Navigating away from mibbit.com causes an non-closeable alert and Firefox crashed [@ js::IsWrapper]

NEW
Unassigned

Status

()

Core
JavaScript Engine
--
critical
6 years ago
a year ago

People

(Reporter: whimboo, Unassigned)

Tracking

({crash})

Trunk
All
Mac OS X
crash
Points:
---

Firefox Tracking Flags

(firefox47 affected, firefox48 affected, firefox-esr45 affected, firefox50 affected)

Details

(crash signature, URL)

(Reporter)

Description

6 years ago
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:11.0a2) Gecko/20111229 Firefox/11.0a2

While trying to leave Mibbit I got an empty alert dialog I was not able to get rid of. Clicking on both buttons crashed Firefox after a while in the above mentioned signature.

Crash report: bp-6394a4e9-54ed-4fff-9a3c-eaef42120106

First 15 frames:

0 	XUL 	js::IsWrapper 	js/src/jsfriendapi.h:313
1 	XUL 	xpc::WrapperFactory::PrepareForWrapping 	js/xpconnect/wrappers/WrapperFactory.cpp:81
2 	XUL 	JSCompartment::wrap 	js/src/jscompartment.cpp:221
3 	XUL 	JSCompartment::wrap 	js/src/jscompartment.cpp:343
4 	XUL 	JS_WrapObject 	js/src/jsapi.cpp:1431
5 	XUL 	XPCConvert::NativeInterface2JSObject 	js/xpconnect/src/XPCConvert.cpp:1152
6 	XUL 	XPCConvert::NativeData2JS 	js/xpconnect/src/XPCConvert.cpp:423
7 	XUL 	XPCWrappedNative::CallMethod 	js/xpconnect/src/xpcprivate.h:3255
8 	XUL 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1554
9 	XUL 	js::InvokeKernel 	js/src/jscntxtinlines.h:311
10 	XUL 	js::Interpret 	js/src/jsinterp.cpp:3506
11 	XUL 	UncachedInlineCall 	js/src/methodjit/InvokeHelpers.cpp:390
12 	XUL 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:473
13 	XUL 	CallCompiler::update 	js/src/methodjit/MonoIC.cpp:989
14 	XUL 	js::mjit::ic::Call 	js/src/methodjit/MonoIC.cpp:1047
15 		@0x1061c9465 

Steps:
1. Open https://wiki.mozilla.org/QA/Automation_Services/Team
2. Click on one of the IRC links and use Mibbit to connect to IRC
3. Wait until Mibbit has been loaded and try to go back

So far it's not reproducible for me. I will continue to check.
(Reporter)

Comment 1

6 years ago
No steps to reproduce yet but the behavior of going back is broken for the two-finger swipe and I have filed bug 715856.

Updated

6 years ago
Crash Signature: [@ js::IsWrapper]
(Assignee)

Updated

3 years ago
Assignee: general → nobody
Crash volume for signature 'js::IsWrapper':
 - nightly (version 50): 1 crash from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 13 crashes from 2016-06-06.
 - release (version 47): 14 crashes from 2016-05-31.
 - esr     (version 45): 1 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          1          0          0          0          0          0
 - aurora           0          0          0          0          0          0          0
 - beta             1          5          1          0          4          1          0
 - release          1          3          5          3          2          0          0
 - esr              0          0          0          0          1          0          0

Affected platform: Windows
status-firefox47: --- → affected
status-firefox48: --- → affected
status-firefox50: --- → affected
status-firefox-esr45: --- → affected
You need to log in before you can comment on or make changes to this bug.