Closed Bug 936604 Opened 6 years ago Closed 6 years ago

Crashes when going to event listeners tab

Categories

(Core :: User events and focus handling, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla29

People

(Reporter: fitzgen, Assigned: smaug)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(3 files)

I just experienced this twice.

1) https://crash-stats.mozilla.com/report/index/b16715a8-0d62-4386-89f0-84e2f2131108

2) https://crash-stats.mozilla.com/report/index/9143feee-b562-4be4-9de9-79b102131108

STR:

Open debugger

Open instrumentation panes

Select the break on dom events tab

BOOM!
I have been testing this on bugzilla bug pages, FWIW.
On windows, I get the same crash only when I follow the STR on bugzilla pages. Didn't try many other pages though. Also, did not try before today;s update too.
Doesn't happen for me in either OS X or Linux, but I'm about a day behind in sources. Must be a very recent regression. Ollie, any ideas?
Flags: needinfo?(bugs)
Hmm, nothing interesting has changed in ELS for awhile.
We're getting a bogus jsobject from wrappedJS?

Nick, any chance you could try to find the regression range?
Flags: needinfo?(bugs)
I can reproduce this using latest nightly.
Only affects me since I updated to today's nightly.
Duplicate of this bug: 942899
I still can't get this crash though.
Crash Signature: [@ nsEventListenerInfo::GetJSVal(JSContext*, mozilla::Maybe<JSAutoCompartment>&, JS::Value*)]
Fwiw, it seems to be happening only on OS X 10.9? We have tests for every other platform.
Hmm, I get the crash in my main profile (with dozens of tabs open), but not in my test profiles with up to a dozen tabs open.
Component: Developer Tools: Debugger → Event Handling
Product: Firefox → Core
Moving this to Core::Event Handling.

This is reproducible 100% of the time on any bugzilla page as per comment #1 and 2.

e.g., 
https://crash-stats.mozilla.com/report/index/69090137-ccd0-4e9c-b9bf-03b3d2140103
Can't reproduce. Based on stack traces this looks like a null pointer (or null+offset) crash.
Any chance someone who can reproduce could get an exact stack trace showing where we're actually
having the problem. crash-stat stacks are too vague.
Here is a crash log from a debug build with --enable-optimize. Let me know if a non-optimized debug build is required.
Duplicate of this bug: 942899
Attached patch guess fixSplinter Review
This might help. Could someone try this?
This patch seems to fix the crash for me.
Comment on attachment 8361354 [details] [diff] [review]
guess fix

We have similar null checks in ELM.
Attachment #8361354 - Flags: review?(bzbarsky)
Comment on attachment 8361354 [details] [diff] [review]
guess fix

r=me
Attachment #8361354 - Flags: review?(bzbarsky) → review+
Oh, and maybe add a testcase?
https://hg.mozilla.org/mozilla-central/rev/239b4d95624a
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Setting flag per above comments..
Flags: in-testsuite+
Issue is resolved - clearing old keywords - qa-wanted clean-up
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.