714639 - Closing browser tab from Silverlight crashes Firefox @ js::ContextStack::popInvokeArgs

Status: VERIFIED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[kuvik3]

Hi,

One of the Silverlight applications crashes Firefox with following signature:

https://crash-stats.mozilla.com/report/index/bp-84feabbe-3ab6-4046-9900-c936c2120102

To reproduce, open two blank tabs, and open this Silverlight application in one of them. Then open main menu (located in top left corner) and click Exit:
http://dl.dropbox.com/u/841468/testcase/silverlight/ReportDesignerTestPage.html

Note: Sometimes it doesn't crash for first time. If it doesn't crash, try it once more in remaining tab.

I tested it in Firefox 7, 8 and Nightly and with Silverlight plugins 4 and 5 on Windows XP and 7.

Thanks

Comment 1

[Steven Michaud [:smichaud] (Retired)]

Also happens on OS X (testing on OS X 10.5.8):
bp-0eaef14f-5ee8-4c1a-b047-d1a552120102

Comment 2

[Steven Michaud [:smichaud] (Retired)]

Doesn't happen in Safari or Chrome (testing on OS X 10.5.8).

Comment 3

[Steven Michaud [:smichaud] (Retired)]

> Doesn't happen in Safari or Chrome (testing on OS X 10.5.8).

But in neither Safari nor Chrome does choosing Exit close the current tab.

Comment 4

[Benjamin Smedberg]

I can't reproduce with nightlies on Win7... hrm.

Comment 5

[Steven Michaud [:smichaud] (Retired)]

> I can't reproduce with nightlies on Win7... hrm.

Are you testing with the 64-bit Windows Silverlight plugin?  If so you might also want to try with the 32-bit one.

I've just reproduced this on OS X 10.6.8 in today's mozilla-central nightly.  There is no 64-bit Silverlight plugin for OS X -- only a 32-bit one.

bp-0d734cf7-17b1-422e-946b-6aea12120103

Comment 6

[kuvik3]

I simplified the testcase, so it will now crash after you click "Close" button.
http://dl.dropbox.com/u/841468/testcase/silverlight/ReportDesignerTestPage.html

This Silverlight application now contains only this code:

private void Button_Click(object sender, RoutedEventArgs e) {
    HtmlPage.Window.Invoke("close");
}

(You should have more tabs open, so you can see that Silverlight closes Firefox tab and then Firefox crashes. If it doesn't crash for first time, try it once more.)

Comment 7

[Alice0775 White]

I cannot reproduce anymore on
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912

Fixed window(m-c):
Reproduce:
http://hg.mozilla.org/mozilla-central/rev/03ae304e45af
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125052451
Cannot reproduce:
http://hg.mozilla.org/mozilla-central/rev/0d5ad6a6f814
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120125 Firefox/12.0a1 ID:20120125064912
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=03ae304e45af&tochange=0d5ad6a6f814


Fixed window(m-i):
Reproduce:
http://hg.mozilla.org/integration/mozilla-inbound/rev/040975f3210a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120124 Firefox/12.0a1 ID:20120124102247
Cannot reproduce:
http://hg.mozilla.org/integration/mozilla-inbound/rev/79deba022227
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0a1) Gecko/20120124 Firefox/12.0a1 ID:20120124104951
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=040975f3210a&tochange=79deba022227

Fixed by:
79deba022227	Luke Wagner — Bug 675078 - rm JSThreadData and JSThread (JSRuntime is now officially single-threaded) (r=igor)

Comment 8

[Luke Wagner [:luke]]

Hah.  Righteous.

Comment 9

[Steven Michaud [:smichaud] (Retired)]

I can no longer reproduce this crash on OS X, either (testing with today's mozilla-central nightly on OS X 10.6.8).