884156 - crash in JS::Value::isMagic, crash in js::ObjectImpl::getSlot when I open CKEditor demo if Web Console is staying open

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Alice0775 White]

Crash id: bp-6e93339c-d4b9-4670-adff-41e682130617

Browser crashes when I open certain site if Web Console is staying open
However, Browser does not crash if I opened Browser Console instead of Web Console.

Unfortunately, Bug 883562 does not fix the crash...

Steps To Reproduce:
1. Open Web Console
2. Open http://ckeditor.com/demo

Actual Results:
Browser crashes

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/849e6303ac21
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130616 Firefox/24.0 ID:20130617091523
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/ccb80286042a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130617 Firefox/24.0 ID:20130617093533
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=849e6303ac21&tochange=ccb80286042a

Re-triggered by: 
ccb80286042a	Jason Orendorff — Bug 883523 - Regression: 'if(1) /a/.test("a")' causes a SyntaxError after landing bug 872735. r=till.

However, I think that this is false positive, because prior to land Bug 883523, the web page fails to load due to bug 872735.


Regression window(m-i) before landing bug 872735
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/18c1fd169792
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130614 Firefox/24.0 ID:20130614031707
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/ce43d28276e4
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130614 Firefox/24.0 ID:20130614045911
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=18c1fd169792&tochange=ce43d28276e4

Regressed by:
ce43d28276e4	Brian Hackett — Bug 678037 - Enable lazy JS parsing and fix various bugs, r=waldo,evilpie,nobody.

Comment 1

[Scoobidiver (away)]

Firefox doesn't crash for me in 24.0a1/20130617 and it seems to be confirmed by crash stats.
Dupe of bug 883562?

Comment 2

[Alice0775 White]

(In reply to Scoobidiver from comment #1)
> Firefox doesn't crash for me in 24.0a1/20130617 and it seems to be confirmed
> by crash stats.

Because, Not crash due to Bug 883523. 24.0a1/20130617 build did not include the fix yet.

> Dupe of bug 883562?

No.

Comment 3

[Scoobidiver (away)]

(In reply to Alice0775 White from comment #2)
> Because, Not crash due to Bug 883523. 24.0a1/20130617 build did not include
> the fix yet.
How can it be a regression from bug 678037? It's a regression from bug 883523 in that case.

Comment 4

[Alice0775 White]

(In reply to Scoobidiver from comment #3)
> (In reply to Alice0775 White from comment #2)
> > Because, Not crash due to Bug 883523. 24.0a1/20130617 build did not include
> > the fix yet.
> How can it be a regression from bug 678037? It's a regression from bug
> 883523 in that case.

No.

Bug 678037 landed:
  Start crash.
Bug 872735 landed:
  The page fails to load due to regression of bug 872735, then stop crashing.
Bug 883523 landed:
  Bug 883523 fixed the regression of bug 872735. so, then start crash again.

Comment 5

[Alice0775 White]

bp-b37b3143-0432-4eab-a079-63b6d2130618

http://hg.mozilla.org/mozilla-central/rev/4e5983de6e3b
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130618 Firefox/24.0 ID:20130618031335

Comment 6

[bhavana bajaj [:bajaj]]

Can someone help identify the regressing bug here ? Are we seeing this on any other editors ? 

needsinfo'ing :jorendoff and :bhackett here as they own the suspected bugs here ,to help investigate

Comment 7

[Jason Orendorff [:jorendorff]]

Alice is right, the regressing bug is bug 678037.

Comment 8

[Alice0775 White]

I cannnot reproduce the crash anymore in
http://hg.mozilla.org/integration/mozilla-inbound/rev/2ffbbe96954c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20130620 Firefox/24.0 ID:20130620123512

This was fixed by bug 884194 .

Comment 9

[Bogdan Maris, Desktop Test Engineering]

Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20100101 Firefox/24.0

Verified as fixed on latest Nightly, Firefox 24 beta 6 and
> http://hg.mozilla.org/integration/mozilla-inbound/rev/2ffbbe96954c

I think this can`t be marked as verified since there are still crashes in Socorro 
http://bit.ly/1flG5Aj in the last week

Comment 10

[Manuela Muntean [Away]]

Verified as fixed, using the STR from comment 0, on: Win 7 64bit, Ubuntu 13.04 64bit and Mac OS X 10.7.5, with Firefox 24 RC.

Here are the reports for last month, from Socorro: 

1) for the 1st signature: there are 20 crashes on 24.0b9, and no other crashes since then on the 24 branch

https://crash-stats.mozilla.com/report/list?product=Firefox&query_search=signature&query_type=contains&reason_type=contains&date=2013-08-29&range_value=28&range_unit=days&hang_type=any&process_type=any&signature=js%3A%3AObjectImpl%3A%3AgetSlot%28unsigned+int%29

2) for the 2nd signature: there is only 1 crash on 24.0b9, and no other crash since then

https://crash-stats.mozilla.com/report/list?signature=JS%3A%3AValue%3A%3AisMagic%28JSWhyMagic%29&product=Firefox&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&date=2013-09-13+14%3A00%3A00&range_value=4