Closed Bug 934203 Opened 6 years ago Closed 6 years ago

Startup crash in JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) with Twitter Disconnect / Facebook Disconnect

Categories

(Core :: DOM: Core & HTML, defect, critical)

27 Branch
x86_64
Windows 8.1
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla28
Tracking Status
firefox26 --- unaffected
firefox27 + verified
firefox28 + verified

People

(Reporter: dholbert, Assigned: peterv)

References

Details

(Keywords: crash, regression, topcrash-win)

Crash Data

Attachments

(1 file, 1 obsolete file)

This bug was filed from the Socorro interface and is 
report bp-d5b4f674-1389-4170-b3f2-4713c2131103.
=============================================================

STR: Same as bug 931794 (install Twitter Disconnect or Facebook Disconnect, restart to complete installation).

I'm on Windows (ver 8.1).

With either of these addons installed, I'm unable to start recent nightly - always crashes within a few seconds. (Tried w/ fresh profile + twitter disconnect; it crashes reliably)

Sample crash report:
bp-d5b4f674-1389-4170-b3f2-4713c2131103
Can't reproduce on OS X.
I can reproduce the start up crash on windows7 after install twitter disconnect.
bp-814f0028-cd7d-4256-8025-351382131103

http://hg.mozilla.org/mozilla-central/rev/47c8e9b16918
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131103030204
Crash Signature: [@ JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>)] → [@ JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) ]
And also Crash in Aurora27.0a2
bp-8533a256-2c5a-49c4-8c21-8b6222131103

http://hg.mozilla.org/releases/mozilla-aurora/rev/27d0165a1097
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20131103004005
Version: Trunk → 27 Branch
There are 2 regressions
#1 Crash [@ mozilla::dom::WindowBinding::get_content ]
   http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a80dce1126db&tochange=4646259ab62d
   Troggered by Bug 918345
#2 Crash [@ JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) ]
   http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f0d363d72753&tochange=abe6790a5dd8
   Triggered by bug 931794

Regression window(m-c Nightly)
Good:
http://hg.mozilla.org/mozilla-central/rev/a80dce1126db
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20131027030205

#1 Bad [@ mozilla::dom::WindowBinding::get_content ]:
bp-40b8c650-6ac1-4c7d-b949-62cc12131103
http://hg.mozilla.org/mozilla-central/rev/4646259ab62d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 ID:20131028030205
bp-663345c9-1ec0-41f1-b208-47de32131103
http://hg.mozilla.org/mozilla-central/rev/518f5bff0ae4
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131029030201
bp-24cd6872-8622-4d2f-b7af-66b872131103
http://hg.mozilla.org/mozilla-central/rev/829d7bef8b0a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131030030201
bp-8b4cd97e-4803-4d2e-bf64-5dcf72131103
http://hg.mozilla.org/mozilla-central/rev/f0d363d72753
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131031030203

#2 Bad [@ JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) ]:
bp-a0b80ddd-4423-43f9-b113-99ed32131103
http://hg.mozilla.org/mozilla-central/rev/abe6790a5dd8
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131101030205
bp-afa204a4-00be-467e-a998-7d6ff2131103
http://hg.mozilla.org/mozilla-central/rev/2f7593f81351
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131102030205
bp-ad99948d-f32f-4a6d-b6fc-d0d0b2131103
http://hg.mozilla.org/mozilla-central/rev/47c8e9b16918
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 ID:20131103030204
Blocks: 931794
(In reply to Alice0775 White from comment #4)
> There are 2 regressions
> #1 Crash [@ mozilla::dom::WindowBinding::get_content ]
>    Troggered by Bug 918345
> #2 Crash [@ JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) ]
>    Triggered by bug 931794

(Alternately: bug 931794's fix may not have technically "triggered" this, but instead simply allowed us to avoid an earlier crash, which allows us to actually make it far enough to hit this (separate) crash.)
Blocks: 918345
Summary: Startup crash in JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) with Twitter Disconnect / Facebook Disconnect → Windows-only startup crash in JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) with Twitter Disconnect / Facebook Disconnect
Attached patch v1 (obsolete) — Splinter Review
Sigh.
Assignee: nobody → peterv
Status: NEW → ASSIGNED
Attachment #826664 - Flags: review?(bzbarsky)
Attached patch v1Splinter Review
Now after qref'ing.
Attachment #826664 - Attachment is obsolete: true
Attachment #826664 - Flags: review?(bzbarsky)
Attachment #826689 - Flags: review?(bzbarsky)
Comment on attachment 826689 [details] [diff] [review]
v1

Yummy xrays...
Attachment #826689 - Flags: review?(bzbarsky) → review+
This is currently #2 topcrash on Aurora (27). A startup crash which happens mostly on Windows with some Linux crashes. 

Many comments pointing to twitter, facebook and google disconnect add-ons.  Some comments say it doesn't happen with fresh profile.
Keywords: topcrash-win
https://hg.mozilla.org/mozilla-central/rev/7e6cb031ed8f
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
[Clarifying summary -- turns out I hit this on Linux as well -- I just didn't notice it right away, because I still had my Twitter/FB Disconnect addons disabled there, as a workaround for bug 931794. Sample linux crash report: bp-647381d8-befd-4c5f-92de-e29ba2131105 ]
Summary: Windows-only startup crash in JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) with Twitter Disconnect / Facebook Disconnect → Startup crash in JS_WrapValue(JSContext*, JS::MutableHandle<JS::Value>) with Twitter Disconnect / Facebook Disconnect
Comment on attachment 826689 [details] [diff] [review]
v1

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 918345
User impact if declined: crashes
Testing completed (on m-c, etc.): landed on m-c
Risk to taking this patch (and alternatives if risky): low-risk, just deals with null instead of crashing
String or IDL/UUID changes made by this patch: none
Attachment #826689 - Flags: approval-mozilla-aurora?
Attachment #826689 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0
Mozilla/5.0 (Windows NT 6.3; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0

Reproduced this issue with Aurora from 2013-11-05.
Verified as fixed on latest Aurora (Build ID: 20131106004000): no crash when restarting Firefox to complete the installation for Twitter Disconnect 2.1.2, Facebook Disconnect  2.1.3 and Google Disconnect  2.4.2.
Status: RESOLVED → VERIFIED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.