open in tabs crashes - Trunk [@ js_Interpret ]

VERIFIED FIXED

Status

()

Core
JavaScript Engine
--
critical
VERIFIED FIXED
13 years ago
12 years ago

People

(Reporter: Peter6, Assigned: brendan)

Tracking

({crash, regression, topcrash+})

Trunk
crash, regression, topcrash+
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

13 years ago
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050308
Firefox/1.0+ 00:17 PST

open build
open in tabs
crash

talkback TB4193768G
(Reporter)

Updated

13 years ago
Keywords: regression

Comment 1

13 years ago
Seems to be windows only bug.

WFM - Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2)
Gecko/20050308 Firefox/1.0+

One hour old homemade build.
(Reporter)

Comment 2

13 years ago
regressed between
20050307 07:36 PST and 20050308 00:17 PST

I tried a later build to rule out bad .zip, same crash
WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050308
Firefox/1.0+

However, with TabMix extension installed opening a new tab causes firefox to
bail. Which is TabMix's problem I guess. (Not that it's even meant to work on
the trunk, but anyway..)

Comment 4

13 years ago
Peter, could you reproduce with clean install and new profile?

TB4193768G:
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 2635]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 3804]
nsJSContext::CompileFunction 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1340]
nsNodeInfo::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsNodeInfo.cpp,
line 116]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1499]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1632]
nsXULElement::GetResource 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2148]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6257]
nsMenuFrame::OnCreate 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1690]
nsMenuFrame::ToggleMenuState 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 533]
PresShell::AddOverrideStyleSheet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6220]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5940]
nsViewManager::MoveViewTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2778]
nsViewManager::BuildDisplayList 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2401]
nsView::GetClippedRect 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
946]
nsWindow::InitEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1055]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5438]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5674]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1377]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Observe 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 472]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7962893d)
Summary: [crash] open in tabs → [crash] open in tabs [@ js_Interpret ]
(Reporter)

Comment 5

13 years ago
Adam, no, works with clean profile.
I'm at work so I can't extensively test but found that disabling MiniT 0.5
drag&indicator ( http://v2studio.com/k/moz/ ) fixes the problem.
Also undoclosedtab seems to cause crashes when closing tabs. I guess a few
extensions are going to need reworked.

Comment 7

13 years ago
Okay, I'm marking this bug as WFM.

If you want, contact authors of extensions and provide them info about crashes.
Status: NEW → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → WORKSFORME

Comment 8

13 years ago
As far as I understand, crash bugs should not be resolved WFM just because they
are caused by an extension.
Status: RESOLVED → REOPENED
Keywords: crash
Resolution: WORKSFORME → ---

Comment 9

13 years ago
Happens on Linux as well, so All/All. I guess Tabbrowser Extensions is the
culprit in my case.

Also note that this bug happens even when starting Firefox in safe mode. So I
can't even disable extensions and have it work. The only thing that works is a
new profile.
OS: Windows 2000 → All
Hardware: PC → All
(Reporter)

Comment 10

13 years ago
CC -> Bzbarsky
Prime suspect bug 285188

Updated

13 years ago
Assignee: firefox → events
Status: REOPENED → NEW
Component: General → DOM: Events
Product: Firefox → Core
QA Contact: general → ian
Summary: [crash] open in tabs [@ js_Interpret ] → open in tabs crashes [@ js_Interpret ]
Eh?  What does that have to do with this bug?  Do you actually have a reason for
the suspicion?  A regression range (with hours!), say?

The stack in comment 4 is clearly bogus:

PresShell::AddOverrideStyleSheet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6220]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5940]
nsViewManager::MoveViewTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2778]

There is no call into presshell from MoveViewTo.   There is no call to
AddOverrideStyleSheet anywhere in presshell.

Anyway, if someone can give me clear steps to reproduce that won't require me
forever to sort through the mess that is extensions (so step by step
instructions, please!), I can take a look at this.

Also, it would help to know whether this is just a Firefox bug or also one in
SeaMonkey.
(Reporter)

Comment 12

13 years ago
(In reply to comment #11)
> Eh?  What does that have to do with this bug?  Do you actually have a reason for
> the suspicion?  
Sorry if it wasn't the cause, someone else suggested it was (my mistake to
believe him)

>A regression range (with hours!), say?
I can't download builds and sleep at the same time.
In the first build it worked in the last it crashed

> Anyway, if someone can give me clear steps to reproduce that won't require me
> forever to sort through the mess that is extensions (so step by step
> instructions, please!), I can take a look at this.

1. install 20050307 Firefox build 
2. install any single tab related extension (MiniT (multiple options) , Tabmix,
UndoCloseTab, TBE, etc)
3. open Firefox
4. go to bookmarks, select a folder and press "open in tabs"
5. Firefox crashes, Firefox.exe has generated errors (Win msg), talkback pops up

> In the first build it worked in the last it crashed

This is from comment 2?  What are those the times of?  Times when the builds
were put on the ftp server?

> 1. install 20050307 Firefox build 

You mean 0308, right?

> 2. install any single tab related extension (MiniT (multiple options) ,
> Tabmix, UndoCloseTab, TBE, etc)

This is exactly the part I asked for detailed instructions on (which url to go
to, what to click, etc).
I would nominate this bug as the problem:
https://bugzilla.mozilla.org/show_bug.cgi?id=285244

The following error occurs in WinXP Events Manager when clicking on any bookmark
that is set by a 'tab' extension to open in 'new tab'.

Faulting application firefox.exe, version 1.0.0.0, faulting module js3250.dll,
version 4.0.0.0, fault address 0x0001e98b.
(In reply to comment #14)
> I would nominate this bug as the problem:
> https://bugzilla.mozilla.org/show_bug.cgi?id=285219
> 
> The following error occurs in WinXP Events Manager when clicking on any bookmark
> that is set by a 'tab' extension to open in 'new tab'.
> 
> Faulting application firefox.exe, version 1.0.0.0, faulting module js3250.dll,
> version 4.0.0.0, fault address 0x0001e98b.
> 
Edit: wrong bug should be 285219
(Reporter)

Comment 16

13 years ago
(In reply to comment #13)
> > In the first build it worked in the last it crashed
> 
> This is from comment 2?  What are those the times of?  Times when the builds
> were put on the ftp server?
> 
> > 1. install 20050307 Firefox build 
> 
> You mean 0308, right?
> 
> > 2. install any single tab related extension (MiniT (multiple options) ,
> > Tabmix, UndoCloseTab, TBE, etc)
> 
> This is exactly the part I asked for detailed instructions on (which url to go
> to, what to click, etc).

Sorry, I skipped a few steps
After the extension is installed close FF
Install any newer FF build.
Now open any group of bookmarks in tabs (which urls is irrelevant , it will
crash anyway).
"MiniT (multiple options)" is not a URL.
(Reporter)

Comment 18

13 years ago
(In reply to comment #17)
> "MiniT (multiple options)" is not a URL.

http://v2studio.com/k/moz/
or
http://forums.mozillazine.org/viewtopic.php?t=45990

(ps. sorry for making a mess, family matters in beween don't mix well)

Comment 19

13 years ago
(In reply to comment #13)
> > 2. install any single tab related extension (MiniT (multiple options) ,
> > Tabmix, UndoCloseTab, TBE, etc)
> 
> This is exactly the part I asked for detailed instructions on (which url to go
> to, what to click, etc).

Well, in my case, Ctrl-T, double-clicking the tab bar (for new tab), middle
clicking a bookmark, middle-clicking any link on a page, all crash. I have
Tabbrowser Extensions.
Let me clarify.  I don't use Firefox.  I have a clean debug build, with no
extensions.  I've never installed a Firefox extension.  I don't really have the
time to sort out how to do it.

So clear step-by-step instructions on exactly what extension to install and how
and then on what to do to reproduce the crash would be much appreciated.
(Reporter)

Comment 21

13 years ago
proper discription now

1. Install (unzip) the 20050307 Firefox build 
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-03-07-07-trunk/
2. run Firefox.exe
3. Go to http://v2studio.com/k/moz/ and doubleclick on
MiniT 0.5(drag&indicator) http://v2studio.com/k/moz/minit_drag_0.5.xpi
The first time you need to ad the site to the whitelist.
The second time you doubleclick it will be installed.
4. Close Firefox
5. Open Firefox (to activate the extension )
6. Close Firefox
7. Install (unzip) the 20050308 Firefox build (use another dir as the first)
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-03-08-07-trunk/
8. run Firefox.exe
9. Open any group of bookmarks using bookmarks->Open in tabs
(Reporter)

Comment 22

13 years ago
the error was found in js3250.dll

replacing it with the one in the 20050307 build fixes the crashes
http://forums.mozillazine.org/viewtopic.php?p=1295446#1295446
and the response after that

That sounds like bug 285219, then... Lemme see whether I can get this to reproduce.
> 9. Open any group of bookmarks using bookmarks->Open in tabs

There's no such option, but I think I figured out what you meant..
OK, the patch from bug 285219 is what's crashing here.  Reassigning accordingly.

Program received signal SIGSEGV, Segmentation fault.
0x40067b6d in js_Interpret (cx=0x83015d0, pc=0x86e7f85 "\016", result=0xbfffbfd8)
    at /home/bzbarsky/mozilla/debug/mozilla/js/src/jsinterp.c:2631
2631               ok = OBJ_DEFINE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), rval,
(gdb) p cx
$1 = (struct JSContext *) 0x83015d0
(gdb) p obj
$2 = (struct JSObject *) 0x0

That last looks unhappy.
Assignee: events → general
Component: DOM: Events → JavaScript Engine
QA Contact: ian → pschwartau
To brendan.  I have this in the debugger for the nonce if you need more info...
Assignee: general → brendan
If nothing else, in the same stack frame:

(gdb) p *fp
$3 = {callobj = 0x0, argsobj = 0x0, varobj = 0x0, script = 0x86e7cf8, fun =
0x8647660, 
  thisp = 0x8311048, argc = 1, argv = 0x88ec8a4, rval = -2147483647, nvars = 0, 
  vars = 0x88ec8b4, down = 0x88ec7d4, annotation = 0x0, scopeChain = 0x837be30, 
  pc = 0x86e7f85 "\016", sp = 0x88ec8dc, spbase = 0x88ec8d8, sharpDepth = 0, 
  sharpArray = 0x0, flags = 0, dormantNext = 0x0, xmlNamespace = 0x0}
(Reporter)

Comment 28

13 years ago
sorry for the incovenience and thanks for the help Boris
The event we're handling is an NS_XUL_COMMAND event.  The target is a <command>
element....

Can't really tell much about what JS we're executing here, mostly due to lack of
JS knowledge.
Per Shaver's request, in frame 0 we have:

(gdb) p fp->down->flags
$21 = 0
OK.  So our first time through JS we're looking at:

addTab() called from
anonymous(aCommand = "cmd_bm_openfolder") called from
goDoCommand(command = "cmd_bm_openfolder")

according to DumpJSStack().
(Assignee)

Comment 33

13 years ago
I backed out the patch for bug 285219, so this should be fixed in tomorrow's
builds.  Sorry for the trouble.

/be
Status: NEW → RESOLVED
Last Resolved: 13 years ago13 years ago
Resolution: --- → FIXED
(Reporter)

Comment 34

13 years ago
verified
Status: RESOLVED → VERIFIED

Comment 35

13 years ago
adding topcrash info for future reference.
Keywords: topcrash+
Summary: open in tabs crashes [@ js_Interpret ] → open in tabs crashes - Trunk [@ js_Interpret ]

Updated

12 years ago
Flags: testcase-
Crash Signature: [@ js_Interpret ]
You need to log in before you can comment on or make changes to this bug.