467007 - TM: 100% Crash with Adblock Plus 0.7.5.5 on specific URL [@ nanojit::LirBufWriter::insLink(nanojit::LOpcode, nanojit::LIns*) ]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Matthias Versen [:Matti]]

Mozilla/5.0 (Windows; U; Windows NT 6.0; rv:1.9.1b3pre) Gecko/20081127 SeaMonkey/2.0a2pre
Adblock Plus 0.7.5.5

STR:
1) Install adblock plus with filter list, it doesn't crash without
2) Open URL
3) a 100% crash

bp-fed9fed6-72f8-4341-a7ea-b6dff2081127
bp-0777843b-d2e9-427d-9ac3-479bf2081127

0  	js3250.dll  	nanojit::LirBufWriter::insLink  	 js/src/nanojit/LIR.cpp:423
1 	js3250.dll 	nanojit::LirBufWriter::ensureReferenceable 	js/src/nanojit/LIR.cpp:252
2 	js3250.dll 	nanojit::LirBufWriter::ins2 	js/src/nanojit/LIR.cpp:329
3 	js3250.dll 	nanojit::CseFilter::insLoad 	js/src/nanojit/LIR.cpp:1956
4 	js3250.dll 	js3250.dll@0xac773

Comment 1

[Wladimir Palant]

Confirmed in Minefield build 20081123 on Windows XP (using Adblock Plus 1.0 release candidate):

bp-bf6cff00-2f8b-4e9d-8e14-0a3f62081128
bp-ad787bd9-6d78-40da-b233-eea262081128

Comment 2

[Wladimir Palant]

Attachment: Testcase

Managed to minimize that page, more or less. I didn't dig into jQuery but the crash also happens with the standard jQuery version that I linked from the testcase. If your browser didn't crash you might need to refresh a few times.

Comment 3

[Wladimir Palant]

On the Adblock Plus side minimizing is more difficult - removing filter matching "fixes" the crash which makes pretty little sense because that's the one part that doesn't interact with the web page in any way (also, it had major changes between Adblock Plus 0.7.5.5 and 1.0).

Comment 4

[Matthias Versen [:Matti]]

I don't know if it matters but the stack in bp-ad787bd9-6d78-40da-b233-eea262081128 is a little bit different.

Comment 6

[Andreas Gal :gal]

If you put "TM:" in the title for JIT crashes I can find them easier.

Comment 7

[Andreas Gal :gal]

I have seen this in the top crashes too.

The test case looks promising. I will try to reproduce.

Comment 8

[Tony Mechelynck [:tonymec]]

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1b3pre) Gecko/20081130 SeaMonkey/2.0a2pre - Build ID: 20081130000511

Crash immediately after opening the "details" view of the testcase (and Breakpad told me it "had a problem" transmitting my crash data). I believe bug 460272 is a dupe of this one.

Comment 10

[David Anderson [:dvander] - inactive, e-mail if emergency]

I can reproduce this, will debug.

Comment 11

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: quick fix

We're re-entering the interpreter via a resolve hook which causes a deep abort.  This is really nasty since it means the recorder continues with complete garbage.

Jason is working on a larger solution to this problem in bug 462027.  Attached patch is a quick fix in case something is needed right away.

Comment 12

[David Anderson [:dvander] - inactive, e-mail if emergency]

Attachment: quick fix, v2

Comment 13

[David Anderson [:dvander] - inactive, e-mail if emergency]

Pushed changeset http://hg.mozilla.org/tracemonkey/rev/213728a95a5c

This is a really common crash that can produce wildly varying stack traces, so it's probably best to get the quick fix in early.  Once the general fix is available this patch can be stripped out.

Comment 14

[Worcester12345]

I just tried it with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20081201 Minefield/3.1b3pre ID:20081201035224 and it didn't trigger a crash. For the record, I also have NoScript installed, and didn't allow whatever was trying to run, so it was likely a script.

Comment 15

[Robert Sayre]

This got merged to m-c

Comment 17

[Tyler Downer [He/Him]]

bp-5922a9dd-e10e-4572-8f24-1f3252081211
bp-97ce37cb-7c9c-43c7-b6fd-b34342081211
Crash with above testcase and Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2a1pre) Gecko/20081211 Minefield/3.2a1pre, with ABP 1

Comment 18

[Matthias Versen [:Matti]]

sure, because your build doesn't contain the fix because it got merged into m-c 2 hours ago. As we have a fix we don't need more information that it crashes, where it crashes and why it crashes because if we have a fix, the cause of this has been identified by the developers.

You should of course reopen this bug if you get this with a build that should contain this fix.

Comment 19

[Tyler Downer [He/Him]]

Sorry matti, need to check the build info. Does not crash with todays trunk

Comment 20

[Henrik Skupin [:whimboo][⌚️UTC+2]]

This is a top crasher for Firefox 3.1 Beta 2.

Robert, has the patch already been landed on mozilla1.9.1 branch? I ask because I'm not able to get the latest branch nightly to crash on the given URL (as comment 14 also pointed out).

Comment 21

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

I just crashed Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US;
rv:1.9.1b3pre) Gecko/20081212 Shiretoko/3.1b3pre, supposed to be built after
checkin, on http://quicksilver.en.softonic.com/mac

Comment 22

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Thanks Daniel. I'm also able to reproduce the crash with the latest 1.9.1b3pre. Slightly updating the URL to a crashing one.

I think it need some baking on trunk until it will be checked into 1.9.1 branch?

Comment 23

[Mike Beltzner [:beltzner, not reading bugmail]]

We should land this on 1.9.1 as soon as we know it doesn't regress performance or break builds. It's a blocker, and a crasher, so sooner is better.

Comment 24

[Worcester12345]

Not sure if it matters here, but Adblock Plus is on a new version, 1.0.

Comment 25

[Wladimir Palant]

No, it doesn't matter - see comment 1.

Comment 26

[chris hofmann]

anyone spot regressions?  is it time to move that patch to the branch?

Comment 27

[Robert Sayre]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/d8e796eeeaef

Comment 28

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed on 1.9.1 with the given URL and testcase:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre) Gecko/20081221 Shiretoko/3.1b3pre ID:20081221020430

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b3pre) Gecko/20081222 Shiretoko/3.1b3pre ID:20081222041930

No more crash reports listed for Firefox3.1b3 after the 2008121900 build.