Closing browser tab from Silverlight crashes Firefox @ js::ContextStack::popInvokeArgs

VERIFIED FIXED

Status

()

Core
Plug-ins
--
critical
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: kuvik3, Unassigned)

Tracking

({crash})

Trunk
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

6 years ago
Hi,

One of the Silverlight applications crashes Firefox with following signature:

https://crash-stats.mozilla.com/report/index/bp-84feabbe-3ab6-4046-9900-c936c2120102

To reproduce, open two blank tabs, and open this Silverlight application in one of them. Then open main menu (located in top left corner) and click Exit:
http://dl.dropbox.com/u/841468/testcase/silverlight/ReportDesignerTestPage.html

Note: Sometimes it doesn't crash for first time. If it doesn't crash, try it once more in remaining tab.

I tested it in Firefox 7, 8 and Nightly and with Silverlight plugins 4 and 5 on Windows XP and 7.

Thanks
Also happens on OS X (testing on OS X 10.5.8):
bp-0eaef14f-5ee8-4c1a-b047-d1a552120102
Status: UNCONFIRMED → NEW
Crash Signature: [@ js::ContextStack::popInvokeArgs ]
Ever confirmed: true
OS: Windows 7 → All
Hardware: x86_64 → All
Summary: Closing browser tab from Silverlight crashes Firefox → Closing browser tab from Silverlight crashes Firefox [@ js::ContextStack::popInvokeArgs ]
Doesn't happen in Safari or Chrome (testing on OS X 10.5.8).
> Doesn't happen in Safari or Chrome (testing on OS X 10.5.8).

But in neither Safari nor Chrome does choosing Exit close the current tab.
I can't reproduce with nightlies on Win7... hrm.
> I can't reproduce with nightlies on Win7... hrm.

Are you testing with the 64-bit Windows Silverlight plugin?  If so you might also want to try with the 32-bit one.

I've just reproduced this on OS X 10.6.8 in today's mozilla-central nightly.  There is no 64-bit Silverlight plugin for OS X -- only a 32-bit one.

bp-0d734cf7-17b1-422e-946b-6aea12120103
(Reporter)

Comment 6

6 years ago
I simplified the testcase, so it will now crash after you click "Close" button.
http://dl.dropbox.com/u/841468/testcase/silverlight/ReportDesignerTestPage.html

This Silverlight application now contains only this code:

private void Button_Click(object sender, RoutedEventArgs e) {
    HtmlPage.Window.Invoke("close");
}

(You should have more tabs open, so you can see that Silverlight closes Firefox tab and then Firefox crashes. If it doesn't crash for first time, try it once more.)

Updated

6 years ago
Severity: normal → critical
Crash Signature: [@ js::ContextStack::popInvokeArgs ] → [@ js::ContextStack::popInvokeArgs] [@ js::ContextStack::popInvokeArgs(js::InvokeArgsGuard const&)]
Keywords: crash
Summary: Closing browser tab from Silverlight crashes Firefox [@ js::ContextStack::popInvokeArgs ] → Closing browser tab from Silverlight crashes Firefox @ js::ContextStack::popInvokeArgs

Comment 7

6 years ago
I cannot reproduce anymore on
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912

Fixed window(m-c):
Reproduce:
http://hg.mozilla.org/mozilla-central/rev/03ae304e45af
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125052451
Cannot reproduce:
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=03ae304e45af&tochange=0d5ad6a6f814


Fixed window(m-i):
Reproduce:
http://hg.mozilla.org/integration/mozilla-inbound/rev/040975f3210a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120124 Firefox/12.0a1 ID:20120124102247
Cannot reproduce:
http://hg.mozilla.org/integration/mozilla-inbound/rev/79deba022227
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120124 Firefox/12.0a1 ID:20120124104951
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=040975f3210a&tochange=79deba022227

Fixed by:
79deba022227	Luke Wagner — Bug 675078 - rm JSThreadData and JSThread (JSRuntime is now officially single-threaded) (r=igor)

Updated

6 years ago
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Depends on: 675078
Resolution: --- → FIXED

Comment 8

6 years ago
Hah.  Righteous.
I can no longer reproduce this crash on OS X, either (testing with today's mozilla-central nightly on OS X 10.6.8).

Updated

6 years ago
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.