"Search for add-ons" in about:addons lets Firefox crash

RESOLVED INVALID

Status

()

Firefox
Extension Compatibility
RESOLVED INVALID
a year ago
5 months ago

People

(Reporter: rugk, Unassigned)

Tracking

({hang, regressionwindow-wanted})

50 Branch
x86_64
Linux
hang, regressionwindow-wanted
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

a year ago
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Build ID: 20161104212021

Steps to reproduce:

1. Open Firefox.
2. Open about:addons
3. Click on "Search for addons"


Actual results:

The whole Firefox freezes. This is reproducible.

When closing Firefox from the task manager and reopening it I'll get another problem: On the next restart Firefox often does not recognize the tabs it had open, so the about:session-restore page does not show any tabs.

Console errors:
(firefox:5441): GLib-GObject-CRITICAL **: g_object_ref: assertion 'object->ref_count > 0' failed

(firefox:5441): GLib-GObject-CRITICAL **: g_object_unref: assertion 'object->ref_count > 0' failed

(firefox:5441): GLib-GObject-CRITICAL **: g_object_ref: assertion 'object->ref_count > 0' failed

(firefox:5441): GLib-GObject-CRITICAL **: g_object_unref: assertion 'object->ref_count > 0' failed
autosizer-bs: bootstrap.js loaded.
autosizer-bs: Importing Autosizer.
autosizer-bs: Autosizer imported
[…]
4095
Extension error: Error: Incorrect argument types for tabs.get. moz-extension://36e03678-9e78-4f69-96a5-6eb324617305/js/background.bundle.js 381
[[Exception stack
[2]</startWindowAndTabListeners/<@moz-extension://36e03678-9e78-4f69-96a5-6eb324617305/js/background.bundle.js:381:7
Current stack
runSafeSyncWithoutClone@resource://gre/modules/ExtensionUtils.jsm:43:129
runSafeSync@resource://gre/modules/ExtensionUtils.jsm:74:37
runSafe@resource://gre/modules/ExtensionUtils.jsm:220:32
fire/<@resource://gre/modules/ExtensionUtils.jsm:921:42
]]
Extension error: Error: Incorrect argument types for tabs.get. moz-extension://36e03678-9e78-4f69-96a5-6eb324617305/js/background.bundle.js 381
[[Exception stack
[2]</startWindowAndTabListeners/<@moz-extension://36e03678-9e78-4f69-96a5-6eb324617305/js/background.bundle.js:381:7
Current stack
runSafeSyncWithoutClone@resource://gre/modules/ExtensionUtils.jsm:43:129
runSafeSync@resource://gre/modules/ExtensionUtils.jsm:74:37
runSafe@resource://gre/modules/ExtensionUtils.jsm:220:32
fire/<@resource://gre/modules/ExtensionUtils.jsm:921:42
]]
[error below is logged **before** I actually click on "Search for addons"]
console.error: CustomizableUI: 
  TypeError: aNode.previousSibling is null -- resource://app/modules/CustomizableUI.jsm:4313
console.warn: SDK worker-child started as frozen on unexpected initial document.readyState {"initialDocumentReadyState":"uninitialized","windowLocation":"about:addons"}
[…]
[Opened dev console, not neccessary, logs below are related to dev console and likely do not matter]
console.error: 
  Message: Error: Custom SelectorHighlighterhighlighter cannot be created in a XUL window
  Stack:
    exports.CustomHighlighterActor<.initialize@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/server/actors/highlighters.js:435:13
constructor@resource://gre/modules/commonjs/toolkit/loader.js -> resource://gre/modules/commonjs/sdk/core/heritage.js:146:23
exports.InspectorActor<.getHighlighterByType@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/server/actors/inspector.js:2695:14
generateRequestHandlers/</handler@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/shared/protocol.js:1044:19
onPacket@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/server/main.js:1707:15
ChildDebuggerTransport.prototype.receiveMessage@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/shared/transport/transport.js:752:7

exports.CustomHighlighterActor<.initialize@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/server/actors/highlighters.js:435:13
constructor@resource://gre/modules/commonjs/toolkit/loader.js -> resource://gre/modules/commonjs/sdk/core/heritage.js:146:23
exports.InspectorActor<.getHighlighterByType@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/server/actors/inspector.js:2695:14
generateRequestHandlers/</handler@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/shared/protocol.js:1044:19
onPacket@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/server/main.js:1707:15
ChildDebuggerTransport.prototype.receiveMessage@resource://gre/modules/commonjs/toolkit/loader.js -> resource://devtools/shared/transport/transport.js:752:7
console.warn: The selectorHighlighter couldn't be instantiated, elements matching hovered selectors will not be highlighted



Expected results:

Open page.

No issue with Firefox 49.
(Reporter)

Updated

a year ago
Has STR: --- → yes
Component: Untriaged → Activity Streams: Application Servers
(Reporter)

Comment 1

a year ago
Created attachment 8814717 [details]
FreezeAddons.png

Updated

a year ago
Component: Activity Streams: Application Servers → Add-ons Manager
Product: Firefox → Toolkit

Updated

a year ago
Keywords: crash
OS: Unspecified → Linux
Hardware: Unspecified → x86_64
Can you reproduce this in a new profile or in safe mode?
https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles
Flags: needinfo?(c4609174)

Comment 3

a year ago
https://developer.mozilla.org/en-US/docs/Mozilla/How_to_report_a_hung_Firefox#Linux_and_Mac
Severity: normal → critical
Keywords: crash → hang
(Reporter)

Comment 4

a year ago
https://crash-stats.mozilla.com/report/index/1a87b14e-7ba7-4bc9-b9f9-5c6342161128#tab-details

I am going to reproduce it in a clean profile.

Comment 5

a year ago
So maybe there is a regression in FF50. Could you use the tool mozregression to narrow down a regression range, please.
See http://mozilla.github.io/mozregression/ for details (you need python 2.7).
Run the command "mozregression --good=49" then copy here the final pushlog from the repository mozilla-inbound.
Keywords: regressionwindow-wanted
The crash-stats link in comment 4 shows that it's crashing with a SIGABRT - could you start Firefox from a terminal window, and reproduce it with that same profile? If a system library like glibc is causing that signal by calling abort() there should be some output in the terminal.

Trying to reproduce with a clean profile is useful as well, but it's possible that one of your addons is triggering a real bug in Firefox so I think it's worth following up on.
(Reporter)

Comment 7

a year ago
I did, so the last output before Firefox restart is:

console.warn: SDK worker-child started as frozen on unexpected initial document.readyState {"initialDocumentReadyState":"uninitialized","windowLocation":"about:addons"}
ExceptionHandler::GenerateDump cloned child 5434
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...

BTW I think I can reproduce it with both Debians Firefox release build (from their mozilla backports) and with the official Firefox binaries from Mozilla.

> but it's possible that one of your addons is triggering a real bug in Firefox so I think it's worth following up on.

Yeah, I also think so.
Flags: needinfo?(c4609174)
I can't reproduce a crash from that PDF.  Have you reproduced any of these crashes with a clean profile as requested in comment 2?
Flags: needinfo?(c4609174)
(Reporter)

Comment 10

a year ago
Yeah, forget the PDF. Now I also cannot reproduce it with my main profile.

The about:addons crash is not reproducible with a clean profile. However when reproducing it in my main profile I waited long enough now to see a JS error message. (I'm attaching a screenshot)

Unfortunately clocking on "debug script" did nothing as I had already closed the main Firefox window.
Flags: needinfo?(c4609174)
(Reporter)

Comment 11

a year ago
Created attachment 8816766 [details]
jshang.png
My German is not very good but I think that's the slow script warning, which doesn't seem related to the issue in this bug.
Given that this isn't reproducible in a clean profile, there's an issue with one of your extensions.  Unfortunately, the only thing to do at this point is to try selectively disabling some of your extensions to narrow down which one(s) is responsible.  If you're willing to try this, you might start with extensions that are closely related to how other extensions are handled (eg slim addon manager).
Severity: critical → normal
Component: Add-ons Manager → Extension Compatibility
Product: Toolkit → Firefox

Comment 13

a year ago
This bug is related to the "NoScript" add-on.

I disabled only NoScript and the tab works again.
To make sure it's not a conflict I then disabled all add-ons but NoScript, and the bug re-appeared.

However, on the second test, my firefox froze only for a short time, before NoScript issued a warning bar that it intercepted a possible XSS-attack by [chrome:].

Comment 14

a year ago
This is not limited to UNIX:

Name: Firefox
Version: 50.1.0
Build-ID: 20161208153507
Update-Channel: release
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
OS: Windows_NT 10.0

Notifications from the Console (manually translated):

[NoScript InjectionChecker] JavaScript Injection in ///de/firefox/discovery/pane/50.1.0/WINNT/normal#{%22{64161300-e22b-11db-8314-0800200c9a66}%22:{%22name%22:%22Speed%20Dial%22,%22version%22:%220.9.6.18%22,%22type%22:%22extension%22,%22userDisabled%22:true,%22isCompatible%22:true,%22isBlocklisted%22:false},>>>JSON for the other add-ons<<<}

[NoScript XSS] A suspicious request was cleaned. Original URL [https://discovery.addons.mozilla.org/de/firefox/discovery/pane/50.1.0/WINNT/normal#>>>same JSON as above<<<] requested by [chrome://browser/content/browser.xul]. Cleaned URL: [https://discovery.addons.mozilla.org/#8215977273304351357].

[NoScript] Force text/plain for missing content-type on https://discovery.addons.mozilla.org/de/firefox/#8215977273304351357

Updated

a year ago
Flags: needinfo?(g.maone)
I've tried to reproduce following the steps in comment 1, but I couldn't.
However the reporter at comment 13 is different: are the steps to reproduce the same? Is he able to reproduce on a clean profile with just NoScript installed?
Flags: needinfo?(g.maone)

Comment 16

a year ago
Preparation:
1. Created a fresh profile
2. Pressed Ctrl+Shift+A
3. Clicked on "Search for add-ons" => works
4. Opened addons.mozilla.org
5. Installed NoScript
6. Restarted browser
7. Closed all tabs (first-run and restored)
8. Restarted browser again

No settings in NoScript or Firefox were changed.

Execution
1. Ctrl+Shift+A
2. Click on "Search for add-ons"
3. Firefox hangs for ~11 seconds, UI loading animation freezes
4. UI loading animation continues for 1 second
5. The discovery page shows
6. A notification bar from NoScript says "Some script are blocked"

Reproducible 5/5 times.
(Reporter)

Comment 17

a year ago
I could not reproduce it with NoScript only. So with the STR in comment 16 I could not reproduce it.
(Reporter)

Comment 18

a year ago
I finally could test it and NoScript is indeed an issue (& it works with NoScripts default configuration), but also Greasemonkey is needed in my case. Actually even some Greasemonkey scripts are needed, *but* all of them are disabled. (when deleting the disabled scripts however, it does not work).

So as it seems I actually need: NoScript (default conf), Greasemonkey (with some disabled scripts)

For reproduction cases I made a profile where I could reproduce it and tried to remove all personal data. I have a tar.gz available here and I am willing to share it with some Mozilla dev.
So @Andrew Swan, can I e.g. sent it to you?

My STR are basically what I said in comment 1. (except that I used FF 50.0.1 here).

Tested with 50.0.1
Flags: needinfo?(aswan)
I'm sorry, I've got my hands full with other things at the moment and don't have time to try to reproduce this.  I would suggest trying to work with the NoScript and Greasemonkey developers (Giorgio is already cc'ed on this bug).
Flags: needinfo?(aswan)
(Reporter)

Comment 20

a year ago
So okay, Giorgio, let me know whether you can receive the ZIP file. 
As for Greasemonkey I've opened an issue: https://github.com/greasemonkey/greasemonkey/issues/2467
(Reporter)

Updated

a year ago
Flags: needinfo?(g.maone)
(In reply to rugk from comment #20)
> So okay, Giorgio, let me know whether you can receive the ZIP file. 

My email address & PGP key are listed at https://maone.net/
Flags: needinfo?(g.maone)

Comment 22

a year ago
TEMP Fix / workaround :

Go to NoScript Options -> Advanced -> XSS -> Anti-XSS Protection Exceptions

Add:

"^https?://([a-z]*)\.mozilla\.org/[^"<>\?%]+$" (without quotes)
(Reporter)

Comment 23

a year ago
WOW, awesome! It works.

Will this get fixed in NoScript e.g. by adding this exception by default? Or what exactly is causing this freeze?

Comment 24

5 months ago
This is a legacy extension, no longer valid in Firefox 57, closing.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 5 months ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.