Crash in [@ Balloc ] with DownThemAll! addon

VERIFIED FIXED in mozilla26

Status

()

--
critical
VERIFIED FIXED
5 years ago
a year ago

People

(Reporter: Virtual, Assigned: bhackett)

Tracking

({crash, nightly-community, regression})

26 Branch
mozilla26
x86_64
All
crash, nightly-community, regression
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

Comment 1

5 years ago
Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/d52251e9123c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130815125919
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b5e301863e69
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130815141517
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d52251e9123c&tochange=b5e301863e69

Regressed by:
b5e301863e69	Brian Hackett — Bug 897655 - Use off thread parsing when loading scripts from XUL documents, r=billm,bz,luke.
Blocks: 897655
Severity: blocker → critical
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash, regression

Updated

5 years ago
Duplicate of this bug: 906496

Comment 3

5 years ago
bp-7cfb1dc5-a84e-4aad-a507-36f632130818

Crash on ubuntu as well
http://hg.mozilla.org/mozilla-central/rev/a71cedddadd1
Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130818030219
OS: Windows 7 → All
Summary: Crash in [@ Balloc ] → Crash in [@ Balloc ] with DownThemAll! addon
Assignee: nobody → general
Component: General → JavaScript Engine
tracking-firefox26: --- → ?
(Assignee)

Comment 4

5 years ago
Created attachment 792197 [details] [diff] [review]
patch

I didn't repro this but pretty sure this patch will fix the crash.  We never init()'ed the DtoaState in the per thread data used by worker threads, and on Windows at least I suppose this leads to NULL crashes when that NULL state is passed to the library dtoa functions.
Attachment #792197 - Flags: review?(wmccloskey)
Attachment #792197 - Flags: review?(wmccloskey) → review+
(Assignee)

Comment 5

5 years ago
Pushed, with an added tweak to make sure the PerThreadData instances are also destroyed when shutting down the runtime.

https://hg.mozilla.org/integration/mozilla-inbound/rev/9ffe7f98806d
https://hg.mozilla.org/mozilla-central/rev/9ffe7f98806d
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla26
Verified with latest hourly Nightly
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0
buildID: 20130819210003
Source: Built from http://hg.mozilla.org/integration/mozilla-inbound/rev/c21468186d3d
Status: RESOLVED → VERIFIED

Updated

5 years ago
Assignee: general → bhackett1024
tracking-firefox26: ? → ---
You need to log in before you can comment on or make changes to this bug.