906331 - Crash in [@ Balloc ] with DownThemAll! addon

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Open some image and try to download it with DownThemAll!



Regression window (mozilla-inbound-win32-pgo)
Good:
https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-pgo/1376596116/

Bad:
https://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-pgo/1376604004/

Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=bc51f3691c07&tochange=bc978cc5421c



Regression window (mozilla-central)
Good:
https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-08-16-03-02-05-mozilla-central/

Bad:
https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-08-17-03-02-28-mozilla-central/

Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1ed5a88cd4d0&tochange=8ad1e4c838c8



Crashlogs:
https://crash-stats.mozilla.com/report/index/29ab9cda-9242-4d26-98cb-28a982130817
https://crash-stats.mozilla.com/report/index/e1b4cdde-474e-4d94-b0fa-c20a42130817
https://crash-stats.mozilla.com/report/index/c7e33f6b-6c89-4784-81c5-8c2f02130817
https://crash-stats.mozilla.com/report/index/f1fa1b66-3b20-4bbe-94dc-b0ff72130817

Comment 1

[Alice0775 White]

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/d52251e9123c
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130815125919
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b5e301863e69
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130815141517
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=d52251e9123c&tochange=b5e301863e69

Regressed by:
b5e301863e69	Brian Hackett — Bug 897655 - Use off thread parsing when loading scripts from XUL documents, r=billm,bz,luke.

Comment 3

[Alice0775 White]

bp-7cfb1dc5-a84e-4aad-a507-36f632130818

Crash on ubuntu as well
http://hg.mozilla.org/mozilla-central/rev/a71cedddadd1
Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130818030219

Comment 4

[Brian Hackett [Laid off!]]

Attachment: patch

I didn't repro this but pretty sure this patch will fix the crash.  We never init()'ed the DtoaState in the per thread data used by worker threads, and on Windows at least I suppose this leads to NULL crashes when that NULL state is passed to the library dtoa functions.

Comment 5

[Brian Hackett [Laid off!]]

Pushed, with an added tweak to make sure the PerThreadData instances are also destroyed when shutting down the runtime.

https://hg.mozilla.org/integration/mozilla-inbound/rev/9ffe7f98806d

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9ffe7f98806d

Comment 7

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

Verified with latest hourly Nightly
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0
buildID: 20130819210003
Source: Built from http://hg.mozilla.org/integration/mozilla-inbound/rev/c21468186d3d