934251 - crash in mozilla::dom::WindowBinding::get_content trying to create a Saved Search

Status: VERIFIED DUPLICATE of bug 931794

(Thunderbird :: Search, defect)

Description

[Wayne Mery (:wsmwk)]

100% reproducible.

1. edit | find | search messages
2. pick an imap account (or local folder)
3. with no search terms added, click "Save"
crash

perhaps regression - earliest crash I find is version 27.0a1
bp-4db9b4d8-c5f8-4530-9f97-e40542131030 
build 20131028030203

This bug was filed from the Socorro interface and is 
report bp-4acb2d04-d014-4653-848a-06b362131103.
=============================================================
0	xul.dll	mozilla::dom::WindowBinding::get_content	objdir-tb/mozilla/dom/bindings/WindowBinding.cpp
1	xul.dll	mozilla::dom::WindowBinding::genericGetter	objdir-tb/mozilla/dom/bindings/WindowBinding.cpp
2	mozjs.dll	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct)	js/src/vm/Interpreter.cpp
3	mozjs.dll	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
4	mozjs.dll	js::InvokeGetterOrSetter(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
5	mozjs.dll	js::Shape::get(JSContext *,JS::Handle<JSObject *>,JSObject *,JSObject *,JS::MutableHandle<JS::Value>)	js/src/vm/Shape-inl.h
6	mozjs.dll	js::baseops::GetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	js/src/jsobj.cpp
7	mozjs.dll	js::DirectProxyHandler::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	js/src/jsproxy.cpp
8	xul.dll	nsOuterWindowProxy::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	dom/base/nsGlobalWindow.cpp
9	mozjs.dll	js::Proxy::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	js/src/jsproxy.cpp
10	mozjs.dll	proxy_GetGeneric	js/src/jsproxy.cpp
11	mozjs.dll	js::DirectProxyHandler::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	js/src/jsproxy.cpp
12	mozjs.dll	js::CrossCompartmentWrapper::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	js/src/jswrapper.cpp
13	mozjs.dll	js::Proxy::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>)	js/src/jsproxy.cpp
14	mozjs.dll	proxy_GetGeneric	js/src/jsproxy.cpp
15	mozjs.dll	js::jit::DoGetElemFallback	js/src/jit/BaselineIC.cpp
16		@0x7e604b	
17		@0x7e15f9	
18	mozjs.dll	EnterBaseline	js/src/jit/BaselineJIT.cpp
19	mozjs.dll	js::jit::EnterBaselineAtBranch(JSContext *,js::StackFrame *,unsigned char *)	js/src/jit/BaselineJIT.cpp
20	mozjs.dll	Interpret	js/src/vm/Interpreter.cpp
21	mozjs.dll	js::RunScript(JSContext *,js::RunState &)	js/src/vm/Interpreter.cpp
22	mozjs.dll	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct)	js/src/vm/Interpreter.cpp
23	mozjs.dll	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
24	mozjs.dll	js::DirectProxyHandler::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &)	js/src/jsproxy.cpp
25	mozjs.dll	js::CrossCompartmentWrapper::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &)	js/src/jswrapper.cpp
26	mozjs.dll	js::Proxy::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &)	js/src/jsproxy.cpp
27	mozjs.dll	proxy_Call	js/src/jsproxy.cpp
28	mozjs.dll	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct)	js/src/vm/Interpreter.cpp
29	mozjs.dll	Interpret	js/src/vm/Interpreter.cpp
30	mozjs.dll	js::RunScript(JSContext *,js::RunState &)	js/src/vm/Interpreter.cpp
31	mozjs.dll	js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct)	js/src/vm/Interpreter.cpp
32	mozjs.dll	js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>)	js/src/vm/Interpreter.cpp
33	mozjs.dll	JS_CallFunctionValue(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::Value *)	js/src/jsapi.cpp
34	xul.dll	mozilla::dom::EventListener::HandleEvent(JSContext *,JS::Handle<JSObject *>,nsDOMEvent &,mozilla::ErrorResult &)	objdir-tb/mozilla/dom/bindings/EventListenerBinding.cpp
35	xul.dll	mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>(mozilla::dom::EventTarget * const &,nsDOMEvent &,mozilla::ErrorResult &,mozilla::dom::CallbackObject::ExceptionHandling)	objdir-tb/mozilla/dist/include/mozilla/dom/EventListenerBinding.h
36	xul.dll	nsEventListenerManager::HandleEventSubType(nsListenerStruct *,mozilla::dom::CallbackObjectHolder<mozilla::dom::EventListener,nsIDOMEventListener> const &,nsIDOMEvent *,mozilla::dom::EventTarget *,nsCxPusher *)	content/events/src/nsEventListenerManager.cpp
37	xul.dll	nsEventListenerManager::HandleEventInternal(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *,nsCxPusher *)	content/events/src/nsEventListenerManager.cpp
38	xul.dll	nsEventListenerManager::HandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *,nsCxPusher *)	content/events/src/nsEventListenerManager.h
39	xul.dll	nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor &,ELMCreationDetector &,nsCxPusher *)	content/events/src/nsEventDispatcher.cpp
40	xul.dll	nsEventTargetChainItem::HandleEventTargetChain(nsTArray<nsEventTargetChainItem> &,nsEventChainPostVisitor &,nsDispatchingCallback *,ELMCreationDetector &,nsCxPusher *)	content/events/src/nsEventDispatcher.cpp
41	xul.dll	nsEventDispatcher::Dispatch(nsISupports *,nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent *,nsEventStatus *,nsDispatchingCallback *,nsCOMArray<mozilla::dom::EventTarget> *)	content/events/src/nsEventDispatcher.cpp
42	xul.dll	nsDocumentViewer::LoadComplete(tag_nsresult)	layout/base/nsDocumentViewer.cpp
43	xul.dll	nsDocShell::EndPageLoad(nsIWebProgress *,nsIChannel *,tag_nsresult)	docshell/base/nsDocShell.cpp

Comment 1

[Wayne Mery (:wsmwk)]

I incorrectly assumed this was not a *major* regression. Item 3a is NOT required. Just try to create normal saved search

1. edit | find | search messages
2. pick an imap account (or local folder)
3. a) with no search terms added, b) click "Save"
crash

Comment 2

[:aceman]

Looking at the stack, shouldn't this be fixed in JS/DOM core?

Comment 3

[Wayne Mery (:wsmwk)]

It's likely a dupe of bug 931794 or friends because crashes end after 10-31 [1] and I'm on TB28.0a1 (2013-10-30), so it's within the period where that crash is live. But bugs that go to core can get lost, so I'd just as soon it stay here, and dupe it from here if it's a regression that's already has a bug report and/or is already fixed in core. Or anyone else can do the testing just as well as me - I'm happy to not both file and kill the bugs :)

[1] https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AWindowBinding%3A%3Aget_content&product=Thunderbird&query_type=is_exactly&range_unit=weeks&process_type=any&hang_type=any&date=2013-11-04+11%3A00%3A00&range_value=4#reports

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Yeah, should be a dupe.

Comment 6

[Wayne Mery (:wsmwk)]

definitely the dupe - crash ends starting with 2013-11-01 nightly