Closed Bug 700761 Opened 9 years ago Closed 8 years ago

Assert with style inspector and Firebug combo

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
firefox10 - wontfix
firefox11 - ---
firefox12 - ---
firefox13 - ---

People

(Reporter: miker, Unassigned)

Details

(Keywords: crash)

Attachments

(2 files)

Attached file Backtrace
To reproduce:
1. Open Firebug (F12)
2. Ensure that the Firebug console panel is enabled
3. Go to this page
4. Open Web Console (ctrl + shift + k)
5. inspectstyle(document.body)
6. Try to expand a property

Crash (backtrace attached)
Assignee: nobody → general
Component: Developer Tools → JavaScript Engine
Product: Firefox → Core
QA Contact: developer.tools → general
Michael, what build are you using?  This seems to work for me in a debug build from mozilla-inbound from today on Mac....
Keywords: crash
I can still reproduce it on Fedora 15. I know that this crasher was also present in Windows a few weeks back, I can try to reproduce on a windows build if you would like. Here is a more concise test case that should be reproducible at least on a debug build from the fx-team repo (http://hg.mozilla.org/integration/fx-team)

1. Create a new Fx profile
2. Go to http://getfirebug.com/releases/firebug/1.9/firebug-1.9.0a5.xpi to download the Firebug 1.9.0a5
3. Install the xpi and restart Fx when prompted
4. Go to this bug (https://bugzilla.mozilla.org/show_bug.cgi?id=700761)
4. Press F12 to open Firebug
5. Click on the console tab and set it to enabled via the tab dropdown
6. Reload the page to activate the Firebug Console
7. Right-click this text and choose "Inspect Element (Q)"
8. Click the Style button at the bottom right of the page
9. Click on the Properties button at the top of the page
10. Click on the color property to expand the row

Crash
I can't reproduce the steps described in comment #2, Win Vista, Firebug 1.9a6 (and also SVN head)

But note that I am often seeing crashes on Nightlies when JSD is enabled (note that Firebug enables JSD when the Console panel is enabled) -> see Bug 700311

Honza
Michael, does the crash happen on a build from m-c or inbound?  Or just fx-team repo?  If the latter, are there any debug nightlies for that repo?
(In reply to Jan Honza Odvarko from comment #3)
> I can't reproduce the steps described in comment #2, Win Vista, Firebug
> 1.9a6 (and also SVN head)
Correction: tested with Firebug 1.9a5
Honza
I can reproduce this on m-c using both Fedora and Ubuntu ... of course, with this being a failed assertion it only happens in a debug build.

(gdb) bt
#0  0x00110424 in __kernel_vsyscall ()
#1  0x4603f3ce in raise () from /lib/libpthread.so.0
#2  0x024300e6 in CrashInJS ()
    at /home/ratcliffes/Desktop/mozilla-central/js/src/jsutil.cpp:95
#3  0x02430142 in JS_Assert (s=0x2b19951 "!target->isCachedEval", file=
    0x2b13e28 "/home/ratcliffes/Desktop/mozilla-central/js/src/jsapi.cpp", ln=
    1331) at /home/ratcliffes/Desktop/mozilla-central/js/src/jsutil.cpp:103
#4  0x022a0302 in JS_EnterCrossCompartmentCallScript (cx=0xa8bd3530, target=
    0xa78cbf70)
    at /home/ratcliffes/Desktop/mozilla-central/js/src/jsapi.cpp:1331
#5  0x01ac2c41 in jsd_GetClosestPC (jsdc=0xa0c970e0, jsdscript=0xa0c8d180, 
    line=0) at /home/ratcliffes/Desktop/mozilla-central/js/jsd/jsd_scpt.c:545
#6  0x01abdbb8 in JSD_GetClosestPC (jsdc=0xa0c970e0, jsdscript=0xa0c8d180, 
    line=0) at /home/ratcliffes/Desktop/mozilla-central/js/jsd/jsdebug.c:348
#7  0x01acbb83 in jsdScript::jsdScript (this=0xa0c8d280, aCx=0xa0c970e0, 
    aScript=0xa0c8d180)
    at /home/ratcliffes/Desktop/mozilla-central/js/jsd/jsd_xpc.cpp:1009
#8  0x01ac91ce in jsdScript::FromPtr (aCx=0xa0c970e0, aScript=0xa0c8d180)
    at /home/ratcliffes/Desktop/mozilla-central/js/jsd/jsd_xpc.h:155
#9  0x01acab79 in jsds_ScriptHookProc (jsdc=0xa0c970e0, jsdscript=0xa0c8d180, 
    creating=1, callerdata=0x0)
...

(gdb) frame 4
#4  0x022a0302 in JS_EnterCrossCompartmentCallScript (cx=0xa8bd3530, target=
    0xa78cbf70)
    at /home/ratcliffes/Desktop/mozilla-central/js/src/jsapi.cpp:1331
1331        JS_ASSERT(!target->isCachedEval);

(gdb) print target->isCachedEval
$1 = true

(gdb) print target->filename
$2 = 0xabfc9131 "resource:///modules/devtools/Templater.jsm"

Templater.jsm is included by browser/devtools/styleinspector/CssHtmlTree.jsm. The file is used to process an xhtml / xul file (browser/devtools/styleinspector/csshtmltree.xul) as a template and evals a bunch of values as part of that process ... maybe this gives a little insight into the issue.
I am not sure why Honza cannot reproduce this because I can reproduce using m-c on Fedora, Ubuntu & Windows 7.

Just in case it is my instructions that are unclear here is a short video showing how to reproduce it.
OK, now I have been able to repro the crash using fx-team repo (following the video steps). It does work for me when testing on latest nightly.

Honza
When you say the latest nightly do you mean a non-debug build? On Windows debug builds a console opens at the same time as the browser.

This issue only affects debug builds.
(In reply to Michael Ratcliffe from comment #9)
> When you say the latest nightly do you mean a non-debug build?
Yes

Honza
Igor, could you have a look at this? They are tripping an assertion you added for bug 684529:

Assertion failure: !target->isCachedEval, at e:/builds/moz2_slave/m-cen-w32-dbg/build/js/src/jsapi.cpp:1333
We don't have time to fix this for 10. Should fix this soon though.
IIUC, this actually an assert, not a crash. Not tracking Firebug-only asserts.
Summary: Crasher with style inspector and Firebug combo → Assert with style inspector and Firebug combo
New test case (debug build only):

1. Open https://bugzilla.mozilla.org/show_bug.cgi?id=700761
2. Open Firebug (F12)
3. Ensure that the Firebug console panel is enabled
4. Right click an element and choose "Inspect Element (Q)"
5. Click on an element to lock the highlighter
6. Click the "Computed" button in the devtools sidebar
5. Try to expand a property and the assertion will be raised
This was fixed a long time ago, closing
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.