Closed Bug 686441 Opened 8 years ago Closed 7 years ago

Crash in JSLinearString::mark(JSTracer*) or JSString::mark(JSTracer*) mainly with Better Facebook

Categories

(Core :: JavaScript Engine, defect, critical)

6 Branch
x86
Windows 7
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: w9wdxzaj2n, Unassigned)

Details

(Keywords: crash)

Crash Data

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2
Build ID: 20110902133214

Steps to reproduce:

I had the Facebook home page open (www.facebook.com) but was not actively doing anything in Firefox at all and Firefox crashed.  See it listed as the #2 crash URL here: https://crash-stats.mozilla.com/topcrasher/byurl/Firefox/6.0
This report is for the #4 and #15 crash signatures for that URL.  I think the two crash signatures are correlated as they are very similar and both correlate with Facebook.
https://crash-stats.mozilla.com/report/index/bp-607f95e5-cc84-4ac9-86c1-c1d672110912
https://crash-stats.mozilla.com/report/index/bp-1231f41b-a4c8-46e0-93e4-7e7d02110912
This may also be related to https://bugzilla.mozilla.org/show_bug.cgi?id=655526, where the reporter is using Facebook chat (I was not though), although it was reported as Linux originally (https://crash-stats.mozilla.com/report/index/bp-67d5024f-9bb9-4e5f-ab2b-d0fea2110507), and another commenter posted that it was #7 top crash on Mac/OS (https://crash-stats.mozilla.com/report/index/077ec457-2449-4b99-9e0f-74b4d2110710).

This is my first bugzilla report so excuse my reporting inadequacies.  Maybe this is XPConnect issue rather than Core JavaScript - I can't tell.  If it, please change it, or ask me to.
Severity: normal → critical
Crash Signature: [@ JSLinearString::mark(JSTracer*) ] [@ JSString::mark(JSTracer*) ]
Confirming this based on data in crash stats. Also see related Bug 687001 which appears to be the Mac version of this signature.

Reporter: Are you using the Better Facebook extension?
Status: UNCONFIRMED → NEW
Ever confirmed: true
I am actually using the Greasemonkey add-on, running the Better Facebook script. So it's pure javascript. Not something that should be able to cause a crash! But, yes, I've looked at your bug and it does appear highly correlated.

However, the crash may have stopped for me a couple of days ago?  My most recent crash is https://crash-stats.mozilla.com/report/index/bp-51c65dfe-242a-4317-be93-f63b42110920
Maybe Facebook changed something in their code?  Facebook usually gradually roll out changes to their users (I got a new Facebook home page (newsfeed page) today) so others may be continuing to see the crash.
But... I also got this crash when I was logging into (or unlocking my) Yahoo Mail (session):
https://crash-stats.mozilla.com/report/index/bp-d766ff8c-78a3-4e3c-85d5-91d472110919
Could be a coincidence that I happened to be doing that when it crashed, or it could be that this javascript intensive moment precipitated a crash from a Facebook tab that I probably had open. The above crash report does not any "Related Bugs" in it though. But the stack trace is almost identical as my other 5, just missing frame 0 JSLinearString::mark, and everything else pushed up by 1.
It's #21 top crasher in 7.0.1 and #20 in 8.0b1.

There's an extension correlation in 7.0.1:
  JSLinearString::mark(JSTracer*)|EXCEPTION_ACCESS_VIOLATION_READ (236 crashes)
       79% (187/236) vs.   1% (406/57390) betterfacebook@mattkruse.com
          0% (0/236) vs.   0% (1/57390) 5.852
          0% (0/236) vs.   0% (2/57390) 5.911
          1% (2/236) vs.   0% (3/57390) 5.921
        42% (98/236) vs.   0% (228/57390) 5.931
        37% (87/236) vs.   0% (172/57390) 5.941
Summary: Crash in JSLinearString::mark(JSTracer*) or JSString::mark(JSTracer*) → Crash in JSLinearString::mark(JSTracer*) or JSString::mark(JSTracer*) mainly with Better Facebook
Keywords: crash
Hardware: x86_64 → x86
I don't see high correlations to BetterFacebook in 19.0.2 for any crash signatures: https://crash-analysis.mozilla.com/crash_analysis/20130316/20130316_Firefox_19.0.2-interesting-addons.txt.gz

Based on comment 5 and this comment, I close the bugs as workforme.
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: needinfo?(scoobidiver)
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.