918335 - startup crash with calendar addon in xpc::WrapperFactory::PrepareForWrapping(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, unsigned int)

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

This bug was filed from the Socorro interface and is 
report bp-7bebad35-546a-41e6-b6db-08bff2130918.
=============================================================

I got this crash as a startup crash with Thunderbird on Tuesday (had no issues launching it before). There are a bunch of these for Firefox and Thunderbird. The stack:

Frame	Module	Signature
0	xul.dll	xpc::WrapperFactory::PrepareForWrapping(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,unsigned int)
1	mozjs.dll	JSCompartment::wrap(JSContext *,JS::MutableHandle<JS::Value>,JS::Handle<JSObject *>)
2	mozjs.dll	js::CrossCompartmentWrapper::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &)
3	mozjs.dll	js::Proxy::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &)
4	mozjs.dll	proxy_Call
5	mozjs.dll	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct)
6	mozjs.dll	Interpret
7	mozjs.dll	ScanBaseShape
8	mozjs.dll	PushMarkStack
9	mozjs.dll	MarkInternal<js::Shape>
10	mozjs.dll	js::EmptyShape::getInitialShape(JSContext *,js::Class *,js::TaggedProto,JSObject *,JSObject *,unsigned int,unsigned int)
11	mozjs.dll	JSObject::create(JSContext *,js::gc::AllocKind,js::gc::InitialHeap,JS::Handle<js::Shape *>,JS::Handle<js::types::TypeObject *>,js::HeapSlot *)
12	mozjs.dll	js::NewObjectWithGivenProto(JSContext *,js::Class *,js::TaggedProto,JSObject *,js::gc::AllocKind,js::NewObjectKind)
13	mozjs.dll	mozjs.dll@0x2bd1d8

Comment 1

[Wayne Mery (:wsmwk)]

Firefox crashes begin version 23.0a1 build 20130425030845 bp-6d3265a6-9acd-40d1-83a4-6d95d2130502

Thunderbird appears (not? surprisingly?) first version 24.0a1 build 20130621031056bp-9eeac555-5908-4971-9ba5-8b7d92130704

Comment 2

[Wayne Mery (:wsmwk)]

lightning correlation of 98% 
https://crash-analysis.mozilla.com/crash_analysis/20140124/20140124_Thunderbird_24.2.0-interesting-addons.txt

Comment 3

[Wayne Mery (:wsmwk)]

A couple recent examples:
bp-0c1fc672-72a1-4fd3-b416-5f8b02140122
bp-69887e95-219d-44d4-9241-ed4532140122

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Crash volume for signature 'xpc::WrapperFactory::PrepareForWrapping':
 - nightly (version 50): 1 crash from 2016-06-06.
 - aurora  (version 49): 1 crash from 2016-06-07.
 - beta    (version 48): 12 crashes from 2016-06-06.
 - release (version 47): 114 crashes from 2016-05-31.
 - esr     (version 45): 1 crash from 2016-04-07.

Crash volume on the last weeks:
             Week N-1   Week N-2   Week N-3   Week N-4   Week N-5   Week N-6   Week N-7
 - nightly          0          1          0          0          0          0          0
 - aurora           0          0          0          0          1          0          0
 - beta             2          1          3          2          1          2          0
 - release          9         18         12         24         10         21          7
 - esr              0          1          0          0          0          0          0

Affected platforms: Windows, Mac OS X, Linux

Comment 5

[Wayne Mery (:wsmwk)]

There are virtually no Thunderbird crashes after version 24

Comment 6

[Wayne Mery (:wsmwk)]

aryx, have you seen this crash since reporting?

Crash is pretty rare - 10/month covering all versions

Comment 7

[Wayne Mery (:wsmwk)]

Thunderbird 78 has only three crash in six months and the stack I looked at isn't related IMO bp-685b6e70-0c26-49e2-8149-1fef80210107