937631 - crash in js::AutoCompartment::AutoCompartment(js::ExclusiveContext*, JSObject*) | JSAbstractFramePtr::getThisValue(JSContext*, JS::MutableHandle<JS::Value>)

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Tracy Walker [:tracy]]

This bug was filed from the Socorro interface and is 
report bp-ad0eb76c-55dc-469f-a69a-2d2452131111.
=============================================================

With several high volume crashes fixed in Aurora, lower volume signatures are beginning to creep into the top crash criteria (top ten for Aurora). This one is #10.

Comment 1

[Robert Kaiser]

More reports are at https://crash-stats.mozilla.com/report/list?product=Firefox&signature=js%3A%3AAutoCompartment%3A%3AAutoCompartment%28js%3A%3AExclusiveContext%2A%2C+JSObject%2A%29+%7C+JSAbstractFramePtr%3A%3AgetThisValue%28JSContext%2A%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29 - this apparently is a regression in 26 and at low volume in Beta and Nightly but quite high on Aurora for a few days recently.

Comment 2

[Tracy Walker [:tracy]]

Something between 27b2 and 27b4 caused this to rise in over 3 times the volume.  It appears to be correlated to Firebug. 
100% (57/57) vs.   1% (431/37729) [e-mail] (Firebug, https://addons.mozilla.org/addon/1843)
     21% (12/57) vs.   1% (446/37729) {DDC359D1-844A-42a7-9AA1-88A850A938A8} (DownThemAll!, https://addons.mozilla.org/addon/201)
     16% (9/57) vs.   0% (103/37729) {c45c406e-ab73-11d8-be73-000a95be3b12} (Web Developer, https://addons.mozilla.org/addon/60)
     18% (10/57) vs.   4% (1364/37729) {b9db16a4-6edc-47ec-a1f4-b86292ed211d} (Video DownloadHelper, https://addons.mozilla.org/addon/3006)
     12% (7/57) vs.   0% (93/37729) {e968fc70-8f95-4ab9-9e79-304de2a71ee1} (User Agent Switcher, https://addons.mozilla.org/addon/59)
     12% (7/57) vs.   2% (658/37729) {e4a8a97b-f2ed-450b-b12d-ee082ba24781} (Greasemonkey, https://addons.mozilla.org/addon/748)
     11% (6/57) vs.   1% (261/37729) feca4b87-3be4-43da-a1b1-137c24220968@jetpack
      9% (5/57) vs.   0% (30/37729) {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a} (Live HTTP Headers, https://addons.mozilla.org/addon/3829)
      9% (5/57) vs.   0% (55/37729) {6AC85730-7D0F-4de0-B3FA-21142DD85326} (ColorZilla, https://addons.mozilla.org/addon/271)
      9% (5/57) vs.   1% (254/37729) {bee6eb20-01e0-ebd1-da83-080329fb9a3a}
      7% (4/57) vs.   0% (4/37729) lktips@robertkatic
      7% (4/57) vs.   0% (11/37729) [e-mail] (FireQuery, https://addons.mozilla.org/addon/12632)
      7% (4/57) vs.   0% (14/37729) {06997db0-c027-4d5f-bd37-b0d9230226ea} (Remove Cookie(s) for Site, https://addons.mozilla.org/addon/1595)
      7% (4/57) vs.   0% (16/37729) [e-mail]
      7% (4/57) vs.   0% (25/37729) [e-mail]
      7% (4/57) vs.   0% (26/37729) {74fa6b20-2ae6-4584-a4fd-4ac734f8d210}
      7% (4/57) vs.   0% (31/37729) {02450914-cdd9-410f-b1da-db004e18c671}
      7% (4/57) vs.   0% (32/37729) {9c51bd27-6ed8-4000-a2bf-36cb95c0c947} (Tamper Data, https://addons.mozilla.org/addon/966)
      7% (4/57) vs.   0% (44/37729) [e-mail]
      7% (4/57) vs.   0% (126/37729) {23fcfd51-4958-4f00-80a3-ae97e717ed8b}
      7% (4/57) vs.   0% (167/37729) {BBDA0591-3099-440a-AA10-41764D9DB4DB}
      7% (4/57) vs.   0% (186/37729) {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} (iMacros for Firefox, https://addons.mozilla.org/addon/3863)
      7% (4/57) vs.   1% (193/37729) {dc572301-7619-498c-a57d-39143191b318} (Tab Mix Plus, https://addons.mozilla.org/addon/1122)
    100% (57/57) vs.  94% (35459/37729) {972ce4c6-7e08-4474-a285-3208198ce6fd} (Default, https://addons.mozilla.org/addon/8150)
      5% (3/57) vs.   0% (5/37729) [e-mail]
      5% (3/57) vs.   0% (6/37729) firepicker@thedarkone
      5% (3/57) vs.   0% (7/37729) [e-mail]
      5% (3/57) vs.   0% (7/37729) [e-mail]
      5% (3/57) vs.   0% (8/37729) [e-mail] (FirePHP, https://addons.mozilla.org/addon/6149)
      5% (3/57) vs.   0% (8/37729) {fa8476cf-a98c-4e08-99b4-65a69cb4b7d4}
      5% (3/57) vs.   0% (8/37729) [e-mail] (Firediff, https://addons.mozilla.org/addon/13179)
      5% (3/57) vs.   0% (9/37729) [e-mail]
      5% (3/57) vs.   0% (10/37729) [e-mail]
      5% (3/57) vs.   0% (10/37729) {F32E7E42-9AFA-47CA-A0C4-D07EE651D404}
      5% (3/57) vs.   0% (14/37729) [e-mail]
      5% (3/57) vs.   0% (17/37729) {3b56bcc7-54e5-44a2-9b44-66c3ef58c13e} (Html Validator, https://addons.mozilla.org/addon/249)
      5% (3/57) vs.   0% (20/37729) {75CEEE46-9B64-46f8-94BF-54012DE155F0} (MeasureIt, https://addons.mozilla.org/addon/539)
      5% (3/57) vs.   0% (40/37729) [e-mail]
      5% (3/57) vs.   0% (48/37729) [e-mail] (SQLite Manager, https://addons.mozilla.org/addon/5817)
      5% (3/57) vs.   0% (64/37729) jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack
      5% (3/57) vs.   0% (65/37729) {B21F5E31-B8E8-41CD-B74C-168A71A10E49}
      5% (3/57) vs.   0% (78/37729) ScorpionSaver@jetpack

Comment 3

[Tracy Walker [:tracy]]

bajaj, this is one of the cuts contributing to the overall decreased stability of 27betas compared to 26.

Comment 4

[bhavana bajaj [:bajaj]]

Tracy, adding qawanted/steps-wanted to see if we can reproduce this. I think that will help a lot with investigation. Steven, would you be right assignee here to help with investigation ?

Our Fx27 beta's are rather crashier and keeping in mind we are very close to release, requesting urgent help here.Anything we can do to speedup investigation please let us know.

Comment 5

[Tracy Walker [:tracy]]

Kairo, are versions of Firebug available for this signature?  I see 1.12.4 and 1.12.5 in some reports.  Wondering if any of their 1.13 versions crash here?

Windows and a few crashes on Linux.  I'll install Firebug on a Windows machine to see, if I can reproduce.

Comment 6

[Steven Michaud [:smichaud] (Retired)]

> Steven, would you be right assignee here to help with investigation?

Probably not.

This is (mostly) a Windows bug, and I don't know much about debugging/reverse-engineering on Windows.  Also, though bug 877377 (which is mostly a Mac bug) has an almost identical signature, there's at least one very significant difference in these crashes' "epidemilogy" on the two different platforms -- on Windows there are lots of crashes on the 27 branch and very few on earlier branches, but on OS X there are lots of crashes on the 26 branch but relatively few on the 27 branch.  So (at least for now) it makes sense to pursue these bugs separately.

Furthermore, there are (apparently) almost no reports of either crash on the 28 or 29 branches -- so they may already be "fixed".

It's probably worth some effort to try to reproduce these.  But if we can't, I think it's probably best just to wait and see what happens on the 28 and 29 branches.

Comment 7

[Steven Michaud [:smichaud] (Retired)]

We should probably ask a Firebug person to help us here.  But I don't know who to ask.

Comment 8

[bhavana bajaj [:bajaj]]

(In reply to Steven Michaud from comment #6)
> > Steven, would you be right assignee here to help with investigation?
> 
> Probably not.
> 
> This is (mostly) a Windows bug, and I don't know much about
> debugging/reverse-engineering on Windows.  Also, though bug 877377 (which is
> mostly a Mac bug) has an almost identical signature, there's at least one
> very significant difference in these crashes' "epidemilogy" on the two
> different platforms -- on Windows there are lots of crashes on the 27 branch
> and very few on earlier branches, but on OS X there are lots of crashes on
> the 26 branch but relatively few on the 27 branch.  So (at least for now) it
> makes sense to pursue these bugs separately.
Thanks for the thoughts Steven. lets see if honza has any ideas due to his firebug expertise here in parallel to our QA efforts.
> 
> Furthermore, there are (apparently) almost no reports of either crash on the
> 28 or 29 branches -- so they may already be "fixed".
Hmm..may be, in which case we should uplift the resolving patch if we can find it or it may be because the volume/ADI is too low
> 
> It's probably worth some effort to try to reproduce these.  But if we can't,
> I think it's probably best just to wait and see what happens on the 28 and
> 29 branches.

Comment 9

[bhavana bajaj [:bajaj]]

(In reply to Steven Michaud from comment #7)
> We should probably ask a Firebug person to help us here.  But I don't know
> who to ask.

haha :) just NI :honza to get help here.

Comment 10

[Tracy Walker [:tracy]]

(In reply to Steven Michaud from comment #7)
> We should probably ask a Firebug person to help us here.  But I don't know
> who to ask.

Yes, that's also why I asked for versions from Socorro; to see if Firebug's latest developer version is crashing or not in Fx.

I've installed 1.12.5 on a windows 8 machine. poked around with Firebug a bit with no crash.  But am certainly not a power Firebug user.

Comment 11

[Robert Kaiser]

(In reply to [:tracy] Tracy Walker - QA Mentor from comment #5)
> Kairo, are versions of Firebug available for this signature?

Sorry, correlation data is spotty recently, with bug 947021 and possibly more, so we do not have version data there right now.

Comment 12

[Jan Honza Odvarko [:Honza] (always need-info? me)]

(In reply to Steven Michaud from comment #7)
> We should probably ask a Firebug person to help us here.  But I don't know
> who to ask.
I am happy to help here! Do you have any STR I should follow to
test the crash? Or what scenario should I check out?

Honza

Comment 13

[Steven Michaud [:smichaud] (Retired)]

(In reply to comment #12)

What's here in the bug is pretty much all the information there is, at least for now.  And no, we don't have STR.

I was hoping you might be able to glean some information from the crash stacks.  Also take a look at the correlations from comment #2:  The correlation with Firebug is very strong, but the other correlations suggest these crashes are more likely to happen when Firebug is combined with some other extensions.

I noticed one comment that might be helpful:
Using ExtJS 4.2 Javascript Framework; Carsh occurs on page reload; This issue does not occur in FF v25

But there are very few comments, and most of them are unhelpful.

Comment 14

[Steven Michaud [:smichaud] (Retired)]

The crash stacks for the Mac version of this bug (bug 877377) have a lot more comments (even though the number of crashes is actually smaller).  Here are some that might be helpful:

Using ninjamock again. Seems that ninjaMock is a heavy user of JS engine.
bp-4c65328a-1c20-43cf-9fa5-be91b2140116
working with Google Maps API and Firebug console are killing it. Google Chrome console shows "Uncaught RangeError: Maximum call stack size exceeded" error 
bp-3935d39a-aca7-4a43-ba15-2306e2140115
CAUSED BY
document.getElementById("tabs-1").style.display="none";
bp-33049678-5ba4-44b3-9e6f-c32fd2140117
I clicked on the gmail "start a video chat" button or whatever it's called. Opened a new window, hung, and then crashed.
bp-e877c6bf-eb25-4f61-a852-f95162140118
pasting large amount of text in Google document
bp-22ddb2fa-55f8-4111-84ae-eff9b2140114
trying to debug an SVG chart and Firefox keeps crashing. which makes debugging difficult.
bp-a9c18cec-89f1-4876-a974-4a1382140120

See more comments at:
https://crash-stats.mozilla.com/report/list?product=Firefox&query_type=contains&range_unit=weeks&process_type=any&hang_type=any&signature=JSAbstractFramePtr%3A%3AgetThisValue%28JSContext*%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29&date=2014-01-20+17%3A00%3A00&range_value=4&page=3#comments

Comment 15

[Steven Michaud [:smichaud] (Retired)]

Using ExtJS 4.2 Javascript Framework; Carsh occurs on page reload; This issue does not occur in FF v25
bp-cf2dae3b-1197-4eab-a441-e34852140114

Comment 16

[Cornel Ionce [:noni] [Hubs QA]]

I've tried without any success for several hours to obtain this crash.
Tested on Windows 7 32 bit, using FF 27.0b7 (42.82 % of the crashes occurred in this version).

I had Firebug opened and tested several scenarios with ninjamock, DownThemAll!, Web Developer, Video DownloadHelper, Greasemonkey, google maps, gmail and pasting large/extremly large amount of text in Google documents.

I've managed to crash a couple of times but with other signatures, and each time it crashed when pasting large/extremly large amount of text in Google documents and loading ninjamock simultaneously.

Obtained crash IDs:
4ccba8d9-7c1c-4efb-93eb-812ee2140124
13032457-6e5c-451b-bc65-b5ad52140124
5973d75c-dbda-47c3-8881-f9e702140124
a63fb4a3-21f7-468c-865c-9a8152140124

Comment 17

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Not sure if it's related, but we are experiencing a new crash
(STR includes Firebug). Reported here:
https://bugzilla.mozilla.org/show_bug.cgi?id=963289
(regression range available)

Honza

Comment 18

[Steven Michaud [:smichaud] (Retired)]

(Following up comment #16)

> Obtained crash IDs:
> 4ccba8d9-7c1c-4efb-93eb-812ee2140124
> 13032457-6e5c-451b-bc65-b5ad52140124
> 5973d75c-dbda-47c3-8881-f9e702140124
> a63fb4a3-21f7-468c-865c-9a8152140124

bp-4ccba8d9-7c1c-4efb-93eb-812ee2140124
bp-13032457-6e5c-451b-bc65-b5ad52140124
bp-5973d75c-dbda-47c3-8881-f9e702140124
bp-a63fb4a3-21f7-468c-865c-9a8152140124

Comment 19

[Steven Michaud [:smichaud] (Retired)]

(In reply to comment #17)

The one crash stack from bug 963289 comment #0 (bp-2022317f-7cac-4e2d-b0b8-008a52140123) doesn't look related -- getThisValue doesn't appear anywhere in it.

Comment 20

[u279076]

Seems like this is all but gone except for in Beta:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=js%3A%3AAutoCompartment%3A%3AAutoCompartment%28js%3A%3AExclusiveContext*%2C+JSObject*%29+|+JSAbstractFramePtr%3A%3AgetThisValue%28JSContext*%2C+JS%3A%3AMutableHandle%3CJS%3A%3AValue%3E%29

I see no crashes for Nightly and Aurora, and only 14 crashes on Release. It does qualify as a topcrash on Beta however with 1880 crashes in the last week (0.8% of all browser crashes on Beta). Updating the status flags to reflect this current state. I'm not sure what more we can do without steps to reproduce.

Comment 21

[Kai Ruhnau]

I've experienced this crash several times since switching to 26, most recently two days ago:
https://crash-stats.mozilla.com/report/index/f26ddfa8-77d7-47ce-9b63-6a77d2140125
It's on a Linux system, so it's not related to just Windows, but I am running Firebug (1.12.6).

I haven't yet found a way to explicitly trigger it—on Friday it happened when I switched from one tab to another. But several occurrences earlier in January where with the web version of MS Word (Office 365).

Comment 22

[u279076]

(In reply to Kai Ruhnau from comment #21)

Please let us know immediately if you find reliable steps to reproduce. Thank you.

Comment 23

[Steven Michaud [:smichaud] (Retired)]

There have been none of these over the last 4 weeks on the 28, 29 and 30 branches.

Over the same time interval there've been 5822 of these on the 27 branch (5802 on Windows and 20 on Linux).

I'm pretty sure this means that this bug, like bug 877377, has somehow been "fixed".

(Note that there've been three betas released on the 28 branch.  So these results can no longer be explained by the differences between the nightly and beta user bases.)

Comment 24

[ewolfman]

I have these crashes on a daily basis when I have Firebug open with the debugger panel enabled and using the excellent FileUpload plugin (https://github.com/blueimp/jQuery-File-Upload) to async upload files - crashes that did not exist in earlier Firefox and Firebug versions (I noticed these crashes at least since version 26 if not before and up until nowaday's 27.0.1).

Comment 25

[Steven Michaud [:smichaud] (Retired)]

(In reply to comment #23)

I suggest you test with the latest FF 28 beta (ftp://ftp.mozilla.org/pub/firefox/releases/28.0b3/).  As I said in comment #23, these crashes seem to have disappeared on the 28 branch (and up).

Comment 26

[Rob Marshall [tH]]

I can reproduce this reliably in an internal application that has an infinite recursion bug.

bp-feb357ee-5dbe-4300-b286-29a6e2140219
Brand new profile plus Firebug with debugger attached.

Does not crash without debugging, or in 28.0b4.

Comment 27

[Steven Michaud [:smichaud] (Retired)]

> I can reproduce this reliably in an internal application that has an infinite recursion bug.

If possible, please write a reduced testcase and attach it here, with source code.  In other words please make the reduced testcase public.

Comment 28

[Kai Ruhnau]

On my Linux box, I haven't seen this since the last time, but I also disabled Firebug completely.

Today however, I ran into this with Firefox 27 on Windows 8.1 with Firebug active.
The only thing I did was navigating through some data sets in an internal web application, which means I was clicking on the "next" link again and again and each time a single GET request was issued to the web server. The only thing special was, that I was navigating as fast as possible. It might even have been before all the JavaScript fully ran (jQuery mobile…).

Comment 29

[Steven Michaud [:smichaud] (Retired)]

It's only news if this crash happens on the 28 branch or up.  As far as we know it's disappeared there.

Comment 30

[Wayne Mery (:wsmwk)]

(In reply to Steven Michaud [:smichaud] (Retired) from comment #29)
> It's only news if this crash happens on the 28 branch or up.  As far as we
> know it's disappeared there.

indeed