911204 - Thumbnail Zoom Plus crashes Nightly 0830 build

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Fanolian]

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 (Beta/Release)
Build ID: 20130830030205

Steps to reproduce:

Install Thumbnail Zoom Plus in a new profile. Restart Browser.
(https://addons.mozilla.org/firefox/addon/thumbnail-zoom-plus/versions/)


Actual results:

Nightly crashes.
Crash ID: https://crash-stats.mozilla.com/report/index/7b129043-7802-4bed-9db4-796352130830

Comment 1

[Alice0775 White]

Regression window(m-c)
Good:
http://hg.mozilla.org/mozilla-central/rev/e3d47ec31c30
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130829125628
Bad:
http://hg.mozilla.org/mozilla-central/rev/8c5a94ba1096
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130829134141
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e3d47ec31c30&tochange=8c5a94ba1096

Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/f1e2f0c0b542
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130829084235
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b1001a1e906a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 ID:20130829091129
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=f1e2f0c0b542&tochange=b1001a1e906a

Suspected: 
f45469113804	Brian Hackett — Bug 908699 - Allow generating parse errors and warnings when off the main thread, r=billm.

Comment 2

[David Adler]

I'm the developer of Thumbnail Zoom Plus; let me know if anything the add-on is doing wrong is causing the problem.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

I didn't try to reproduce this but the problem is probably that the ctor/dtor for CompileError do not behave well when the vector is resized.  This patch heap allocates the errors so that the vector just contains pointers.

Comment 4

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 798546 [details] [diff] [review]
patch

Review of attachment 798546 [details] [diff] [review]:
-----------------------------------------------------------------

I guess this is fine. I filed bug 911806 on CompileError not having an operator=.

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/24ffdfbf55d8

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/24ffdfbf55d8

Comment 7

[Robert Kaiser]

Oh, is this signature the same thing? https://crash-stats.mozilla.com/report/list?signature=jemalloc_crash%20%7C%20arena_run_reg_dalloc%20%7C%20arena_dalloc_small%20%7C%20arena_dalloc%20%7C%20js_ExpandErrorArguments%28js%3A%3AExclusiveContext%2A%2C%20JSErrorFormatString%20const%2A%20%28%2A%29%28void%2A%2C%20char%20const%2A%2C%20unsigned%20int%29%2C%20void%2A%2C%20unsigned%20int%2C%20char%2A%2A%2C%20JSErrorReport%2A%2C%20js%3A%3AErrorArguments...