Crash in mozilla::extensions::ChannelWrapper::GetFrameAncestors const

VERIFIED FIXED in Firefox 58

Status

defect
P1
critical
VERIFIED FIXED
2 years ago
Last year

People

(Reporter: marcia, Assigned: mixedpuppy)

Tracking

({crash, topcrash})

Trunk
mozilla58
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox55 unaffected, firefox56 unaffected, firefox57 unaffected, firefox58 verified)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-5ea7a97b-1b84-4e11-9448-e8cc20170928.
=============================================================

Seen while looking at nightly crash stats: http://bit.ly/2ftbKZZ. Crashes started using 20170928100123 

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35fbf14b96a633c3f66ea13c1a163a3f3a4219b9&tochange=76a26ef7c493311c170ae83eb0c1d6592a21396d

Comments:

www.speedcurve.com 
I went to pqi.org and clicked one of the calendar events, a colloquium by christopher white, on the left-hand side of the page. second time in a row that this caused a crash. 

Possibly Bug 1305237? ni on Shane
Flags: needinfo?(mixedpuppy)
This crash affects Linux as well, not sure about Windows since I don't see the builds yet in https://dbaron.org/mozilla/crashes-by-build.
Affects Android as well.
Changing OS to all since this affects Windows. Adding Windows signature.
Crash Signature: [@ mozilla::extensions::ChannelWrapper::GetFrameAncestors const] → [@ mozilla::extensions::ChannelWrapper::GetFrameAncestors const] [@ mozilla::extensions::ChannelWrapper::GetFrameAncestors]
OS: Mac OS X → All
Hardware: Unspecified → All
This appears to be a REGRESSION!

I also experienced some crashes, same crash signature.

Problematic site:  wishtv.com

I am on Nightly 58.0a1 (2017-09-28) (64-bit), Build ID 20170928100123 running on Windows 7 Home Premium SP1 (64-bit).

Use my usual profile (with add-ons, including uBlock Origin). Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. Firefox CRASHES. (Not just the process, the whole Firefox.)

Create a new profile. Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. No Crash. (But I note that the Cylon's eye is in constant motion all the time.) 

Create a new profile. Add the uBlock Origin extension. Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. Firefox CRASHES.

Create a new profile. Add the latest AdBlock Plus beta (WebExtensions) extension. Navigate to wishtv.com. Click on the NFL story. Click on the Previous Page Icon. Firefox CRASHES.

These are today's crash reports:

https://crash-stats.mozilla.com/report/index/bp-e161dd1d-d05a-4f1e-846f-f27270170928
https://crash-stats.mozilla.com/report/index/bp-87cd1656-bed2-46a3-a632-8c9d70170928
https://crash-stats.mozilla.com/report/index/bp-d6f6d2ff-b70c-4ed7-aea2-754750170928
https://crash-stats.mozilla.com/report/index/bp-53073ed8-6062-4d12-b25b-7101c0170928
https://crash-stats.mozilla.com/report/index/bp-c798acd4-c4dc-4d22-975c-b04660170928

All of these have Signature: mozilla::extensions::ChannelWrapper::GetFrameAncestors

(Sorry, the crash report pop-up kept on being a pop-under and I lost track of which crash corresponds to which scenarios.)


I repeated the exercise with the Beta 57.0b3 (64-bit) Build ID 20170925150345, again with new profile, new profile + uBlock Origin, new profile + AdBlock Plus. But there were no crashes in any of these attempts in Beta.

If this is different from the bug reported above, let me know. Otherwise, I am going to try a mozregression-gui.
Mark, thank you for a consistent reproduction.  No need to do further investigation.
Flags: needinfo?(mixedpuppy)
Assignee: nobody → mixedpuppy
Priority: -- → P1
I ran a mozregession-gui using the New Profile + uBlock Origin as the profile to clone (so I don't have to keep on adding uBlock Origin on each iteration). I opened a new tab, navigated to wishtv.com, clicked on the NFL story, clicked the back arrow (the Previous Page icon left of the address bar), a success was navigated back to the wishtv.com home page; a failure was a crash.

Attached: the log of the regression (mozregression-gui-log.txt).

For what it's worth, the end of the log points to:

> Bug 1305237 Expose frameAncestors to webextensions, r=bz,kmag
> 
> MozReview-Commit-ID: HpneTIKPoS1


This (below) is from the "Bisection Informations:


app_name: firefox
build_date: 2017-09-27
build_file: C:\Users\Mark12547\.mozilla\mozregression\persist\2017-09-27--mozilla-central--firefox-58.0a1.en-US.win64.zip
build_type: nightly
build_url: https://archive.mozilla.org/pub/firefox/nightly/2017/09/2017-09-27-10-01-20-mozilla-central/firefox-58.0a1.en-US.win64.zip
changeset: 35fbf14b96a633c3f66ea13c1a163a3f3a4219b9
pushlog_url: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=35fbf14b96a633c3f66ea13c1a163a3f3a4219b9&tochange=76a26ef7c493311c170ae83eb0c1d6592a21396d
repo_name: mozilla-central
repo_url: https://hg.mozilla.org/mozilla-central
This crash is ranked #3 in nightly top-crashers for browser process.
Keywords: topcrash
Blocks: 1305237
We have now eclipsed over 1300 crashes on nightly since I filed this bug. Should we consider backing this out?
(In reply to Marcia Knous [:marcia - use ni] from comment #8)
> We have now eclipsed over 1300 crashes on nightly since I filed this bug.
> Should we consider backing this out?

Yes, I am still investigating the best approach to addressing this.
Bug 1305237 backed out. This will be in the next nightly build.
https://hg.mozilla.org/mozilla-central/rev/307a7a34013060a6a1e87dfbb911f058d0781a2e
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
For posterity, my STR to reproduce this crash was:

1. Install the "User-Agent Switcher (revived)" extension: https://addons.mozilla.org/firefox/addon/user-agent-switcher-revived/
2. Load http://www.androidpolice.com/
3. Enter "firefox" in the page's search field and press ENTER.

RESULT:
Crash! bp-97ad15a0-e0ae-4f80-b90e-189eb0170928
I was able to reproduce the issue using 20170928100123 and steps presented in comment #4 and comment #11. 
I verified the fix in 20171120142222 (Build identifier: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0) and I can confirm that no crash was encountered using any of the scenarios from above.

Please let me know if any other testing is needed and if not, I will mark this as verified.
Flags: needinfo?(mixedpuppy)
Nothing more needed.
Flags: needinfo?(mixedpuppy)
(In reply to Shane Caraveo (:mixedpuppy) from comment #13)
> Nothing more needed.

Thank you
Status: RESOLVED → VERIFIED
Product: Toolkit → WebExtensions
You need to log in before you can comment on or make changes to this bug.