806192 - crash in inDOMUtils::GetBindingURLs with Firebug and ShareMeNot

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Scoobidiver (away)]

It's #4 top browser crasher in 16.0.2, #7 in 17.0b3, and #5 in 18.0a2 on Mac.
It's correlated to Firebug and OnePassword:
  inDOMUtils::GetBindingURLs|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (15 crashes)
    100% (15/15) vs.   5% (46/972) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     87% (13/15) vs.   2% (24/972) [e-mail]

It's likely related to bug 795104.

Signature 	inDOMUtils::GetBindingURLs More Reports Search
UUID	67ab27ee-f477-4c7e-bdea-a68262121026
Date Processed	2012-10-26 22:45:17
Uptime	12
Last Crash	1.1 minutes before submission
Install Age	43.6 minutes since version was first installed.
Install Time	2012-10-26 22:01:26
Product	Firefox
Version	16.0.2
Build ID	20121024073032
Release Channel	release
OS	Mac OS X
OS Version	10.7.5 11G56
Build Architecture	amd64
Build Architecture Info	family 6 model 42 stepping 7
Crash Reason	EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash Address	0x18
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x6720GL Context? GL Context+ GL Layers? GL Layers+ 
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x6720

Frame 	Module 	Signature 	Source
0 	XUL 	inDOMUtils::GetBindingURLs 	layout/inspector/src/inDOMUtils.cpp:249
1 	XUL 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:163
2 	XUL 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:3118
3 	XUL 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1474
4 	XUL 	js::InvokeKernel 	js/src/jscntxtinlines.h:382
5 	XUL 	js::Interpret 	js/src/jsinterp.cpp:2442
6 	XUL 	UncachedInlineCall 	js/src/methodjit/InvokeHelpers.cpp:327
7 	XUL 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:410
8 	XUL 	js::mjit::stubs::UncachedCall 	js/src/methodjit/InvokeHelpers.cpp:367
9 		@0x1172df45e 	
10 	XUL 	js::mjit::JaegerShot 	js/src/methodjit/MethodJIT.cpp:1016
11 	XUL 	js::RunScript 	js/src/jsinterp.cpp:298
12 	XUL 	js::InvokeKernel 	js/src/jsinterp.cpp:355
13 	XUL 	js::Invoke 	js/src/jsinterp.h:119
14 	XUL 	js::IndirectProxyHandler::call 	js/src/jsproxy.cpp:442
15 	XUL 	js::CrossCompartmentWrapper::call 	js/src/jswrapper.cpp:383
16 	XUL 	proxy_Call 	js/src/jsproxy.cpp:1143
17 	XUL 	js::InvokeKernel 	js/src/jscntxtinlines.h:382
18 	XUL 	js::mjit::stubs::UncachedCallHelper 	js/src/methodjit/InvokeHelpers.cpp:423
19 	XUL 	js::mjit::stubs::UncachedCall 	js/src/methodjit/InvokeHelpers.cpp:367
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=inDOMUtils%3A%3AGetBindingURLs

Comment 1

[Alex Keybl [:akeybl]]

(In reply to Scoobidiver from comment #0)
> It's #4 top browser crasher in 16.0.2, #7 in 17.0b3, and #5 in 18.0a2 on Mac.
> It's correlated to Firebug and OnePassword:
>   inDOMUtils::GetBindingURLs|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (15
> crashes)
>     100% (15/15) vs.   5% (46/972) [e-mail] (Firebug,
> https://addons.mozilla.org/addon/1843)
>      87% (13/15) vs.   2% (24/972) [e-mail]
> 
> It's likely related to bug 795104.

Are the add-on version correlations the same as bug 795104? We're going to pull some comments that may help QA reproduce.

Comment 2

[bhavana bajaj [:bajaj]]

(In reply to Alex Keybl [:akeybl] from comment #1)
> (In reply to Scoobidiver from comment #0)
> > It's #4 top browser crasher in 16.0.2, #7 in 17.0b3, and #5 in 18.0a2 on Mac.
> > It's correlated to Firebug and OnePassword:
> >   inDOMUtils::GetBindingURLs|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (15
> > crashes)
> >     100% (15/15) vs.   5% (46/972) [e-mail] (Firebug,
> > https://addons.mozilla.org/addon/1843)
> >      87% (13/15) vs.   2% (24/972) [e-mail]
> > 
> > It's likely related to bug 795104.
> 
> Are the add-on version correlations the same as bug 795104? We're going to
> pull some comments that may help QA reproduce.

Most of correlations are for Mac OSX . Performing some of the below when firebug was open could be a good start :
a)"loading YouTube with cache disabled and Firebug was open"
b)"Been debugging my application and Firefox was running in the background."
c)"loaded the firebug js tab, and the browser crashed"
d)"refreshed the page with firebug open, and the js tab open. Firefox crashed."
e)"suddenly any time I refresh with firebug active I crash"

The above are pulled from the comments section of crash-stats

Comment 3

[Scoobidiver (away)]

(In reply to Alex Keybl [:akeybl] from comment #1)
> Are the add-on version correlations the same as bug 795104?
Almost but we can't compare in the same channel. Using correlations of the same day:
*this bug in 16.0.2:
    100% (29/29) vs.   6% (74/1256) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     79% (23/29) vs.   3% (35/1256) [e-mail]
     52% (15/29) vs.   2% (30/1256) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60)
*bug 795104 in 17.0:
    100% (10/10) vs.  17% (41/247) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     80% (8/10) vs.   9% (22/247) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60)
     60% (6/10) vs.   7% (17/247) [e-mail]

Comment 4

[Lukas Blakk [:lsblakk] use ?needinfo]

Honza - can you take a look at this and see if there's an obvious Firebug issue related to bugs you're aware of or if this is a larger platform issue feel free to re-assign to another dev.

Comment 5

[Marcia Knous [:marcia]]

Some URLs, but I suspect that the URL in Bug 795104 could probably be used to generate a crash.

Correlations for this crash are the same as in 795104

inDOMUtils::GetBindingURLs|EXC_BAD_ACCESS / KERN_INVALID_ADDRESS (24 crashes)
    117% (28/24) vs.  30% (146/494) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
          0% (0/24) vs.   0% (1/494) 1.10.2b1
         13% (3/24) vs.   7% (37/494) 1.10.4
         79% (19/24) vs.  20% (100/494) 1.10.5
          8% (2/24) vs.   1% (4/494) 1.11.0a5
         17% (4/24) vs.   1% (4/494) 1.9.0
     58% (14/24) vs.  14% (69/494) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60) (1.2.2)
     54% (13/24) vs.  20% (100/494) [e-mail]
          8% (2/24) vs.   3% (13/494) 3.9.10.b1
         46% (11/24) vs.  17% (86/494) 3.9.9
          0% (0/24) vs.   0% (1/494) 3.9.9.b2

URLs:

14 	about:blank
12 	https://www.facebook.com/
7 	https://plus.google.com/u/0/_/streamwidgets/canvas
6 	http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
5 	https://www.facebook.com/login.php?login_attempt=1
4 	http://www.facebook.com/
4 	http://www.eb.dk/
3 	http://radio6.bram.pb/
3 	http://beta.girlscene.nl/profiel/riekelt
2 	https://plus.google.com/u/1/_/streamwidgets/canvas
2 	http://www.cnn.com/
2 	https://www.shopwithyourfriends.com/nl-women/
2 	http://www.railroadmedia.com/cgi-bin/FormMail.pl
2 	http://www.youtube.com/
2 	http://www.karennicholls.com/Galleries/
2 	http://www.ashdownmusic.com/
2 	http://www.telegraph.co.uk/
2 	http://audesc.dynalias.com/
2 	https://na5.salesforce.com/02i70000005msT8
2 	http://talkingpointsmemo.com/
2 	http://imagineenergy/blog/2012/10/16/the-pressure-boundary/
2 	http://127.0.0.1:3000/
2 	http://www.lematin.devlocal/news/standard/Login-EPaper/story/22734181
2 	https://www.youtube.com/
2 	http://techbu.com/

Comment 7

[u279076]

Marcia, are you able to look into this further or can I reassign the QA Contact?

Comment 8

[Marcia Knous [:marcia]]

We have been working on this in an email thread - please see Bug 795104 for other information related to this bug, which is likely a dupe of it.

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #7)
> Marcia, are you able to look into this further or can I reassign the QA
> Contact?

Comment 9

[Lukas Blakk [:lsblakk] use ?needinfo]

At this point we're too late to take a fix for FF17, wontfixing - we'll have to continue investigation for 18.

Comment 10

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Just to note that the main discussion and all my analyses-results are available under bug 795104, which is most likely related to this one.

Honza

Comment 11

[Tyler Downer [He/Him]]

I have a user reporting this at https://support.mozilla.org/en-US/questions/941957 if we need investigation.

Comment 12

[Bryan Roseberry]

Firebug 1.10.6 started crashing Firefox (16.0.2) on me at some point recently (though I don't think the timing can be pinned down), and I found this thread. 

When I downgrade Firebug to 1.10.4 (still 16.0.2), the crashing appears to stop. When I go back up to 1.10.5 (or anything higher up through 1.11.x), the crashing starts again.

Steps to recreate the crash in my case (with Firebug 1.10.5):

1) Open browser (opens homepage of http://www.asu.edu).
2) Hit F12 to open Firebug. (My last tab selected is "Scripts").
3) Click on "Reload to see all sources".
4) Starts to reload, then it crashes before the page completely reloads (it is working on re-rendering the page when it crashes).

Another set of steps that reproduces the crash:

1) Uninstall Firebug and restart browser.
2) Go to older versions of Firebug listing and select 1.10.5 (or any newer version).
3) Allow the site to install Firebug and install it.
4) Go to http://www.asu.edu.
5) Hit F12 to open Firebug (selected tab can be any tab - HTML, Scripts, Console, etc.).
6) Reload the page (Ctrl+R).
7) Crash -- before the page loads (same as above - usually within a second or two of hitting Ctrl+R).

Other background info:

- Win7, 64bit. FF 16.0.2.
- I've sent a few crash reports to Mozilla over the last few hours.
- The crashing didn't happen on every page I hit refresh.
- I have a Firefox master password set, but I do not have a OnePassword/1Password FF add-on installed. The crash can be recreated before OR after the master password box pops up soon after the browser is running.
- Disabling the following add-ons had no effect: NoScript, Firefinder for Firebug, FireSass for Firebug. (If you want a list of all my add-ons, let me know).

I'm posting a link to this comment in https://bugzilla.mozilla.org/show_bug.cgi?id=795104 as well.

BTW - I've seen a comment or two from posters in bugzilla (probably Firefox devs) about how this isn't an important bug... IMO, they are dead wrong. Firebug is my most important FF tool, and I know that I'm not alone by a longshot.

Comment 13

[u279076]

Thanks for the detailed information, Bryan. Unfortunately this does not reproduce using your instructions with Firefox 16.0.2 on Windows 7 64-bit with Firebug 1.10.5 for me. Granted, I'm using a new profile so there could be something else at play here.

One question I do have is are you logged in to asu.edu on startup? I see no reason the Master Password prompt would display unless this is the case. I can't confirm this case as I'm not an ASU student or faculty.

Comment 14

[Jan Honza Odvarko [:Honza] (always need-info? me)]

(In reply to Bryan Roseberry from comment #12)
> When I downgrade Firebug to 1.10.4 (still 16.0.2), the crashing appears to
> stop. When I go back up to 1.10.5 (or anything higher up through 1.11.x),
> the crashing starts again.
Yes, this confirms that the commit (between 1.10.4 and 1.10.5) that causes the crash is this one:
https://github.com/firebug/firebug/commit/7227fc862207d0c5645d876a83c80a6054c06e20

But don't know what's wrong with the change.

> Steps to recreate the crash in my case (with Firebug 1.10.5):
I can't reproduce the crash on my machine using your steps,
but I am pretty sure it's the same reason as for bug 795104

> - I've sent a few crash reports to Mozilla over the last few hours.
Can you post a link to one of your crashes (you can get it from about:crashes)

> If you want a list of all my add-ons, let me know.
Yes, please, copy list of all your extensions. I think one of them + Firebug causes the crash. It would be great to find the one.

Honza

Comment 15

[:Benjamin Peterson]

Attachment: don't crash on invalid input

Seems fairly straightforward.

Comment 16

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 682616 [details] [diff] [review]
don't crash on invalid input

r=me

Comment 17

[Bryan Roseberry]

I've discovered that when I disable the ShareMeNot 2.1 addon, the crashing stops (with Firebug 1.10.6).

Here are two crash reports:

https://crash-stats.mozilla.com/report/index/d42bbce8-1c4e-42ec-9fc1-68cf12121115
https://crash-stats.mozilla.com/report/index/14b6de9f-0aa8-405a-8ed5-c9aff2121115

Here are all of my add-ons (though I suspect it's ShareMeNot now):

------------------------
Adblock Plus 2.1.2
BetterPrivacy 1.68
ColorfulTabs 17.0
DownloadStatusbar 0.9.10
Firebug 1.10.6
FireFTP 2.0.7
FireSass for Firebug 0.0.9
Forecastfox 2.2.2
Graphing Calculator Toolbar 2.3
Html Validator 0.9.5.1
Live HTTP headers 0.17
NoScript 2.6.1
Nuke Anything Enhanced 1.0.2
Rainbow 1.5.1
ShareMeNot 2.1
SQLite Manager 0.7.7
Status-4-Evar 2012.07.08.17
Tab Mix Plus 0.4.0.3
TItlebar Text 1.4
Web Developer 1.2.2
---------------------

Hope this helps.

Comment 18

[Bryan Roseberry]

@Anthony Hughes - "One question I do have is are you logged in to asu.edu on startup?"

No.

Comment 19

[:Benjamin Peterson]

https://hg.mozilla.org/integration/mozilla-inbound/rev/85bf6ba633a2

Comment 20

[Bryan Roseberry]

More info:

- If I have ONLY Firebug 1.10.6 and ShareMeNot 2.1, the crashing still happens.

- If I have everything add-on listed above EXCEPT ShareMeNot 2.1, the crashing appears to stop (though I haven't tested this extensively).

- Only certain sites crash the browser. The browser crashes 100% of the time on reloading these pages with the Scripts tab in Firebug open:
---- http://www.asu.edu
---- http://students.asu.edu

- With http://www.cbssports.com, when I allow scripts globally with NoScript, the crashing stops, but when I turn NoScript back on (forbid some of the scripts), it crashes.

- Other sites do not crash. A few random pages verified to not crash (for comparison's sake):
---- many other asu.edu subdomains
---- drudgereport.com
---- slashdot.org
---- huffingtonpost.com
---- w3schools.com
---- ESPN.com
---- cnnsi.com
---- nbcnews.com
---- quirksmode.org

So maybe this is just a combination of DOM objects in certain sites that's bad for the ShareMeNot/Firebug combo? cbssports.com, asu.edu, and students.asu.edu all have jQuery and jQuery UI scripts being called. Could be a connection?

That's all the help I can offer. Hope this helps!

Comment 21

[u279076]

Thanks, this is easy to reproduce now.

1. Install Firefox 17.0b6 and start with a new profile
2. Install Firebug from addons.mozilla.org
3. Install ShareMeNot from addons.mozilla.org
4. Navigate to http://asu.edu
5. Turn on Firebug
6. Click "enable" in the Script panel 
7. Click "reload" in the Script panel
> Firefox crashes

Seems like there is definitely some bad interaction between Firebug, ShareMeNot, and asu.edu.

Comment 22

[:Benjamin Peterson]

Comment on attachment 682616 [details] [diff] [review]
don't crash on invalid input

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Not sure. Looks like it's been lying in wait for a while.
User impact if declined: Crashes with Firebug
Testing completed (on m-c, etc.): On m-i now
Risk to taking this patch (and alternatives if risky): None
String or UUID changes made by this patch: None

Comment 23

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/85bf6ba633a2

Comment 24

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 682616 [details] [diff] [review]
don't crash on invalid input

Approving for uplift to Aurora (18). Please land before 11/19 merge on Monday so that this gets on the correct version.

Comment 25

[:Benjamin Peterson]

https://hg.mozilla.org/releases/mozilla-aurora/rev/065e2b8abc1a

No fix for 17, though?

Comment 26

[Alex Keybl [:akeybl]]

(In reply to :Benjamin Peterson from comment #25)
> https://hg.mozilla.org/releases/mozilla-aurora/rev/065e2b8abc1a
> 
> No fix for 17, though?

Correct, this fix came after our final beta and RC build. We can consider uplift if a 17.0.1 occurs.

Comment 27

[:Benjamin Peterson]

(In reply to Alex Keybl [:akeybl] from comment #26)
> (In reply to :Benjamin Peterson from comment #25)
> > https://hg.mozilla.org/releases/mozilla-aurora/rev/065e2b8abc1a
> > 
> > No fix for 17, though?
> 
> Correct, this fix came after our final beta and RC build. We can consider
> uplift if a 17.0.1 occurs.

Okay. Will you look at or do I have to do something?

Comment 28

[Alex Keybl [:akeybl]]

(In reply to :Benjamin Peterson from comment #27)
> (In reply to Alex Keybl [:akeybl] from comment #26)
> > (In reply to :Benjamin Peterson from comment #25)
> > > https://hg.mozilla.org/releases/mozilla-aurora/rev/065e2b8abc1a
> > > 
> > > No fix for 17, though?
> > 
> > Correct, this fix came after our final beta and RC build. We can consider
> > uplift if a 17.0.1 occurs.
> 
> Okay. Will you look at or do I have to do something?

We'll look at this and all other tracked bugs that are still marked as affected for FF17.

Comment 29

[Lukas Blakk [:lsblakk] use ?needinfo]

We're going to do a 17.0.1 so please prepare patches and/or nominate for mozilla-release and mozilla-esr17 branches.

Comment 30

[:Benjamin Peterson]

Comment on attachment 682616 [details] [diff] [review]
don't crash on invalid input

[Approval Request Comment]
Same nomination comment as above with the extra information that this has been on m-i, m-b, m-a for more than a week.

Comment 31

[Lukas Blakk [:lsblakk] use ?needinfo]

Comment on attachment 682616 [details] [diff] [review]
don't crash on invalid input

please land to mozilla-esr17 relbranch GECKO170_2012111914_RELBRANCH as well

Comment 32

[Paul Silaghi, QA [:pauly]]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #21)
> Thanks, this is easy to reproduce now.
> 
> 1. Install Firefox 17.0b6 and start with a new profile
> 2. Install Firebug from addons.mozilla.org
> 3. Install ShareMeNot from addons.mozilla.org
> 4. Navigate to http://asu.edu
> 5. Turn on Firebug
> 6. Click "enable" in the Script panel 
> 7. Click "reload" in the Script panel
> > Firefox crashes
> 
> Seems like there is definitely some bad interaction between Firebug,
> ShareMeNot, and asu.edu.

NOT fixed in FF 18b1.
fixed in 19.0a2 (2012-11-27)

Comment 33

[Boris Zbarsky [:bzbarsky]]

Er... this should be fixed on 18...

Comment 34

[Robert Kaiser]

I don't see any of those signatures in 18.0b1 so far: https://crash-stats.mozilla.com/topcrasher/byversion/Firefox/18.0b1/7

Paul/Anthony, could you verify that you can indeed still reproduce with 18.0b1?

Comment 35

[u279076]

Using the steps in comment 21:
 * Clean install of 17.0b6 -> crash
 * Update to 18.0b1 -> crash
 * Clean install of 18.0b1 -> crash
 * Clean install of 18.0b2#1 -> does not crash

It would seem that it's fixed in Beta but not in 18b1, which is odd considering we pushed to Aurora before the merge to Beta for Firefox 18.

Comment 36

[:Benjamin Peterson]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #35)
> Using the steps in comment 21:
>  * Clean install of 17.0b6 -> crash
>  * Update to 18.0b1 -> crash
>  * Clean install of 18.0b1 -> crash
>  * Clean install of 18.0b2#1 -> does not crash
> 
> It would seem that it's fixed in Beta but not in 18b1, which is odd
> considering we pushed to Aurora before the merge to Beta for Firefox 18.

I think the release was just tagged before I fixed it in beta.

Comment 37

[:Benjamin Peterson]

https://hg.mozilla.org/releases/mozilla-release/rev/2afd813ee454

https://hg.mozilla.org/releases/mozilla-esr17/rev/4955c180d093
https://hg.mozilla.org/releases/mozilla-esr17/rev/2e104f2c9b10

Comment 38

[u279076]

Marking this verified for Firefox 18.0b2 based on comment 35.

Comment 39

[Simona Badau, Desktop QA, PTO 13-25aug]

Verified as fixed on Firefox 17.0.1 - Firefox does not crash when loading Firebug scripts (used the STR from Comment 21).

Verified on Windows 7, Mac OS X and Ubuntu 12.10.

Comment 40

[u279076]

Verified fixed with Firefox 17.0.1esr on Windows 7, Mac OSX 10.8, and Ubuntu 12.10

Comment 42

[Adam Clark]

recently I have updated my mozilla now it is not opening most of the web pages Why?
http://usecloak.com/apk-download/cloak-the-way-to-be-unsocial/36
http://www.kikforpcmessenger.com/2016/01/how-to-delete-kik-account-guide-to.html
http://www.signup-login.com/2015/08/how-to-set-up-free-skype-account.html
http://whatsappparapcgratis.com/descargar-gratis-whatsapp-para-pc-2015/

Comment 43

[u279076]

(In reply to Adam Clark from comment #42)
> Recently I have updated my mozilla now it is not opening most of the web pages Why?

Hi Adam,

Could you please post this over on support.mozilla.org? It's hard to know what is happening on your system and our Support team is the best place to get this investigated. If it is determined through the course of troubleshooting that you are encountering a Firefox bug, they should be able to help you get a new bug report filed.

Thank you.

Comment 47

[Adam Clark]

Thank you Anthony Hughes for replying 



I am posting same on support.mozilla.org?

My another query is I need a extension for slither.io(http://slitheriotricks.com/) I have found for chrome but I mostly use Firefox so plz give me url to download.

Comment 48

[Tushar Goyal]

I switched to mozilla some days back. It is working fine except of some times. It showing some security warning for some particular sites like if i am trying to open https://chinagrabber.com/tubemate-youtube-downloader/ , it will open this up without any issue but if i go for http://www.e-aadhaarcard.in , it shows error. Please clear out this problem.