530198 - With Firebug installed Firefox crashes when turning PB mode on/off very fast [@LeaveTree | JS_GetFrameThis]

Status: VERIFIED DUPLICATE of bug 519719

(Core :: JavaScript Engine, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2b4pre) Gecko/20091120 Namoroka/3.6b4pre ID:20091120033655 and Firebug 1.5X.0b4.

While verifying another Private Browsing bug my browser was crashing after some transistions in and out of Private Browsing mode. Just follow the steps:

1. Install Firebug (I have the 1.5X.0b4 version installed)
2. Open another window
3. Press Cmd+Shift+P and check the checkbox so you will not get a prompt
4. Hold Cmd+Shift+P for 2-3s

You will see that the browser stucks and no more transistion happens. After one more second the browser crashes with EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE.

Crash report: bp-5274e645-c386-4bc5-83ca-140582091120

First 10 frames of the stack:
0  	libmozjs.dylib  	LeaveTree  	 js/src/jstracer.cpp:6529
1 	libmozjs.dylib 	LeaveTree 	js/src/jstracer.cpp:7744
2 	libmozjs.dylib 	JS_GetFrameThis 	js/src/jscntxt.h:1914
3 	XUL 	_callHook 	js/jsd/jsd_step.c:133
4 	XUL 	jsd_FunctionCallHook 	js/jsd/jsd_step.c:285
5 	libmozjs.dylib 	SynthesizeFrame 	js/src/jstracer.cpp:5484
6 	libmozjs.dylib 	LeaveTree 	js/src/jstracer.cpp:6715
7 	libmozjs.dylib 	ExecuteTree 	js/src/jstracer.cpp:6478
8 	libmozjs.dylib 	js_MonitorLoopEdge 	js/src/jstracer.cpp:6961
9 	libmozjs.dylib 	js_Interpret 	js/src/jsops.cpp:360
10 	libmozjs.dylib 	js_Invoke 	js/src/jsinterp.cpp:1384

This crash happens across all branches:
http://crash-stats.mozilla.com/report/list?query_search=signature&query_type=exact&query=LeaveTree&date=&range_value=1&range_unit=weeks&do_query=1&signature=LeaveTree

Comment 1

[David Mandelin [:dmandelin]]

This looks like another dup of 519719. A fix landed on TM for that today--it should be available in TM nightly builds starting tomorrow or m-c builds after the next merge.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Listed crashes for Windows should be handled by bug 513038.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to comment #1)
> This looks like another dup of 519719. A fix landed on TM for that today--it
> should be available in TM nightly builds starting tomorrow or m-c builds after
> the next merge.

I don't think so. I give it a shot in the latest tracemonkey hourly build and it is still crashing. Sadly the crash reporter is disabled.

Comment 4

[David Mandelin [:dmandelin]]

I tried the steps in comment 0 with this morning's tracemonkey build and didn't get a crash.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Ok, that tracemonkey build doesn't crash anymore.

Comment 6

[David Mandelin [:dmandelin]]

(In reply to comment #5)
> Ok, that tracemonkey build doesn't crash anymore.

Does this mean we can WFM this?

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

David, I would be safer when I retest this steps once the tracemonkey merge happened. As you have stated in comment 1 bug 519719 could have been fixed this crash. Let us add it to the dependency list and I will test it as soon as we have the fix on mozilla-central.

Comment 8

[Robert Sayre]

please verify this, this fix was merged.

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Ok, the patch on bug 519719 has fixed this crash.