Closed Bug 1989840 Opened 5 months ago Closed 5 months ago

Firefox 140.3.0 crashes on startup with Notefox

Categories

(WebExtensions :: Storage, defect, P2)

Firefox 140
defect

Tracking

(relnote-firefox 143+, firefox-esr115 unaffected, firefox-esr140144+ verified, firefox143 verified, firefox144 verified, firefox145 verified)

VERIFIED FIXED
145 Branch
Tracking Status
relnote-firefox --- 143+
firefox-esr115 --- unaffected
firefox-esr140 144+ verified
firefox143 --- verified
firefox144 --- verified
firefox145 --- verified

People

(Reporter: thunderbird64bit, Assigned: bdk)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, Whiteboard: [fxsync-])

Attachments

(10 files, 3 obsolete files)

38.01 KB, image/png
Details
57 bytes, text/x-github-pull-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
57 bytes, text/x-github-pull-request
Details | Review
57 bytes, text/x-github-pull-request
Details | Review
990 bytes, application/zip
Details
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0

Steps to reproduce:

  • Install Firefox ESR 140.3.0
  • Install Notefox 4.5.0.5
  • Restart Firefox
  • Instant crash
Attached image Crash Firefox.png β€”
Component: Untriaged → General
Product: Firefox → WebExtensions

According to bp-baa95ec0-e647-4481-b202-44d560250918

the crash is initiated in a call in

that code was recently change in bug 1953191 , with the diff at https://searchfox.org/firefox-main/diff/3eb9ddea6a117649a38702da8cbbe6b034dc53af/third_party/rust/webext-storage/src/lib.rs#38
The original change was made in https://github.com/mozilla/application-services/commit/d15375f68f2686be9be8548485c22f881b0e477e

:bdk, as the author of that change, can you take a look at this bug to see what could have happened and what we should do here?

--

The extension in this STR is https://addons.mozilla.org/en-US/firefox/addon/websites-notes/ and it seems to only pass JSON-serializable values to browser.storage.sync.set (in its source code, search for sync.set( and sync_local.set( for usage - crxviewer link.

Component: General → Storage
Flags: needinfo?(bdeankawamura)
See Also: → 1953191

I see recursion limit exceeded in the error message. Looks like the JSON data was too deeply nested for serde or something like that? I think we should a) make sure we don't crash in this scenario and b) consider increasing the limit. I'll try to find some webextstorage devs to look at this one.

Flags: needinfo?(bdeankawamura)

Hello,

I could not reproduce the issue on the latest ESR 140.3.0 under Windows 11.

I tried the STR with both version 4.4.3 of Notefox from AMO (as version 4.5.0.5 is not available on AMO) and versions 4.5.3 and 4.5.0.3 from https://github.com/Sav22999/websites-notes/releases (version 4.5.0.5 is not available there either). No crashes occurred once the browser restarted.

Hi guys,

I'm the developer of Notefox.

Some information: users reported the crash only on Windows and not everyone can reproduce the crash (someone gets the issue after some days).

I am available to get you help to fix this issue/crash, because it's causing some users reviewed negatively the add-on and some users stopped to use it. Please, fix this as priority

Hello, Iβ€―have the issue with Zenbrowser. After activating the extension, the browser crashes in few seconds. The same if I deactivate the other extensions. Win 10 64 bits.

Assignee: nobody → bdeankawamura
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Whiteboard: [fxsync-]

(In reply to Saverio Morelli from comment #5)

Hi guys,

I'm the developer of Notefox.

Some information: users reported the crash only on Windows and not everyone can reproduce the crash (someone gets the issue after some days).

I am available to get you help to fix this issue/crash, because it's causing some users reviewed negatively the add-on and some users stopped to use it. Please, fix this as priority

Are you able to provide reproduction steps?

In comment 3, another Firefox engineer pointed towards potential recursion limits. Does your extension have deeply nested objects, or even circular values?

Blocks: 1990313

Going through the crashes, I see many recursion limit errors, all with the exact same message: "recursion limit exceeded", line: 1, column: 1524. It seems like a very specific JSON string is causing this, but I'm not sure which. I also see a single lone leading surrogate in hex escape, which seems to point to invalid unicode data.

I'm going to split this into 2 parts. For this bug, I'm going to fix the crash. This seems to be the worst issue. However, if we're failing to parse the JSON, then there will almost certainly be other issues. I made https://bugzilla.mozilla.org/show_bug.cgi?id=1990313 to work through those.

I'll echo Rob, if we can get steps to reproduce then it would really help.

(In reply to Rob Wu [:robwu] from comment #7)

(In reply to Saverio Morelli from comment #5)

Hi guys,

I'm the developer of Notefox.

Some information: users reported the crash only on Windows and not everyone can reproduce the crash (someone gets the issue after some days).

I am available to get you help to fix this issue/crash, because it's causing some users reviewed negatively the add-on and some users stopped to use it. Please, fix this as priority

Are you able to provide reproduction steps?

In comment 3, another Firefox engineer pointed towards potential recursion limits. Does your extension have deeply nested objects, or even circular values?

This is an example of JSON used:

{"notefox":{"version":"4.5.0.5","author":"Saverio Morelli (Sav22999)","manifest_version":2,"os":"mac","browser":"firefox"},"settings":{"open-default":"page","consider-parameters":false,"consider-sections":false,"open-popup-default":"Ctrl+Alt+O","open-popup-domain":"Ctrl+Alt+D","open-popup-page":"Ctrl+Alt+P","advanced-managing":true,"html-text-formatting":true,"save-page-content":false,"search-page-content":false,"disable-word-wrap":false,"spellcheck-detection":false,"theme":"light","sticky-theme":"yellow","check-green-icon-global":true,"check-green-icon-domain":true,"check-green-icon-page":true,"check-green-icon-subdomain":true,"change-icon-color-based-on-tag-colour":false,"open-links-only-with-ctrl":true,"check-with-all-supported-protocols":false,"font-family":"Shantell Sans","show-title-textbox":false,"immersive-sticky-notes":true,"notes-background-follow-tag-colour":false,"datetime-format":"yyyymmdd1","sending-error-logs-automatically":true,"send-telemetry":false,"undo-redo":true,"bold-italic-underline-strikethrough":true,"link":true,"spellcheck":true,"superscript-subscript":false,"headers":false,"small-big":false,"highlighter":false,"code-block":false,"default-tag-colour-domain":"none","default-tag-colour-page":"none"},"websites":{"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6/all-notes/index.html":{"notes":"this is a \"page\" note","last-update":"2025-09-23 22:43:05","tag-colour":"none","sticky":false,"minimized":false,"type":2,"domain":"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6","title":"Notefox - All notes"},"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6":{"notes":"this is a \"domain\" note","last-update":"2025-09-23 22:43:17","tag-colour":"none","sticky":false,"minimized":false,"type":1,"domain":""},"**global":{"notes":"this is a \"global\" note","last-update":"2025-09-23 22:43:23","tag-colour":"none","sticky":false,"minimized":false,"type":0,"domain":""},"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6/all-notes/*":{"notes":"this is a \"subdomain\" note","last-update":"2025-09-23 22:43:30","tag-colour":"none","sticky":false,"minimized":false,"type":2,"domain":"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6"},"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6/all-notes/index.html/*":{"notes":"this is a \"subdomain\" note","last-update":"2025-09-23 22:43:38","tag-colour":"none","sticky":false,"minimized":false,"type":2,"domain":"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6"}},"sticky-notes":{"sizes":{"w":"300px","h":"300px"},"opacity":{"value":"0.70"}},"storage":"local","last-update":"2025-09-23 22:43:38"}

(In reply to Saverio Morelli from comment #10)

(In reply to Rob Wu [:robwu] from comment #7)

(In reply to Saverio Morelli from comment #5)

Hi guys,

I'm the developer of Notefox.

Some information: users reported the crash only on Windows and not everyone can reproduce the crash (someone gets the issue after some days).

I am available to get you help to fix this issue/crash, because it's causing some users reviewed negatively the add-on and some users stopped to use it. Please, fix this as priority

Are you able to provide reproduction steps?

In comment 3, another Firefox engineer pointed towards potential recursion limits. Does your extension have deeply nested objects, or even circular values?

This is an example of JSON used:

{"notefox":{"version":"4.5.0.5","author":"Saverio Morelli (Sav22999)","manifest_version":2,"os":"mac","browser":"firefox"},"settings":{"open-default":"page","consider-parameters":false,"consider-sections":false,"open-popup-default":"Ctrl+Alt+O","open-popup-domain":"Ctrl+Alt+D","open-popup-page":"Ctrl+Alt+P","advanced-managing":true,"html-text-formatting":true,"save-page-content":false,"search-page-content":false,"disable-word-wrap":false,"spellcheck-detection":false,"theme":"light","sticky-theme":"yellow","check-green-icon-global":true,"check-green-icon-domain":true,"check-green-icon-page":true,"check-green-icon-subdomain":true,"change-icon-color-based-on-tag-colour":false,"open-links-only-with-ctrl":true,"check-with-all-supported-protocols":false,"font-family":"Shantell Sans","show-title-textbox":false,"immersive-sticky-notes":true,"notes-background-follow-tag-colour":false,"datetime-format":"yyyymmdd1","sending-error-logs-automatically":true,"send-telemetry":false,"undo-redo":true,"bold-italic-underline-strikethrough":true,"link":true,"spellcheck":true,"superscript-subscript":false,"headers":false,"small-big":false,"highlighter":false,"code-block":false,"default-tag-colour-domain":"none","default-tag-colour-page":"none"},"websites":{"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6/all-notes/index.html":{"notes":"this is a \"page\" note","last-update":"2025-09-23 22:43:05","tag-colour":"none","sticky":false,"minimized":false,"type":2,"domain":"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6","title":"Notefox - All notes"},"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6":{"notes":"this is a \"domain\" note","last-update":"2025-09-23 22:43:17","tag-colour":"none","sticky":false,"minimized":false,"type":1,"domain":""},"**global":{"notes":"this is a \"global\" note","last-update":"2025-09-23 22:43:23","tag-colour":"none","sticky":false,"minimized":false,"type":0,"domain":""},"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6/all-notes/*":{"notes":"this is a \"subdomain\" note","last-update":"2025-09-23 22:43:30","tag-colour":"none","sticky":false,"minimized":false,"type":2,"domain":"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6"},"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6/all-notes/index.html/*":{"notes":"this is a \"subdomain\" note","last-update":"2025-09-23 22:43:38","tag-colour":"none","sticky":false,"minimized":false,"type":2,"domain":"moz-extension://1f8c4867-ed60-4442-893d-0b07160f89d6"}},"sticky-notes":{"sizes":{"w":"300px","h":"300px"},"opacity":{"value":"0.70"}},"storage":"local","last-update":"2025-09-23 22:43:38"}

Instead, I don't know specific steps to reproduce the bug, because it happens "randomly" to users (someone told me after they deleted firefox profile and created a new one, the add-on didn't crash anymore for a while).
I've asked to users to write here their experience with the crash, so maybe they can help you to find steps to reproduce the crash (I use a macbook and on my-side I wasn't/am not able to get the crash).

Thanks

Status: ASSIGNED → RESOLVED
Closed: 5 months ago
Flags: qe-verify+
Resolution: --- → FIXED

This was fixed in the app-services code, but I wanted to add some JS
tests to make sure we don't regress.

Reopening this until the upstream code gets vendored.

Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Attached file storage-sync-nested.zip β€”

STR:

  1. Load attached extension at about:debugging.

Expected:

  • Firefox should not crash

Actual:

  • Firefox crashes

Note: the relevant part of the test is the part that creates a deeply nested object:


a = {};
for (let i = 0, current = a; i < 126; ++i) {
  const next = {};
  current.a = next;
  current = next;
}
browser.storage.sync.set({ a })

I identified the regressor with mozregression: bug 1888472. Before the change, the API call threw an error. After the change, Firefox crashes.

10:29.60 INFO: Last good revision: 9373fb1b31f59943239a307b620aa22715db1e8e
10:29.60 INFO: First bad revision: 8d3854141ccc463c3a5170669430a1437f962cc0
10:29.60 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9373fb1b31f59943239a307b620aa22715db1e8e&tochange=8d3854141ccc463c3a5170669430a1437f962cc0

Keywords: regression
Regressed by: 1888472

That was my change--sorry about that. Thanks for fixing this, :bdk.

Flags: needinfo?(bdeankawamura)
Flags: needinfo?(bdeankawamura)
  • Updated Cargo.toml to point to the app-services commit with the fix
  • Reverted my default rust to 1.86.0
  • Ran ./mach configure and ./mach vendor rust
Attachment #9516191 - Flags: approval-mozilla-esr140?
  • Did not updated Cargo.toml, since it's points to a branch.
  • Ran cargo update -p context_id -p error-support -p filter_adult -p interrupt-support -p relevancy -p search -p sql-support -p suggest -p tabs -p tracing-support -p viaduct -p webext-storage to update app-services versions.
  • Reverted my default rust to 1.86.0
  • Ran ./mach configure and ./mach vendor rust
Attachment #9516192 - Flags: approval-mozilla-release?
  • Updated Cargo.toml to point to the app-services commit with the fix
  • Set the rust version to 1.89.0
  • Ran ./mach bootstrap ./mach configure and ./mach vendor rust
Attachment #9516193 - Flags: approval-mozilla-beta?

firefox-esr140 Uplift Approval Request

  • User impact if declined: Crash in Firefox when extensions try to save data.
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: This is just a one line Rust change from .unwrap() to ?.
  • String changes made/needed: None
  • Is Android affected?: no
Attachment #9516197 - Flags: approval-mozilla-esr140?
  • Updated Cargo.toml to point to the app-services commit with the fix
  • Reverted my default rust to 1.86.0
  • Ran ./mach configure and ./mach vendor rust

Original Revision: https://phabricator.services.mozilla.com/D266197

firefox-release Uplift Approval Request

  • User impact if declined: Crash in Firefox when extensions try to save data.
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: This is just a one line Rust change from .unwrap() to ?.
  • String changes made/needed: None
  • Is Android affected?: no
Attachment #9516198 - Flags: approval-mozilla-release?
  • Did not updated Cargo.toml, since it's points to a branch.
  • Ran cargo update -p context_id -p error-support -p filter_adult -p interrupt-support -p relevancy -p search -p sql-support -p suggest -p tabs -p tracing-support -p viaduct -p webext-storage to update app-services versions.
  • Reverted my default rust to 1.86.0
  • Ran ./mach configure and ./mach vendor rust

Original Revision: https://phabricator.services.mozilla.com/D266199

firefox-beta Uplift Approval Request

  • User impact if declined: Crash in Firefox when extensions try to save data.
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: This is just a one line Rust change from .unwrap() to ?.
  • String changes made/needed: None
  • Is Android affected?: no
Attachment #9516199 - Flags: approval-mozilla-beta?
  • Updated Cargo.toml to point to the app-services commit with the fix
  • Set the rust version to 1.89.0
  • Ran ./mach bootstrap ./mach configure and ./mach vendor rust

Original Revision: https://phabricator.services.mozilla.com/D266200

Attachment #9516197 - Attachment is obsolete: true
Attachment #9516197 - Flags: approval-mozilla-esr140?
Attachment #9516198 - Attachment is obsolete: true
Attachment #9516198 - Flags: approval-mozilla-release?
Attachment #9516199 - Attachment is obsolete: true
Attachment #9516199 - Flags: approval-mozilla-beta?

I'm not sure why, but I had to use ./mach vendor force for a seemingly unrelated error:

0:09.46 E Vet error: There are some issues with your policy.audit-as-crates-io entries
 0:10.23  related error: Some non-crates.io-fetched packages match published crates.io versions
  mtu:0.2.9@git:b3d8f0d21db5657ebafb14f9b60c8892d2eb3aa9
Attachment #9516193 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9516192 - Flags: approval-mozilla-release? → approval-mozilla-release+
Attachment #9516191 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+

Verified as Fixed. Tested on the latest Beta (144.0b6/20250925193047 from https://treeherder.mozilla.org/jobs?repo=mozilla-beta&revision=ded84973fa47d2f7a5372aa9ec150d28954b5ac3), Release (143.0.3/20250925195835 from https://treeherder.mozilla.org/jobs?repo=mozilla-release&revision=532de6796f942901e3943d4d241b84bcaf670ae7) and ESR (140.4.0esr/20250926042521 from https://treeherder.mozilla.org/jobs?repo=mozilla-esr140&revision=749c9205fb7f0d8ce362c52d501f63ffc952e6b8) under Windows 11.

Using the STR and extension from Comment 17, the browser does not crash, confirming the fix.

I see the report is set to Reopened and not to Resolved, although tracking shows 3 versions as fixed. I will mark it as Verified once it’s set to Resolved noting that the fix was successful as per the info above.

(In reply to Alex Cornestean from comment #33)

I see the report is set to Reopened and not to Resolved, although tracking shows 3 versions as fixed. I will mark it as Verified once it’s set to Resolved noting that the fix was successful as per the info above.

The fixes have landed. Perhaps the bug was not automatically closed because the vendoring landed without bug ID? (comment 29).

There is also an approved unit test that has yet to land, once that lands the bot should close/resolve the bug anyway.

QA Whiteboard: [qa-triage-done-c145/b144]
Pushed by smolnar@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/3baf42b58008 https://hg.mozilla.org/integration/autoland/rev/02330a505984 Revert "Bug 1989840 - Adding JS tests, r=markh,robwu" for causing xpc failures @ test_ext_storage_local.js

This is passing for me locally. :robwu any ideas why this is failing in CI?

Flags: needinfo?(bdeankawamura)
Flags: needinfo?(rob)

The RunListener error is a sign that the test ends before an event was dispatched and handled.

In this specific test, there is a storage.onChanged handler. Every method that mutates storage should await the propagation of the event before continuing, but that is currently not happening after the storage.set calls in the newly added testDeeplyNestedObject test. See other storage.set (or storage.remove) calls in the same file to see how you can await the right thing.

Flags: needinfo?(rob)

A user reported he got the first Firefox crash with the following error:

Firefox 139.0.1 Crash Report [@ core::result::unwrap_failed | webext_storage::impl$55::try_lift ]

(He wrote on the Mozilla Italia forum https://forum.mozillaitalia.org/index.php?topic=79638.new;topicseen#new in Italian)

Firefox 139.0.1 Crash Report [@ core::result::unwrap_failed | webext_storage::impl$55::try_lift ]
Crash ID: 571392d4-d6ed-4458-80b7-5a08e0250608

Firefox 139.0.1 Crash Report [@ core::result::unwrap_failed | webext_storage::impl$55::try_lift ]
Crash ID: eec26b03-6cba-4730-bb54-a3a6f0250608

Please stop posting crash reports from 139.0.1. It's not a version that will ever see this fix. The 143.0.3 release due to ship tomorrow should contain this fix as well as the 140.4esr release due to ship in 2 weeks. If those versions still continue to crash, that would be useful information to have in this bug.

Thanks Rob wu, I think the tests are passing now: https://treeherder.mozilla.org/jobs?repo=try&revision=50b4ba95feedcd6843b647fa31bd4ccc437544c4. I'm going to try landing this again now.

Pushed by abutkovits@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/28d8ef85d861 https://hg.mozilla.org/integration/autoland/rev/8f95067809f1 Revert "Bug 1989840 - Adding JS tests, r=markh,robwu" for causing xpcshell failures at test_ext_storage_sync.js.

Added to the 143.0.3 relnotes.

Flags: qe-verify+
Severity: -- → S3
Priority: -- → P2

I'm still working on getting the tests to pass. Rob had some suggestions in the phabricator patch (thanks!), here's a try run with them: https://treeherder.mozilla.org/jobs?repo=try&landoCommitID=156168

Flags: needinfo?(bdeankawamura)
Status: REOPENED → RESOLVED
Closed: 5 months ago5 months ago
Resolution: --- → FIXED
Target Milestone: --- → 145 Branch
Flags: in-testsuite+

Verified as Fixed. Tested on the latest Nightly (145.0a1/20251002211313) under Windows 11.

Using the STR and extension from Comment 17, the browser does not crash, confirming the fix.

Also, as per Comment 33, setting FX144, FX143 and ESR 140 as Verified.

You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: