882164 - startup crash in nsHTMLDocument::GetAll @ js::CompartmentChecker::fail with Client-Side Adaptations Tool or McAfee Site Advisor

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Scoobidiver (away)]

It seems to be a regression in 24.0a1/20130612 according to startup crashes in crash stats. There are many startup crashes with McAfee Site Advisor.

STR:
1. Install https://www.dropbox.com/s/c36to2gyoo4ulbo/[e-mail]
2. Restart -> Patatra

The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=86413e921d5d&tochange=0414d6d0f60d
It's likely a regression from bug 877277.

Signature 	js::CompartmentChecker::fail(JSCompartment*, JSCompartment*) More Reports Search
UUID	e82462cb-4075-4748-a0e7-be1602130612
Date Processed	2013-06-12 15:18:20
Uptime	4
Last Crash	1.7 days before submission
Install Age	11.8 minutes since version was first installed.
Install Time	2013-06-12 15:06:54
Product	Firefox
Version	24.0a1
Build ID	20130612031138
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 23 stepping 10
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x69b01b33
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x2a42, AdapterSubsysID: 02961025, AdapterDriverVersion: 8.15.10.2869
D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
Processor Notes 	sp-processor05_phx1_mozilla_com_3890:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x2a42
Total Virtual Memory	4294836224
Available Virtual Memory	3937624064
System Memory Use Percentage	61
Available Page File	5804310528
Available Physical Memory	1612771328

Frame 	Module 	Signature 	Source
0 	mozjs.dll 	js::CompartmentChecker::fail 	js/src/jscntxtinlines.h:165
1 	mozjs.dll 	JS_GetGlobalForObject 	js/src/jsapi.cpp:2244
2 	xul.dll 	nsHTMLDocument::GetAll 	content/html/document/src/nsHTMLDocument.cpp:2728
3 	xul.dll 	mozilla::dom::HTMLDocumentBinding::get_all 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:1297
4 	xul.dll 	mozilla::dom::HTMLDocumentBinding::genericGetter 	obj-firefox/dom/bindings/HTMLDocumentBinding.cpp:1443
5 	mozjs.dll 	js::Invoke 	js/src/vm/Interpreter.cpp:434
6 	mozjs.dll 	js::BaseProxyHandler::get 	js/src/jsproxy.cpp:159
7 	xul.dll 	xpc::XrayWrapper<js::CrossCompartmentWrapper,xpc::DOMXrayTraits>::get 	js/xpconnect/wrappers/XrayWrapper.cpp:1821
8 	mozjs.dll 	js::Proxy::get 	js/src/jsproxy.cpp:2478
9 	mozjs.dll 	proxy_GetGeneric 	js/src/jsproxy.cpp:2816
10 	mozjs.dll 	JSObject::getGeneric 	js/src/jsobjinlines.h:158
11 	mozjs.dll 	JSObject::getProperty 	js/src/jsobjinlines.h:182
12 	mozjs.dll 	js::ion::TryAttachScopeNameStub 	js/src/ion/BaselineIC.cpp:4894
13 		@0x9063be4 	
14 		@0xffffff82 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=js%3A%3ACompartmentChecker%3A%3Afail%28JSCompartment*%2C+JSCompartment*%29

Comment 1

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Does this need anything else than a JSAutoCompartment?

Comment 2

[Boris Zbarsky [:bzbarsky]]

No.

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Patch v1

Sounds like I can do it, then.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 761607 [details] [diff] [review]
Patch v1

r=me

Comment 5

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f850d84e4bb5

This should probably have a test, but I guess it needs to be something with frames or something... I'll look later.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Doing document.all on an Xray is the right way to trigger this.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Tough actually, getting the document.all getter from one window and doing a .call() on a document from another window will in fact work too.

Comment 8

[Scoobidiver (away)]

There are 341 crashes in today's build.

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/f850d84e4bb5

(In reply to :Ms2ger from comment #5)
> This should probably have a test, but I guess it needs to be something with
> frames or something... I'll look later.

Comment 10

[Paul Silaghi, QA [:pauly]]

Reproduced on nightly 2013-06-12.
Verified fixed FF 24b8, 26.0a1 (2013-09-02) Win 7.