerLayerFor 	layout/base/FrameLayerBuilder.cpp:5330
18 	libxul.so 	nsDisplayList::PaintRoot 	layout/base/nsDisplayList.cpp:1816
19 	libxul.so 	nsLayoutUtils::PaintFrame 	layout/base/nsLayoutUtils.cpp:3638
20 	libxul.so 	PresShell::Paint 	layout/base/nsPresShell.cpp:6362
21 	libxul.so 	mozilla::dom::TabChild::RecvSetDocShellIsActive 	dom/ipc/TabChild.cpp:2712
22 	libxul.so 	mozilla::dom::TabChild::ForcePaint 	dom/ipc/TabChild.cpp:3397
23 	libxul.so 	InterruptCallback 	dom/ipc/ProcessHangMonitor.cpp:312
24 	libxul.so 	InvokeInterruptCallback 	js/src/vm/Runtime.cpp:539
25 		@0x7fc9bcbd6d1f 	
26 		@0x7fc9bcbd3887 	
27 	libxul.so 	EnterBaseline 	js/src/jit/BaselineJIT.cpp:155
28 	libxul.so 	js::jit::EnterBaselineMethod 	js/src/jit/BaselineJIT.cpp:193
29 	libxul.so 	js::RunScript 	js/src/vm/Interpreter.cpp:394
30 	libxul.so 	js::Call 	js/src/vm/Interpreter.cpp:476
31 	libxul.so 	JS::Call 	js/src/jsapi.cpp:2825
32 	libxul.so 	mozilla::dom::Function::Call 	obj-firefox/dom/bindings/FunctionBinding.cpp:37
33 	libxul.so 	nsGlobalWindow::RunTimeoutHandler 	obj-firefox/dist/include/mozilla/dom/FunctionBinding.h:70
34 	libxul.so 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:12551
35 	libxul.so 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:12797
36 	libxul.so 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:480
37 	libxul.so 	nsTimerEvent::Run 	xpcom/threads/TimerThread.cpp:289
38 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:1082
39 	libxul.so 	NS_ProcessNextEvent 	xpcom/glue/nsThreadUtils.cpp:290
40 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:96
41 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:232
42 	libxul.so 	nsBaseAppShell::Run 	widget/nsBaseAppShell.cpp:156
43 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:869
44 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:232
45 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:701
46 	plugin-container 	content_process_main 	ipc/contentproc/plugin-container.cpp:197
Ø 47 	libc-2.23.so 	libc-2.23.so@0x20730 	
48 	plugin-container 	plugin-container@0xdfaf 	
49 	plugin-container 	malloc_good_size 	memory/build/replace_malloc.c:243
50 		@0x7ffebc526d1f 	
51 	plugin-container 	pthread_atfork 	
Ø 52 	ld-2.23.so 	ld-2.23.so@0x1019f 	
Ø 53 	ld-2.23.so 	ld-2.23.so@0xfe9a 	
54 	plugin-container 	malloc_good_size 	memory/build/replace_malloc.c:243
55 		@0x7ffebc526d1f 	
56 	plugin-container 	_start

I was trying to open a periscope link from an embedded tweet on the huf.po

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

22 	libxul.so 	mozilla::dom::TabChild::ForcePaint 	dom/ipc/TabChild.cpp:3397
23 	libxul.so 	InterruptCallback 	dom/ipc/ProcessHangMonitor.cpp:312
24 	libxul.so 	InvokeInterruptCallback 	js/src/vm/Runtime.cpp:539

I think this means we're in the painting interrupt code.  Bill?

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

Crash appears to be on 52.

Comment 3

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I got this crash today on 52.0a1 (2016-10-13) [e10s enabled] when I was duplicating tabs and moving them around in tab bar.

https://crash-stats.mozilla.com/report/index/df608846-3b77-44e3-b6ee-5e8ad2161013