715829 - Navigating away from mibbit.com causes an non-closeable alert and Firefox crashed [@ js::IsWrapper]

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:11.0a2) Gecko/20111229 Firefox/11.0a2

While trying to leave Mibbit I got an empty alert dialog I was not able to get rid of. Clicking on both buttons crashed Firefox after a while in the above mentioned signature.

Crash report: bp-6394a4e9-54ed-4fff-9a3c-eaef42120106

First 15 frames:

0 	XUL 	js::IsWrapper 	js/src/jsfriendapi.h:313
1 	XUL 	xpc::WrapperFactory::PrepareForWrapping 	js/xpconnect/wrappers/WrapperFactory.cpp:81
2 	XUL 	JSCompartment::wrap 	js/src/jscompartment.cpp:221
3 	XUL 	JSCompartment::wrap 	js/src/jscompartment.cpp:343
4 	XUL 	JS_WrapObject 	js/src/jsapi.cpp:1431
5 	XUL 	XPCConvert::NativeInterface2JSObject 	js/xpconnect/src/XPCConvert.cpp:1152
6 	XUL 	XPCConvert::NativeData2JS 	js/xpconnect/src/XPCConvert.cpp:423
7 	XUL 	XPCWrappedNative::CallMethod 	js/xpconnect/src/xpcprivate.h:3255
8 	XUL 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1554
9 	XUL 	js::InvokeKernel 	js/src/jscntxtinlines.h:311
10 	XUL 	js::Interpret 	js/src/jsinterp.cpp:3506
11 	XUL 	UncachedInlineCall 	js/src/methodjit/InvokeHelpers.cpp:390
12 	XUL 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:473
13 	XUL 	CallCompiler::update 	js/src/methodjit/MonoIC.cpp:989
14 	XUL 	js::mjit::ic::Call 	js/src/methodjit/MonoIC.cpp:1047
15 		@0x1061c9465 

Steps:
1. Open https://wiki.mozilla.org/QA/Automation_Services/Team
2. Click on one of the IRC links and use Mibbit to connect to IRC
3. Wait until Mibbit has been loaded and try to go back

So far it's not reproducible for me. I will continue to check.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

No steps to reproduce yet but the behavior of going back is broken for the two-finger swipe and I have filed bug 715856.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'js::IsWrapper':
 - nightly (version 50): 1 crash from 2016-06-06.
 - aurora  (version 49): 0 crash from 2016-06-07.
 - beta    (version 48): 13 crashes from 2016-06-06.
 - release (version 47): 14 crashes from 2016-05-31.
 - esr     (version 45): 1 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          1          0          0          0          0          0
 - aurora           0          0          0          0          0          0          0
 - beta             1          5          1          0          4          1          0
 - release          1          3          5          3          2          0          0
 - esr              0          0          0          0          1          0          0

Affected platform: Windows

Comment 3

[Wayne Mery (:wsmwk)]

Ever seen this again?

I've never had a problem in recent years (but I'm not on a mac). The crash signature doesn't exist for current versions of FIreefox desktop https://crash-stats.mozilla.org/signature/?signature=js%3A%3AIsWrapper&date=%3E%3D2019-08-07T08%3A44%3A00.000Z&date=%3C2019-11-07T08%3A44%3A00.000Z

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

No, I haven't seen it again but I'm also not using it.