454669 - TM: Crash if user clicks on 'Manage Search Engines...' with JIT enabled [@js_ExecuteTree]

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Joris de Haes]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080909032504 Minefield/3.1b1pre
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080909032504 Minefield/3.1b1pre

When expanding the list of search engines I get the full list. I want to organize them (group Wikipedia's, dictionaries and Mozilla's together) so I need to open the search engines manager. When I click on 'Manage Search Engines...' Minefield crashes.

Reproducible: Always

Steps to Reproduce:
1. Click on the current search engine icon to the expand list of search engines
2. Click on 'Manage Search Engines...' to open the search engine manager
Actual Results:  
I get a Windows XP error-message saying the program has been closed and Microsoft is sorry for that. I don't get to see Breakpad :( and I don't get the option to restore the session. When I restart Minefield I get the option to restore the session, which works fine.

Expected Results:  
Show 'Manage Search Engine List' with all the search engines.

Environment:
Nightly Minefield download (not compiled) for win32. Windows XP uses 'classic' theme. Minefield uses default theme. No Talkback crash ID

Comment 1

[Joris de Haes]

Attachment: about:buildconfig

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Do you have javascript.options.jit.chrome enabled? This sounds like bug 452208, though that was supposedly fixed.

Comment 3

[Joris de Haes]

You are right. I had jit enabled.

Scenarios I just tried:

1 Starting with jit.chrome true and jit.content true. Click = Crash
2 Starting with jit.chrome true and jit.content false. Click = Crash
3 Starting with jit.chrome false and jit.content true. Click = No Crash
4 Starting with jit.chrome false and jit.content true. Click = No Crash
5 Starting with jit.chrome enabled and changing it to false after startup. Click = No Crash
6 Starting with jit.chrome true and changing it to false. Use the search engine list to change search engine but don't use the manager. After that change jit.chrome back to true. Click = Crash

My conclusion: If the first time the search engine manager is used with jit.chrome false there is no crash. When the first time it is used with jit.chrome true it crashes. Changing jit.chrome state after startup from true to false avoids crashing.

Comment 4

[Brian Polidoro]

I got this report:
bp-10b707fa-7fa0-11dd-b9d4-001321b13766

Comment 5

[:Gavin Sharp [email: [e-mail]]]

That looks like a different stack than bug 452208.

Comment 6

[timeless]

Signature	js_ExecuteTree
UUID	10b707fa-7fa0-11dd-b9d4-001321b13766
Time	2008-09-10 18:22:16-07
Uptime	15
Product	Firefox
Version	3.1b1pre
Build ID	20080910043000
OS	Windows NT
OS Version	5.1.2600 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 15 model 3 stepping 4
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x697463a1
Comments	
Crashing Thread
Frame 	Module 	Signature 	Source
0 	js3250.dll 	js_ExecuteTree 	
1 	js3250.dll 	js_MonitorLoopEdge 	
2 	js3250.dll 	js3250.dll@0x65ec0 	
3 	js3250.dll 	js_Invoke 	
4 	js3250.dll 	array_extra 	
5 	js3250.dll 	array_map 	
6 	js3250.dll 	js_Interpret 	
7 	js3250.dll 	js_Invoke 	
8 	js3250.dll 	JS_CallFunctionValue 	
9 	xul.dll 	nsJSContext::CallEventHandler

Comment 7

[Joris de Haes]

Are those links to _my_ crash report? If so, I'd like to note that my OS version is XP SP3, and the the time is weird... can anyone tell/link me info about the time format? what timezone, 12/24 hours, offset, DSL?

Back on the topic: can I do anything to help now, or do I wait for the next nightly build? :)

Comment 8

[Ria Klaassen (not reading all bugmail)]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080911082840 Minefield/3.1b1pre

I don't get this crash.

Comment 9

[timeless]

no, they're brian's (comment 4). i can't easily get your crash reports, you could load about:crashes and provide them here.

Comment 10

[RFLazaro]

No crash using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080912031847 Minefield/3.1b1pre

Comment 11

[Brian Polidoro]

Well only my normal profile crashes even with today's build.  No problems with a clean profile.  But my normal profile crashes even in safe mode with my plugins also disabled.  I'll have to dig deeper to see if I can find the cause.

Comment 12

[Brian Polidoro]

Ok I got it.  It 's the searchplugins. Not a surprise given what triggers the crash.   It doesn't seem to be any search plugin in particular.  It seems like anytime I have 5-7 plugins in that directory in the profile is when it crashes.  So that's 5-7 extra plugins without counting the default plugins.  I have 7 plugins in the program's searchplugins directory.

Comment 13

[Joris de Haes]

That could explain it. I normally have 35 searchplugins. (They are really useful)
Yesterday I removed Firefox 3.0.1, Shiretoko and Minefield 3.1b1pre and reinstalled the latest nightly binary for win32. I kept my profile.
With a clean profile I can add the same amount of plugins and it doesn't crash. After that I tried it back with my normal profile. Started up with jit enabled and the same searchplugins as in the bugdescription and everything went fine; no crash. So either this bug is fixed or I cannot reproduce it anymore.

Comment 14

[Jean-Yves Perrier [:teoli]]

I can reproduce the bug on Mac OS X.5 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; fr-FR; rv:1.9.1b1pre) Gecko/20080912020659 Minefield/3.1b1pre ID:20080912020659
When I click 'Manage Search Engines...', it crashes instantly.

Here is an about:crashes that I get: http://crash-stats.mozilla.com/report/index/8078eb7a-81c7-11dd-9bd7-001cc4e2bf68?p=1

Comment 15

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20080914034157 Minefield/3.1b1pre

I can't install the additional plugins from addons.mozilla.org:
This XML file does not appear to have any style information associated with it. The document tree is shown below.
      
I installed bugzilla and addons as additional search engines, and tested all buttons of 'Manage Search Engines...', moved, removed, set keyword, saved, canceled etc. no crash seen

Comment 16

[Brian Polidoro]

Attachment: zip of profile search plugins

does anyone else crash with these search plugins in a new profile with chrome jit?

Comment 17

[RFLazaro]

No crash using attached search plugins in nightly Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b1pre) Gecko/20081006 Minefield/3.1b1pre 20081006034237

Some recent code changes fixed this?

Comment 18

[Brian Polidoro]

I concur using the same build.  

->WFM