276895 - crash on opening new tab (after delay) when permit cookies is installed

Status: RESOLVED EXPIRED

(Firefox :: General, defect)

Description

[Alexey Spiridonov]

The repro steps are somewhat dodgy, so please give it a couple of tries before
giving up. A backtrace follows.

1. Start a fresh firefox (new window wasn't enough for me).

2. Go to http://www.pctex.com/help.html. Not much special about this site, it's
happened on plenty others. 

3. Open a second tab, point it to, say, www.google.com. This is somewhat
optional, but it seems to help.

4. Go back to the first tab. Make sure you don't submit garbage requests to
these guys, it's not their fault that page is a convenient test case.  Now, fill
in form say, like so:

name: arg
e-mail: [e-mail]
question: here, you type stuff like:
 asdjkla d/.as d.kjas. .asdj kas.jkasd .kasjd .asdk .asd kjkadsjsda .ks ajksadk  
 j.ksad jksadk. kasdjkladsl .asd jljlk. kj jasdklasdkladskladslk ,as dm.askd 
 jaks.djpiewifj.dsflkj
for about a MINUTE, continuously. Use the arrow keys and edit your text a little
too, seems to help. Feel free to quote Shakespeare, or other text instead. It
seems to be important that you type stuff (or in general, use this tab -- i.e.
i've seen it happen by searching bugzilla in a single-tab window, and then
opening another tab) for a while. Otherwise the crash doesn't happen. 

5. When you've had enough typing, hit Ctrl-T to open a new tab, and type, say
"g" in the location bar. This is usually enough for it to crash. I have "g"
keyworded to search google, but that doesn't seem to be relevant. My location
history does have stuff that comes up on "g". 

In the 20 or so times I've reproduced this, the backtrace is always the same:

#0  0x4ee09651 in kill () from /lib/libc.so.6
#1  0x4f0876fd in pthread_kill () from /lib/libpthread.so.0
#2  0x4f087a51 in raise () from /lib/libpthread.so.0
#3  0x0805596b in nsProfileLock::FatalSignalHandler ()
#4  0x4f08a361 in __pthread_sighandler () from /lib/libpthread.so.0
#5  <signal handler called>
#6  0x40f0f6a2 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libcookie.so
#7  0x40f0d94e in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libcookie.so
#8  0x40110abd in XPTC_InvokeByIndex ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#9  0x40660898 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libxpconnect.so
#10 0x40667407 in NSGetModule ()
   from /usr/lib/MozillaFirefox/components/libxpconnect.so
#11 0x4003918c in js_Invoke () from /usr/lib/MozillaFirefox/libmozjs.so
#12 0x40042f27 in js_Interpret () from /usr/lib/MozillaFirefox/libmozjs.so
#13 0x4003925f in js_Invoke () from /usr/lib/MozillaFirefox/libmozjs.so
#14 0x40039529 in js_InternalInvoke () from /usr/lib/MozillaFirefox/libmozjs.so
#15 0x40016812 in JS_CallFunctionValue ()
   from /usr/lib/MozillaFirefox/libmozjs.so
#16 0x40d80e61 in nsJSContext::CallEventHandler ()
   from /usr/lib/MozillaFirefox/components/libgklayout.so
#17 0x40d925bd in GlobalWindowImpl::RunTimeout ()
   from /usr/lib/MozillaFirefox/components/libgklayout.so
#18 0x40d92af8 in GlobalWindowImpl::TimerCallback ()
   from /usr/lib/MozillaFirefox/components/libgklayout.so
#19 0x400fb3bb in nsTimerImpl::Fire () from /usr/lib/MozillaFirefox/libxpcom.so
#20 0x400fb426 in handleTimerEvent () from /usr/lib/MozillaFirefox/libxpcom.so
#21 0x400f72b7 in PL_HandleEvent () from /usr/lib/MozillaFirefox/libxpcom.so
#22 0x400f71fb in PL_ProcessPendingEvents ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#23 0x400f8c33 in nsEventQueueImpl::NotifyObservers ()
   from /usr/lib/MozillaFirefox/libxpcom.so
#24 0x405d03d1 in nsBaseWidget::FreeNativeData ()
   from /usr/lib/MozillaFirefox/components/libwidget_gtk2.so
#25 0x4e76b89b in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#26 0x4e748f72 in unblock_source () from /usr/lib/libglib-2.0.so.0
#27 0x4e749f89 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#28 0x4e74a2a6 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#29 0x4e74a87c in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#30 0x4e9da3e7 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#31 0x405d07a0 in nsAppShell::ReleaseGlobals ()
   from /usr/lib/MozillaFirefox/components/libwidget_gtk2.so
#32 0x4050428c in ?? ()
   from /usr/lib/MozillaFirefox/components/libnsappshell.so
#33 0x08098128 in ?? ()
#34 0x0805800c in data_start ()
#35 0xbffff678 in ?? ()
#36 0x08050c6a in xre_main ()
Previous frame identical to this frame (corrupt stack?)

My extension list: DOM Inspector, Flashblock, Permit Cookies
Plugins: Flash 7.0 r25, DjVuLibre-3.5.12

Unfortunately, I'm not in a position to make a debug build and give very
detailed info, or track down the bug. However, I can test patches on release
builds.

Comment 1

[Alexey Spiridonov]

Ok, scratch that. There's a much simpler way to reproduce it on my system
(neither seems to work on a Windows install I tried). 

1. Open a fresh firefox (mine opens to a blank page, single tab). 
2. Let it sit a couple of minutes (say, switch to another app and work there).
3. Hit Ctrl-T to open a new tab. It opens the tab and crashes.

Same backtrace.

Comment 2

[Alexey Spiridonov]

It turns out that an extension is the culprit after all. 

I've tried working with a clean profile, and the problem appears only when
"Permit Cookies" is installed. Since this extension is pure XUL/JS, I think this
is a bug nonetheless: JS/XUL shouldn't be able to crash firefox.

I'm notifying the author of this bug. I hope he will offer some comments.

Comment 3

[Alexey Spiridonov]

Does not happen with Permit Cookies 0.2.1, only with PC 0.4.

Comment 4

[Martijn Wargers (dead)]

I especially installed this extension for this bug.
I think this crash is related. Talkback ID: TB3043902E

nsPermissionManager::GetHost 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/extensions/cookie/nsPermissionManager.cpp,
line 959]
nsPermissionManager::TestPermission 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/extensions/cookie/nsPermissionManager.cpp,
line 379]
XPTC_InvokeByIndex 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp,
line 102]
XPCWrappedNative::CallMethod 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednative.cpp,
line 2034]
XPC_WN_CallMethod 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/xpconnect/src/xpcwrappednativejsops.cpp,
line 1287]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1293]
js_Interpret 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 3565]
js_Invoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsinterp.c, line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/js/src/jsapi.c, line 3804]
nsJSContext::CallEventHandler 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1352]
nsGlobalWindow::RunTimeout 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5215]
nsGlobalWindow::TimerCallback 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/dom/src/base/nsGlobalWindow.cpp,
line 5576]
nsAppStartup::Run 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 147]
main 
[c:/builds/tinderbox/firefox/WINNT_5.0_Clobber/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7c59893d)

It happened when I posted a message on the mozillazine forums.

Comment 5

[Martijn Wargers (dead)]

I think this is related to bug 243385.

Comment 6

[Grendel]

Hi,
I have the same issue, FF crashes approx. once an hour.

installed extensions: 
permit cookies 0.4
quick note 0.6
blogthis 0.3
allinone gestures 0124
adblock 5d2n39
infolister 08

Mozilla/5.0 (Windows; U; Windows NT 5.1; de-DE; rv:1.7.6) Gecko/20050223
Firefox/1.0.1

Happens very often, but is not always reproducible. Usually you get a probable
crash when rightclick-opening a new tab with a saved password/form site.
Talkback kicks in, I send reports... but no fix yet ;-)

Talkback IDs: TB4032087G TB4026875X TB4026875X among others... :-)

HTH

Comment 7

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 8

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.