978417 - [e10s] "Open Link in New Window" from e10s window crashes in xpc::WrapperFactory::PrepareForWrapping() when Lightbeam addon is installed

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[Chris Peterson [:cpeterson]]

STR:
1. Open an e10s window.
2. From the e10s window, right-click on a link and select "Open Link in New Window" or "Open Link in New Private Window".

RESULT:
CRASH!

bp-0ac638c0-c728-4dd5-8c21-5cd762140301
bp-39b4bb38-698b-4149-860a-03f9e2140301

Frame 	Module 	Signature 	Source
0 	XUL 	xpc::WrapperFactory::PrepareForWrapping(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, unsigned int) 	js/xpconnect/src/xpcprivate.h
1 	XUL 	JSCompartment::wrap(JSContext*, JS::MutableHandle<JSObject*>, JS::Handle<JSObject*>) 	js/src/jscompartment.cpp
2 	XUL 	JSCompartment::wrap(JSContext*, JS::MutableHandle<JS::Value>, JS::Handle<JSObject*>) 	js/src/jscompartmentinlines.h
3 	XUL 	js::CrossCompartmentWrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/jswrapper.cpp
4 	XUL 	js::Proxy::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) 	js/src/jsproxy.cpp
5 	XUL 	js::proxy_Call(JSContext*, unsigned int, JS::Value*) 	js/src/jsproxy.cpp
6 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
7 	XUL 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
8 	XUL 	JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
9 	XUL 	nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) 	js/xpconnect/src/XPCWrappedJSClass.cpp
10 	XUL 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_darwin.cpp
11 	XUL 	SharedStub 	
12 	XUL 	xptiInterfaceEntry::GetEntryForParam(unsigned short, nsXPTParamInfo const*, xptiInterfaceEntry**) 	xpcom/reflect/xptinfo/src/xptiInterfaceInfo.cpp
13 	XUL 	nsContentPolicy::CheckPolicy(tag_nsresult (nsIContentPolicy::*)(unsigned int, nsIURI*, nsIURI*, nsISupports*, nsACString_internal const&, nsISupports*, nsIPrincipal*, short*), unsigned int, nsIURI*, nsIURI*, nsISupports*, nsACString_internal const&, nsISupports*, nsIPrincipal*, short*) 	content/base/src/nsContentPolicy.cpp
14 	XUL 	nsContentPolicy::ShouldLoad(unsigned int, nsIURI*, nsIURI*, nsISupports*, nsACString_internal const&, nsISupports*, nsIPrincipal*, short*) 	content/base/src/nsContentPolicy.cpp
15 	XUL 	NS_CheckContentLoadPolicy(unsigned int, nsIURI*, nsIPrincipal*, nsISupports*, nsACString_internal const&, nsISupports*, short*, nsIContentPolicy*, nsIScriptSecurityManager*) 	obj-firefox/x86_64/dist/include/nsContentPolicyUtils.h
16 	XUL 	nsDocShell::InternalLoad(nsIURI*, nsIURI*, nsISupports*, unsigned int, char16_t const*, char const*, nsAString_internal const&, nsIInputStream*, nsIInputStream*, unsigned int, nsISHEntry*, bool, nsAString_internal const&, nsIDocShell*, nsIURI*, nsIDocShell**, nsIRequest**) 	docshell/base/nsDocShell.cpp
17 	XUL 	nsDocShell::LoadURI(nsIURI*, nsIDocShellLoadInfo*, unsigned int, bool) 	docshell/base/nsDocShell.cpp
18 	XUL 	nsDocShell::LoadURIWithBase(char16_t const*, unsigned int, nsIURI*, nsIInputStream*, nsIInputStream*, nsIURI*) 	docshell/base/nsDocShell.cpp
19 	XUL 	_ZThn288_N10nsDocShell7LoadURIEPKDsjP6nsIURIP14nsIInputStreamS5_ 	docshell/base/nsDocShell.cpp
20 	XUL 	NS_InvokeByIndex 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp
21 	XUL 	XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) 	js/xpconnect/src/XPCWrappedNative.cpp
22 	XUL 	XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp
23 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
24 	XUL 	Interpret 	js/src/vm/Interpreter.cpp
25 	XUL 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
26 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
27 	XUL 	js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*) 	js/src/jsfun.cpp
28 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
29 	XUL 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
30 	XUL 	JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
31 	XUL 	mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, nsDOMEvent&, mozilla::ErrorResult&) 	obj-firefox/x86_64/dom/bindings/EventListenerBinding.cpp
32 	XUL 	void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, nsDOMEvent&, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling) 	obj-firefox/x86_64/dist/include/mozilla/dom/EventListenerBinding.h
33 	XUL 	nsEventListenerManager::HandleEventSubType(nsListenerStruct*, nsIDOMEvent*, mozilla::dom::EventTarget*) 	dom/events/nsEventListenerManager.cpp
34 	XUL 	nsEventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) 	dom/events/nsEventListenerManager.cpp
35 	XUL 	nsEventTargetChainItem::HandleEventTargetChain(nsTArray<nsEventTargetChainItem>&, nsEventChainPostVisitor&, nsDispatchingCallback*, ELMCreationDetector&) 	dom/events/nsEventDispatcher.cpp
36 	XUL 	nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) 	dom/events/nsEventDispatcher.cpp
37 	XUL 	nsEventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) 	dom/events/nsEventDispatcher.cpp
38 	XUL 	nsPresContext::FireDOMPaintEvent(nsInvalidateRequestList*) 	layout/base/nsPresContext.cpp
39 	XUL 	DelayedFireDOMPaintEvent::Run() 	layout/base/nsPresContext.cpp
40 	XUL 	nsContentUtils::RemoveScriptBlocker() 	content/base/src/nsContentUtils.cpp
41 	XUL 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	obj-firefox/x86_64/dist/include/nsContentUtils.h
42 	XUL 	nsViewManager::WillPaintWindow(nsIWidget*) 	view/src/nsViewManager.cpp
43 	XUL 	nsView::WillPaintWindow(nsIWidget*) 	view/src/nsView.cpp
44 	XUL 	-[ChildView viewWillDraw] 	widget/cocoa/nsChildView.mm
45 	AppKit 	AppKit@0x17a051 	
46 	CoreGraphics 	CoreGraphics@0x5e21b 	
47 	CoreGraphics 	CoreGraphics@0x5e160 	
48 	AppKit 	AppKit@0x179ae1 	
49 	AppKit 	AppKit@0x335a7 	
50 	AppKit 	AppKit@0x17a432 	
51 	AppKit 	AppKit@0x17a322 	
52 	AppKit 	AppKit@0xa63673 	
53 	AppKit 	AppKit@0x17a051 	
54 	CoreGraphics 	CoreGraphics@0x5e2ac 	
55 	libobjc.A.dylib 	libobjc.A.dylib@0x5080 	
56 	CoreGraphics 	CoreGraphics@0x5e160 	
57 	AppKit 	AppKit@0x179ae1 	
58 	AppKit 	AppKit@0x335a7 	
59 	AppKit 	AppKit@0x17a322 	
60 	libobjc.A.dylib 	libobjc.A.dylib@0x5080 	
61 	AppKit 	AppKit@0x178cba

Comment 1

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

What add-ons are you using? Does it go away if you disable them?

Comment 2

[Chris Peterson [:cpeterson]]

This crash is triggered by Mozilla's Lightbeam add-on: https://addons.mozilla.org/en-US/firefox/addon/lightbeam/

Comment 3

[Chris Peterson [:cpeterson]]

This crash is related to opening a non-e10s window from the e10s window. If I set browser.tabs.remote.autostart=true so Firefox is always running in e10s, then opening a link in a new [e10s] window does not crash.

Comment 4

[Bobby Holley (:bholley)]

Whoever ends up investigating this - needinfo me if you want help understanding what this code is doing.

Comment 5

[Chris Peterson [:cpeterson]]

Bug 978892 is another e10s session store crash when Lightbeam addon is installed (but with a different stack trace).

Comment 6

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.