Closed Bug 922712 Opened 11 years ago Closed 6 years ago

crash in js::ObjectImpl::compartment()

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
26 Branch
Platform:
x86
Windows NT
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WONTFIX
Tracking Flags:
Tracking Status
firefox25 --- wontfix
firefox26 + wontfix
firefox27 --- affected
firefox28 --- affected

People

(Reporter: jbecerra, Assigned: nihsanullah)

Details

(Keywords: crash, reproducible)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-ea61317e-de85-4081-be64-ec5812131001.
=============================================================

This crash signature is listed in the explosiveness report at number 6. It's an issue in 23.0.1 as well, and most of the comments were from people using that version. A lot of the URLs point to localhost sites, which is probably people developing sites.

I haven't been able to reproduce the crash so far by visiting some of the other URLs listed.
Thanks!
I can reproduce this crash:
1) Install Yandex Elements extension from http://element.yandex.ru/
2) Restart browser
3) Open about:memory
4) Click on "Measure" button

There are some of my crash reports:
https://crash-stats.mozilla.com/report/index/d353d5d9-35af-404b-9225-a129d2131029
https://crash-stats.mozilla.com/report/index/f778a8ea-ddce-4fac-96a5-fd88e2131029
I was able to reproduce this on Fx26b2 by following the instructions in comment #2. This signature is hovering in the top 10.
tracking-firefox26: --- → ?
Keywords: reproducible
Keywords: topcrash
Jorge - can you reach out to the developers of the addon to see if there's something on their side triggering this or whether it's a change to Firefox code?
Flags: needinfo?(jorge)
Tracking for 26 while it's a topcrash there but we'd need to know more info like how many users this addon has, and determine if this is an issue with about:memory or with the addon code.
status-firefox25: --- → affected
status-firefox26: --- → affected
status-firefox27: --- → affected
status-firefox28: --- → affected
tracking-firefox26: ? → +
Yandex Elements installs two extensions:
* Visual Bookmarks, id: vb@yandex.ru
* Yandex Elements, id: yasearch@yandex.ru

They each have over 2M users.

Can you narrow down the problem to one of them?
Flags: needinfo?(jorge)
(In reply to Jorge Villalobos [:jorgev] from comment #6)
> Yandex Elements installs two extensions:
> * Visual Bookmarks, id: vb@yandex.ru
> * Yandex Elements, id: yasearch@yandex.ru
> 
> They each have over 2M users.
> 
> Can you narrow down the problem to one of them?

Yandex Elements, id: yasearch@yandex.ru is the one.
(In reply to Alexander L. Slovesnik from comment #7)
> Yandex Elements, id: yasearch@yandex.ru is the one.
So, the crash with Yandex Elements happens with Fx 24, but not Fx 23. Will try to find regression window.
Naveed - this is the #6 topcrash on FF26 Beta, now that there's a regression window and the addon is identified can you find someone to look more closely at this?
Assignee: nobody → nihsanullah
Flags: needinfo?(nihsanullah)
How is this crash and the one in https://bugzilla.mozilla.org/show_bug.cgi?id=922712#c9 correlated? They look quite different to me. Bhackett and I looked at the JS patches in the regression window. Nothing there seems particularly suspicious. The first crash (in this bug) looks like it may be due to a NULL JSContext pointer. The second is crashing from an attempt to use memory deallocated by GC. I will find someone on that team to take a look.
Flags: needinfo?(nihsanullah)
Keywords: topcrash → topcrash-win
(In reply to Naveed Ihsanullah [:naveed] from comment #11)
> The second is crashing from an attempt to use memory deallocated by GC. I
> will find someone on that team to take a look.

So should a new bug be filed for the 26 regression?
Too late for speculative fixes on FF26 branch so we'll have to ship with this.
status-firefox26: affected → wontfix
I got my browser crashed this night with this issue, but I never used any Yandex addon.
And again. Seems like Firebug somehow affects this issue.
This crash is not showing up in the top-300 crash reports for Firefox 27, 28, and 29 anymore. However, it still shows up at #13 (0.82%) for Firefox 26. 

Denis, which version(s) of Firefox can you reproduce your crash?
status-firefox25: affected → wontfix
Flags: needinfo?(deniska666)
I'm on release channel and use Firefox 26. Maybe it's really fixed in 27 and the latter.
Flags: needinfo?(deniska666)
After tracking down this issue for 2 days, I can confirm that it only happens to me if firebug is open. And it still occurs in Firefox 27 beta.

I can reproduce it with a few clicks in my environment, if you have problem reproducing it, I can setup a test server.
(In reply to Ronald Moolenaar from comment #18)
> I can reproduce it with a few clicks in my environment, if you have problem
> reproducing it, I can setup a test server.

If you can provide a test page, steps to reproduce, and a list of installed add-on versions required to reproduce this that would help.
(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #19)
> (In reply to Ronald Moolenaar from comment #18)
> > I can reproduce it with a few clicks in my environment, if you have problem
> > reproducing it, I can setup a test server.
> 
> If you can provide a test page, steps to reproduce, and a list of installed
> add-on versions required to reproduce this that would help.

Anthony, I've sent you an email with instructions.
Thanks for the instructions Ronald, and sorry for taking so long to get back to you.

I've tested what you described under several conditions:
 * Firefox 27.0 with no add-ons -> no crash
 * Firefox 27.0 with Firebug 1.12.6 -> no crash
 * Firefox 27.0 with Adblock Plus 2.4.1 -> no crash
1. Install Firefox 27 and start with a clean profile
2. Run through your steps to reproduce with no add-ons
> No crash
3. Install Firebug 1.12.6 and run through your steps
> No crash
4. Install Adblock Plus 2.4.1 and run through your steps
> No crash
5. Install Live HTTP Headers 0.17 and run through your steps
> No crash
6. Install Omnivalidator 0.1.3 and run through your steps
> No crash
7. Install Fiddler 2 and restart Firefox
8. Opt in to Fiddler 2.4.5.9 add-on installation and restart Firefox
9. Run through your steps
> No crash

I have most of the same add-ons you have installed (except for Adobe Create PDF) and I cannot reproduce this crash. Granted some of the add-on versions are newer than those in your screenshots. Perhaps you could try updating your add-ons to see if this goes away. The only thing I can think of is that you may have left out some crucial step in your instructions or there is some other software interfering here.

Unfortunately we are no closer to steps to reproduce this crash.
In the case of Firebug, at least, they fixed it themselves in their latest release.
(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #21)
> Thanks for the instructions Ronald, and sorry for taking so long to get back
> to you.
> 
> I've tested what you described under several conditions:
>  * Firefox 27.0 with no add-ons -> no crash
>  * Firefox 27.0 with Firebug 1.12.6 -> no crash
>  * Firefox 27.0 with Adblock Plus 2.4.1 -> no crash
> 1. Install Firefox 27 and start with a clean profile
> 2. Run through your steps to reproduce with no add-ons
> > No crash
> 3. Install Firebug 1.12.6 and run through your steps
> > No crash
> 4. Install Adblock Plus 2.4.1 and run through your steps
> > No crash
> 5. Install Live HTTP Headers 0.17 and run through your steps
> > No crash
> 6. Install Omnivalidator 0.1.3 and run through your steps
> > No crash
> 7. Install Fiddler 2 and restart Firefox
> 8. Opt in to Fiddler 2.4.5.9 add-on installation and restart Firefox
> 9. Run through your steps
> > No crash
> 
> I have most of the same add-ons you have installed (except for Adobe Create
> PDF) and I cannot reproduce this crash. Granted some of the add-on versions
> are newer than those in your screenshots. Perhaps you could try updating
> your add-ons to see if this goes away. The only thing I can think of is that
> you may have left out some crucial step in your instructions or there is
> some other software interfering here.
> 
> Unfortunately we are no closer to steps to reproduce this crash.

Thanks for all the testing Anthony.

I can still reproduce the crash after upgrading to the 27.0 final. The key thing about the crash is having the firebug window open/active, I hope all your tests were conducted this way.

Otherwise, I'll try and reproduce it in another environment (at work now), to rule out other 'influences'.
Yes, all my testing except for step 2 (no addons) was done with Firebug open.
I don't think this bug needs to be tracked anymore. It does not show up in the top-300 crashes for any of the branches. When looking at total crashes I see 114 crashes in Release, 26 crashes in Beta, 0 crashes in Aurora, and 0 crashes in Nightly. Obviously this crash still occurs in some circumstances but unforunately it's not reproducible enough for me to investigate further at this time.
Keywords: topcrash-win
Alexander, can you still reproduce this?

Nothing on crash-stats for past 4 weeks for any current version
https://crash-stats.mozilla.com/query/?product=Firefox&version=Firefox%3A38.0a1&version=Firefox%3A37.0a2&version=Firefox%3A36.0b&version=Firefox%3A35.0&range_value=4&range_unit=weeks&date=01%2F30%2F2015+18%3A00%3A00&query_search=signature&query_type=contains&query=js%3A%3AObjectImpl%3A%3Acompartment&reason=&release_channels=&build_id=&process_type=any&hang_type=any

(In reply to Alexander L. Slovesnik from comment #2)
> I can reproduce this crash:
> 1) Install Yandex Elements extension from http://element.yandex.ru/
> 2) Restart browser
> 3) Open about:memory
> 4) Click on "Measure" button
> 
> There are some of my crash reports:
> https://crash-stats.mozilla.com/report/index/d353d5d9-35af-404b-9225-
> a129d2131029
> https://crash-stats.mozilla.com/report/index/f778a8ea-ddce-4fac-96a5-
> fd88e2131029
Flags: needinfo?(unghost)
(In reply to Wayne Mery (:wsmwk) from comment #26)
> Alexander, can you still reproduce this?
> 
> Nothing on crash-stats for past 4 weeks for any current version
> https://crash-stats.mozilla.com/query/?product=Firefox&version=Firefox%3A38.
> 0a1&version=Firefox%3A37.0a2&version=Firefox%3A36.0b&version=Firefox%3A35.
> 0&range_value=4&range_unit=weeks&date=01%2F30%2F2015+18%3A00%3A00&query_searc
> h=signature&query_type=contains&query=js%3A%3AObjectImpl%3A%3Acompartment&rea
> son=&release_channels=&build_id=&process_type=any&hang_type=any
> 
> (In reply to Alexander L. Slovesnik from comment #2)
> > I can reproduce this crash:
> > 1) Install Yandex Elements extension from http://element.yandex.ru/
> > 2) Restart browser
> > 3) Open about:memory
> > 4) Click on "Measure" button
> > 
> > There are some of my crash reports:
> > https://crash-stats.mozilla.com/report/index/d353d5d9-35af-404b-9225-
> > a129d2131029
> > https://crash-stats.mozilla.com/report/index/f778a8ea-ddce-4fac-96a5-
> > fd88e2131029

I still can reproduce it:
https://crash-stats.mozilla.com/report/index/b37da656-5419-4409-b91e-563242150130
https://crash-stats.mozilla.com/report/index/910814b1-39b8-4f0c-9969-7209a2150130
Flags: needinfo?(unghost)
Crash Signature: [@ js::ObjectImpl::compartment()] → [@ js::ObjectImpl::compartment()] [@ js::ObjectImpl::compartment]
Closing because no crash reported since 12 weeks.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.