1403932 - Crash in mozilla::extensions::ChannelWrapper::GetFrameAncestors const

Status: VERIFIED FIXED

(WebExtensions :: Request Handling, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-5ea7a97b-1b84-4e11-9448-e8cc20170928.
=============================================================

Seen while looking at nightly crash stats: http://bit.ly/2ftbKZZ. Crashes started using 20170928100123 

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35fbf14b96a633c3f66ea13c1a163a3f3a4219b9&tochange=76a26ef7c493311c170ae83eb0c1d6592a21396d

Comments:

www.speedcurve.com 
I went to pqi.org and clicked one of the calendar events, a colloquium by christopher white, on the left-hand side of the page. second time in a row that this caused a crash. 

Possibly Bug 1305237? ni on Shane

Comment 1

[Marcia Knous [:marcia]]

This crash affects Linux as well, not sure about Windows since I don't see the builds yet in https://dbaron.org/mozilla/crashes-by-build.

Comment 2

[Marcia Knous [:marcia]]

Affects Android as well.

Comment 3

[Marcia Knous [:marcia]]

Changing OS to all since this affects Windows. Adding Windows signature.

Comment 4

[Mark]

This appears to be a REGRESSION!

I also experienced some crashes, same crash signature.

Problematic site:  wishtv.com

I am on Nightly 58.0a1 (2017-09-28) (64-bit), Build ID 20170928100123 running on Windows 7 Home Premium SP1 (64-bit).

Use my usual profile (with add-ons, including uBlock Origin). Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. Firefox CRASHES. (Not just the process, the whole Firefox.)

Create a new profile. Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. No Crash. (But I note that the Cylon's eye is in constant motion all the time.) 

Create a new profile. Add the uBlock Origin extension. Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. Firefox CRASHES.

Create a new profile. Add the latest AdBlock Plus beta (WebExtensions) extension. Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. Firefox CRASHES.

These are today's crash reports:

https://crash-stats.mozilla.com/report/index/bp-e161dd1d-d05a-4f1e-846f-f27270170928
https://crash-stats.mozilla.com/report/index/bp-87cd1656-bed2-46a3-a632-8c9d70170928
https://crash-stats.mozilla.com/report/index/bp-d6f6d2ff-b70c-4ed7-aea2-754750170928
https://crash-stats.mozilla.com/report/index/bp-53073ed8-6062-4d12-b25b-7101c0170928
https://crash-stats.mozilla.com/report/index/bp-c798acd4-c4dc-4d22-975c-b04660170928

All of these have Signature: mozilla::extensions::ChannelWrapper::GetFrameAncestors

(Sorry, the crash report pop-up kept on being a pop-under and I lost track of which crash corresponds to which scenarios.)


I repeated the exercise with the Beta 57.0b3 (64-bit) Build ID 20170925150345, again with new profile, new profile + uBlock Origin, new profile + AdBlock Plus. But there were no crashes in any of these attempts in Beta.

If this is different from the bug reported above, let me know. Otherwise, I am going to try a mozregression-gui.

Comment 5

[Shane Caraveo (:mixedpuppy)]

Mark, thank you for a consistent reproduction.  No need to do further investigation.

Comment 6

[Mark]

Attachment: mozregression-gui-log.txt

I ran a mozregession-gui using the New Profile + uBlock Origin as the profile to clone (so I don't have to keep on adding uBlock Origin on each iteration). I opened a new tab, navigated to wishtv.com, clicked on the NFL story, clicked the back arrow (the Previous Page icon left of the address bar), a success was navigated back to the wishtv.com home page; a failure was a crash.

Attached: the log of the regression (mozregression-gui-log.txt).

For what it's worth, the end of the log points to:

> Bug 1305237 Expose frameAncestors to webextensions, r=bz,kmag
> 
> MozReview-Commit-ID: HpneTIKPoS1


This (below) is from the "Bisection Informations:


app_name: firefox
build_date: 2017-09-27
build_file: C:\Users\Mark12547\.mozilla\mozregression\persist\2017-09-27--mozilla-central--firefox-58.0a1.en-US.win64.zip
build_type: nightly
build_url: https://archive.mozilla.org/pub/firefox/nightly/2017/09/2017-09-27-10-01-20-mozilla-central/firefox-58.0a1.en-US.win64.zip
changeset: 35fbf14b96a633c3f66ea13c1a163a3f3a4219b9
pushlog_url: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35fbf14b96a633c3f66ea13c1a163a3f3a4219b9&tochange=76a26ef7c493311c170ae83eb0c1d6592a21396d
repo_name: mozilla-central
repo_url: https://hg.mozilla.org/mozilla-central

Comment 7

[Calixte Denizet (:calixte)]

This crash is ranked #3 in nightly top-crashers for browser process.

Comment 8

[Marcia Knous [:marcia]]

We have now eclipsed over 1300 crashes on nightly since I filed this bug. Should we consider backing this out?

Comment 9

[Shane Caraveo (:mixedpuppy)]

(In reply to Marcia Knous [:marcia - use ni] from comment #8)
> We have now eclipsed over 1300 crashes on nightly since I filed this bug.
> Should we consider backing this out?

Yes, I am still investigating the best approach to addressing this.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Bug 1305237 backed out. This will be in the next nightly build.
https://hg.mozilla.org/mozilla-central/rev/307a7a34013060a6a1e87dfbb911f058d0781a2e

Comment 11

[Chris Peterson [:cpeterson]]

For posterity, my STR to reproduce this crash was:

1. Install the "User-Agent Switcher (revived)" extension: https://addons.mozilla.org/firefox/addon/user-agent-switcher-revived/
2. Load http://www.androidpolice.com/
3. Enter "firefox" in the page's search field and press ENTER.

RESULT:
Crash! bp-97ad15a0-e0ae-4f80-b90e-189eb0170928

Comment 12

[Victor Carciu]

I was able to reproduce the issue using 20170928100123 and steps presented in comment #4 and comment #11. 
I verified the fix in 20171120142222 (Build identifier: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0) and I can confirm that no crash was encountered using any of the scenarios from above.

Please let me know if any other testing is needed and if not, I will mark this as verified.

Comment 13

[Shane Caraveo (:mixedpuppy)]

Nothing more needed.

Comment 14

[Victor Carciu]

(In reply to Shane Caraveo (:mixedpuppy) from comment #13)
> Nothing more needed.

Thank you