Crash [@ checkReportFlags ] occurs when loading Eventbug and Selenium IDE

VERIFIED FIXED

Status

()

--
critical
VERIFIED FIXED
9 years ago
8 years ago

People

(Reporter: mozilla.bugs, Assigned: igor)

Tracking

({crash, regression})

Trunk
x86
Windows Vista
crash, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [firebug-p2], crash signature)

Attachments

(1 attachment, 2 obsolete attachments)

(Reporter)

Description

9 years ago
http://crash-stats.mozilla.com/report/index/bp-df08c665-dee9-40d3-ad3a-112ac2091221
http://crash-stats.mozilla.com/report/index/bp-e4b41252-3432-4fba-92bf-536de2091221

When I installed Eventbug, the browser restarted but would crashed when it tried to load my profile.  I could select the profile but not start the browser.

Steps to reproduce:

1) Install Firebug 1.5X.0b8 ( http://getfirebug.com/releases/firebug/1.5X/firebug-1.5X.0b8.xpi )
2) Install Eventbug ( http://getfirebug.com/releases/eventbug/1.5/eventbug-0.1b1.xpi )
3) Restart the browser

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a1pre) Gecko/20091221 Minefield/3.7a1pre (.NET CLR 3.5.30729) ID:20091221052153

Comment 1

9 years ago
We better check FF 3.6
Whiteboard: [firebug-p2]

Comment 2

9 years ago
Actually I cannot reproduce this on FF 3.7 

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a1pre) Gecko/20091221 Minefield/3.7a1pre

Tanner do you have other extensions installed?
(Reporter)

Comment 3

9 years ago
Yes, a long list:

Adblock Plus 1.1.2
Add to Search Bar 1.8
AutoAuth 1.3
Better Gmail 2 0.9.4
Closure Inspector 0.9
DOM Inspector 2.0.4
DownloadHelper 4.6.2
EventBug 0.1b1 [DISABLED]
Firebug 1.5X.0b8
Html Validator 0.8.5.8
Microsoft .NET Framework Assistant 0.0.0 [DISABLED]
Minimap Addon 0.3.13
Mozilla QA Companion 1.2.1 [DISABLED]
MozMill 1.3 [DISABLED]
Nightly Tester Tools 2.0.3
Page Speed 1.4
Selenium IDE 1.0.2 [DISABLED]
Test Pilot 0.4
Wolfram Alpha Google 0.9 [DISABLED]
XSS Me 0.4.3

Either tonight or in the morning, I will figure out which one conflicts with Eventbug.
(Reporter)

Comment 4

9 years ago
Selenium IDE appears to be the offending add-on.

Updated STR:

1) Install Firebug 1.5X.0b8 (
http://getfirebug.com/releases/firebug/1.5X/firebug-1.5X.0b8.xpi )
2) Install Eventbug (
http://getfirebug.com/releases/eventbug/1.5/eventbug-0.1b1.xpi )
3) Install Selenium IDE ( http://release.openqa.org/selenium-ide/1.0.2/selenium-ide-1.0.2.xpi )
3) Restart the browser
(Reporter)

Updated

9 years ago
Summary: Crash [@ checkReportFlags ] occurs when loading Eventbug → Crash [@ checkReportFlags ] occurs when loading Eventbug and Selenium IDE
(Reporter)

Updated

9 years ago
Severity: normal → critical
(Reporter)

Updated

9 years ago
Component: General → Extension Compatibility
QA Contact: general → extension.compatibility

Comment 5

9 years ago
Signature	checkReportFlags
UUID	df08c665-dee9-40d3-ad3a-112ac2091221
Time 	2009-12-21 15:34:07.264701
Uptime	2
Last Crash	20 seconds before submission
Product	Firefox
Version	3.7a1pre
Build ID	20091221052153
Branch	1.9.3
OS	Windows NT
OS Version	6.0.6002 Service Pack 2
CPU	x86
CPU Info	GenuineIntel family 6 model 23 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION
Crash Address	0x18
User Comments	
Processor Notes 	
Related Bugs

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	mozjs.dll 	checkReportFlags 	js/src/jscntxt.cpp:1419
1 	mozjs.dll 	js_ReportErrorNumberVA 	js/src/jscntxt.cpp:1643
2 	mozjs.dll 	JS_ReportErrorFlagsAndNumber 	js/src/jsapi.cpp:5601
3 	mozjs.dll 	JSScopeProperty::set 	js/src/jsscope.h:857
4 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:4713
5 	mozjs.dll 	js_SetProperty 	js/src/jsobj.cpp:4826
6 	mozjs.dll 	JS_SetPropertyById 	js/src/jsapi.cpp:3598
7 	xul.dll 	XPC_SJOW_GetOrSetProperty 	
8 	xul.dll 	XPC_SJOW_SetProperty 	js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp:582
9 	mozjs.dll 	js_SetPropertyHelper 	js/src/jsobj.cpp:4811
10 	mozjs.dll 	js_Interpret 	js/src/jsops.cpp:1890
11 	mozjs.dll 	js_Invoke 	js/src/jsinterp.cpp:1384
12 	mozjs.dll 	js_InternalInvoke 	js/src/jsinterp.cpp:1439
13 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5106
14 	xul.dll 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:2164
15 	xul.dll 	nsGlobalWindow::RunTimeout 	dom/base/nsGlobalWindow.cpp:8130
16 	xul.dll 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:8474
Blocks: 514585
Component: Extension Compatibility → JavaScript Engine
Keywords: crash, regression
Product: Firefox → Core

Comment 6

9 years ago
Created attachment 429458 [details] [diff] [review]
proposal

igor: if you object to this patch, please write your own. this is a one off donation.
Assignee: nobody → timeless
Status: NEW → ASSIGNED
Attachment #429458 - Flags: review?(igor)
QA Contact: extension.compatibility → general
(Assignee)

Comment 7

9 years ago
Comment on attachment 429458 [details] [diff] [review]
proposal

># HG changeset patch
># Parent fadc5f2804d701ca7b4770fecae1f5e3eb6a7dab
># User timeless@mozdev.org
>Bug 536306 Crash [@ checkReportFlags ] occurs when loading Eventbug and Selenium IDE
>r=igor
>
>diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
>--- a/js/src/jscntxt.cpp
>+++ b/js/src/jscntxt.cpp
>@@ -1419,7 +1419,10 @@ checkReportFlags(JSContext *cx, uintN *f
>     if (JSREPORT_IS_STRICT_MODE_ERROR(*flags)) {
>         /* Error in strict code; warning with strict option; okay otherwise. */
>         JS_ASSERT(JS_IsRunning(cx));
>-        if (js_GetTopStackFrame(cx)->script->strictModeCode)
>+        JSStackFrame *fp = js_GetTopStackFrame(cx);
>+        if (!fp->script)
>+            return true;
>+        if (fp->script->strictModeCode)

The issue here is that a script calls a native function that on behalf of it do the property assignment. So to cover that case the code should use I think not js_GetTopStackFrame(cx) but rather js_GetScriptedCaller and decide strictness based on that.
Attachment #429458 - Flags: review?(igor)
(Assignee)

Comment 8

9 years ago
Created attachment 429622 [details] [diff] [review]
fix v1

The comments in the patch should explain the changes.
Assignee: timeless → igor
Attachment #429458 - Attachment is obsolete: true
Attachment #429622 - Flags: review?(jwalden+bmo)

Comment 9

9 years ago
Comment on attachment 429622 [details] [diff] [review]
fix v1

+         * the nearest scripted frame is script, see bug 536306.

... is strict ?
(Assignee)

Comment 10

9 years ago
Created attachment 429638 [details] [diff] [review]
fix v2

Here is a typo fix.
Attachment #429622 - Attachment is obsolete: true
Attachment #429638 - Flags: review?(jwalden+bmo)
Attachment #429622 - Flags: review?(jwalden+bmo)
(Assignee)

Updated

9 years ago
Attachment #429638 - Flags: review?(jwalden+bmo) → review?(jorendorff)
Attachment #429638 - Flags: review?(jorendorff) → review+

Comment 11

9 years ago
http://hg.mozilla.org/mozilla-central/rev/d25662b686bc
Status: ASSIGNED → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
(Reporter)

Comment 12

9 years ago
Verified Fixed.

Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.3a4pre) Gecko/20100317 Minefield/3.7a4pre (.NET CLR 3.5.30729) ID:20100317041424
Status: RESOLVED → VERIFIED
Crash Signature: [@ checkReportFlags ]
You need to log in before you can comment on or make changes to this bug.