285244 - open in tabs crashes - Trunk [@ js_Interpret ]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050308
Firefox/1.0+ 00:17 PST

open build
open in tabs
crash

talkback TB4193768G

Comment 1

[Frederic Bezies]

Seems to be windows only bug.

WFM - Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2)
Gecko/20050308 Firefox/1.0+

One hour old homemade build.

Comment 2

[Peter van der Woude [:Peter6]]

regressed between
20050307 07:36 PST and 20050308 00:17 PST

I tried a later build to rule out bad .zip, same crash

Comment 3

[Steve England [:stevee]]

WFM Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050308
Firefox/1.0+

However, with TabMix extension installed opening a new tab causes firefox to
bail. Which is TabMix's problem I guess. (Not that it's even meant to work on
the trunk, but anyway..)

Comment 4

[Adam Hauner]

Peter, could you reproduce with clean install and new profile?

TB4193768G:
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 2635]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_Interpret 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 3568]
js_Invoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1313]
js_InternalInvoke 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsinterp.c, line 1390]
JS_CallFunctionValue 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/js/src/jsapi.c, line 3804]
nsJSContext::CompileFunction 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/dom/src/base/nsJSEnvironment.cpp,
line 1340]
nsNodeInfo::QueryInterface 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/base/src/nsNodeInfo.cpp,
line 116]
nsEventListenerManager::HandleEventSubType 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1499]
nsEventListenerManager::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/events/src/nsEventListenerManager.cpp,
line 1632]
nsXULElement::GetResource 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2148]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
nsXULElement::GetBuilder 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/content/xul/content/src/nsXULElement.cpp,
line 2181]
ReflowEvent::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6257]
nsMenuFrame::OnCreate 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 1690]
nsMenuFrame::ToggleMenuState 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/xul/base/src/nsMenuFrame.cpp,
line 533]
PresShell::AddOverrideStyleSheet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6220]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5940]
nsViewManager::MoveViewTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2778]
nsViewManager::BuildDisplayList 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2401]
nsView::GetClippedRect 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsView.cpp, line
946]
nsWindow::InitEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1055]
nsWindow::DispatchMouseEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5438]
nsWindow::DispatchFocus 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 5674]
nsWindow::DealWithPopups 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/widget/src/windows/nsWindow.cpp,
line 1377]
USER32.dll + 0x2a420 (0x77e3a420)
USER32.dll + 0x4605 (0x77e14605)
USER32.dll + 0xa7ba (0x77e1a7ba)
nsAppStartup::Observe 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/toolkit/components/startup/src/nsAppStartup.cpp,
line 472]
main 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/browser/app/nsBrowserApp.cpp,
line 60]
KERNEL32.DLL + 0x2893d (0x7962893d)

Comment 5

[Peter van der Woude [:Peter6]]

Adam, no, works with clean profile.
I'm at work so I can't extensively test but found that disabling MiniT 0.5
drag&indicator ( http://v2studio.com/k/moz/ ) fixes the problem.

Comment 6

[Steve England [:stevee]]

Also undoclosedtab seems to cause crashes when closing tabs. I guess a few
extensions are going to need reworked.

Comment 7

[Adam Hauner]

Okay, I'm marking this bug as WFM.

If you want, contact authors of extensions and provide them info about crashes.

Comment 8

[Nickolay_Ponomarev]

As far as I understand, crash bugs should not be resolved WFM just because they
are caused by an extension.

Comment 9

[Pratik]

Happens on Linux as well, so All/All. I guess Tabbrowser Extensions is the
culprit in my case.

Also note that this bug happens even when starting Firefox in safe mode. So I
can't even disable extensions and have it work. The only thing that works is a
new profile.

Comment 10

[Peter van der Woude [:Peter6]]

CC -> Bzbarsky
Prime suspect bug 285188

Comment 11

[Boris Zbarsky [:bzbarsky]]

Eh?  What does that have to do with this bug?  Do you actually have a reason for
the suspicion?  A regression range (with hours!), say?

The stack in comment 4 is clearly bogus:

PresShell::AddOverrideStyleSheet 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 6220]
PresShell::HandleEvent 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/layout/base/nsPresShell.cpp,
line 5940]
nsViewManager::MoveViewTo 
[c:/builds/tinderbox/Fx-Trunk/WINNT_5.0_Depend/mozilla/view/src/nsViewManager.cpp,
line 2778]

There is no call into presshell from MoveViewTo.   There is no call to
AddOverrideStyleSheet anywhere in presshell.

Anyway, if someone can give me clear steps to reproduce that won't require me
forever to sort through the mess that is extensions (so step by step
instructions, please!), I can take a look at this.

Also, it would help to know whether this is just a Firefox bug or also one in
SeaMonkey.

Comment 12

[Peter van der Woude [:Peter6]]

(In reply to comment #11)
> Eh?  What does that have to do with this bug?  Do you actually have a reason for
> the suspicion?  
Sorry if it wasn't the cause, someone else suggested it was (my mistake to
believe him)

>A regression range (with hours!), say?
I can't download builds and sleep at the same time.
In the first build it worked in the last it crashed

> Anyway, if someone can give me clear steps to reproduce that won't require me
> forever to sort through the mess that is extensions (so step by step
> instructions, please!), I can take a look at this.

1. install 20050307 Firefox build 
2. install any single tab related extension (MiniT (multiple options) , Tabmix,
UndoCloseTab, TBE, etc)
3. open Firefox
4. go to bookmarks, select a folder and press "open in tabs"
5. Firefox crashes, Firefox.exe has generated errors (Win msg), talkback pops up

Comment 13

[Boris Zbarsky [:bzbarsky]]

> In the first build it worked in the last it crashed

This is from comment 2?  What are those the times of?  Times when the builds
were put on the ftp server?

> 1. install 20050307 Firefox build 

You mean 0308, right?

> 2. install any single tab related extension (MiniT (multiple options) ,
> Tabmix, UndoCloseTab, TBE, etc)

This is exactly the part I asked for detailed instructions on (which url to go
to, what to click, etc).

Comment 14

[Jim Jeffery not reading bug-mail 1/2/11]

I would nominate this bug as the problem:
https://bugzilla.mozilla.org/show_bug.cgi?id=285244

The following error occurs in WinXP Events Manager when clicking on any bookmark
that is set by a 'tab' extension to open in 'new tab'.

Faulting application firefox.exe, version 1.0.0.0, faulting module js3250.dll,
version 4.0.0.0, fault address 0x0001e98b.

Comment 15

[Jim Jeffery not reading bug-mail 1/2/11]

(In reply to comment #14)
> I would nominate this bug as the problem:
> https://bugzilla.mozilla.org/show_bug.cgi?id=285219
> 
> The following error occurs in WinXP Events Manager when clicking on any bookmark
> that is set by a 'tab' extension to open in 'new tab'.
> 
> Faulting application firefox.exe, version 1.0.0.0, faulting module js3250.dll,
> version 4.0.0.0, fault address 0x0001e98b.
> 
Edit: wrong bug should be 285219

Comment 16

[Peter van der Woude [:Peter6]]

(In reply to comment #13)
> > In the first build it worked in the last it crashed
> 
> This is from comment 2?  What are those the times of?  Times when the builds
> were put on the ftp server?
> 
> > 1. install 20050307 Firefox build 
> 
> You mean 0308, right?
> 
> > 2. install any single tab related extension (MiniT (multiple options) ,
> > Tabmix, UndoCloseTab, TBE, etc)
> 
> This is exactly the part I asked for detailed instructions on (which url to go
> to, what to click, etc).

Sorry, I skipped a few steps
After the extension is installed close FF
Install any newer FF build.
Now open any group of bookmarks in tabs (which urls is irrelevant , it will
crash anyway).

Comment 17

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

"MiniT (multiple options)" is not a URL.

Comment 18

[Peter van der Woude [:Peter6]]

(In reply to comment #17)
> "MiniT (multiple options)" is not a URL.

http://v2studio.com/k/moz/
or
http://forums.mozillazine.org/viewtopic.php?t=45990

(ps. sorry for making a mess, family matters in beween don't mix well)

Comment 19

[Pratik]

(In reply to comment #13)
> > 2. install any single tab related extension (MiniT (multiple options) ,
> > Tabmix, UndoCloseTab, TBE, etc)
> 
> This is exactly the part I asked for detailed instructions on (which url to go
> to, what to click, etc).

Well, in my case, Ctrl-T, double-clicking the tab bar (for new tab), middle
clicking a bookmark, middle-clicking any link on a page, all crash. I have
Tabbrowser Extensions.

Comment 20

[Boris Zbarsky [:bzbarsky]]

Let me clarify.  I don't use Firefox.  I have a clean debug build, with no
extensions.  I've never installed a Firefox extension.  I don't really have the
time to sort out how to do it.

So clear step-by-step instructions on exactly what extension to install and how
and then on what to do to reproduce the crash would be much appreciated.

Comment 21

[Peter van der Woude [:Peter6]]

proper discription now

1. Install (unzip) the 20050307 Firefox build 
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-03-07-07-trunk/
2. run Firefox.exe
3. Go to http://v2studio.com/k/moz/ and doubleclick on
MiniT 0.5(drag&indicator) http://v2studio.com/k/moz/minit_drag_0.5.xpi
The first time you need to ad the site to the whitelist.
The second time you doubleclick it will be installed.
4. Close Firefox
5. Open Firefox (to activate the extension )
6. Close Firefox
7. Install (unzip) the 20050308 Firefox build (use another dir as the first)
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2005-03-08-07-trunk/
8. run Firefox.exe
9. Open any group of bookmarks using bookmarks->Open in tabs

Comment 22

[Peter van der Woude [:Peter6]]

the error was found in js3250.dll

replacing it with the one in the 20050307 build fixes the crashes
http://forums.mozillazine.org/viewtopic.php?p=1295446#1295446
and the response after that

Comment 23

[Boris Zbarsky [:bzbarsky]]

That sounds like bug 285219, then... Lemme see whether I can get this to reproduce.

Comment 24

[Boris Zbarsky [:bzbarsky]]

> 9. Open any group of bookmarks using bookmarks->Open in tabs

There's no such option, but I think I figured out what you meant..

Comment 25

[Boris Zbarsky [:bzbarsky]]

OK, the patch from bug 285219 is what's crashing here.  Reassigning accordingly.

Program received signal SIGSEGV, Segmentation fault.
0x40067b6d in js_Interpret (cx=0x83015d0, pc=0x86e7f85 "\016", result=0xbfffbfd8)
    at /home/bzbarsky/mozilla/debug/mozilla/js/src/jsinterp.c:2631
2631               ok = OBJ_DEFINE_PROPERTY(cx, obj, ATOM_TO_JSID(atom), rval,
(gdb) p cx
$1 = (struct JSContext *) 0x83015d0
(gdb) p obj
$2 = (struct JSObject *) 0x0

That last looks unhappy.

Comment 26

[Boris Zbarsky [:bzbarsky]]

To brendan.  I have this in the debugger for the nonce if you need more info...

Comment 27

[Boris Zbarsky [:bzbarsky]]

If nothing else, in the same stack frame:

(gdb) p *fp
$3 = {callobj = 0x0, argsobj = 0x0, varobj = 0x0, script = 0x86e7cf8, fun =
0x8647660, 
  thisp = 0x8311048, argc = 1, argv = 0x88ec8a4, rval = -2147483647, nvars = 0, 
  vars = 0x88ec8b4, down = 0x88ec7d4, annotation = 0x0, scopeChain = 0x837be30, 
  pc = 0x86e7f85 "\016", sp = 0x88ec8dc, spbase = 0x88ec8d8, sharpDepth = 0, 
  sharpArray = 0x0, flags = 0, dormantNext = 0x0, xmlNamespace = 0x0}

Comment 28

[Peter van der Woude [:Peter6]]

sorry for the incovenience and thanks for the help Boris

Comment 29

[Boris Zbarsky [:bzbarsky]]

Attachment: Stack

Comment 30

[Boris Zbarsky [:bzbarsky]]

The event we're handling is an NS_XUL_COMMAND event.  The target is a <command>
element....

Can't really tell much about what JS we're executing here, mostly due to lack of
JS knowledge.

Comment 31

[Boris Zbarsky [:bzbarsky]]

Per Shaver's request, in frame 0 we have:

(gdb) p fp->down->flags
$21 = 0

Comment 32

[Boris Zbarsky [:bzbarsky]]

OK.  So our first time through JS we're looking at:

addTab() called from
anonymous(aCommand = "cmd_bm_openfolder") called from
goDoCommand(command = "cmd_bm_openfolder")

according to DumpJSStack().

Comment 33

[Brendan Eich [:brendan]]

I backed out the patch for bug 285219, so this should be fixed in tomorrow's
builds.  Sorry for the trouble.

/be

Comment 34

[Peter van der Woude [:Peter6]]

verified

Comment 35

[Jay Patel [:jay]]

adding topcrash info for future reference.