994657 - crash in xpc::WindowOrNull(JSObject*)

Status: RESOLVED WORKSFORME

(Core :: XUL, defect)

Description

[Liz Henry (:lizzard)]

This bug was filed from the Socorro interface and is 
report bp-67f06b48-668c-43ce-8fbc-0852d2140403.
=============================================================
This crash signature first appeared on 3-20-2014 for Firefox 31.0a1, with 76 out of 15960 crashes. It's only the #35 crasher for Firefox 31; I'm reporting it because it first appeared recently. The crash appears on Windows, Linux, and Mac. 

More reports: https://crash-stats.mozilla.com/report/list?product=Firefox&query_type=contains&range_unit=days&process_type=any&hang_type=any&signature=xpc%3A%3AWindowOrNull%28JSObject*%29&date=2014-04-10+13%3A00%3A00&range_value=28#tab-sigsummary

Comment 1

[Liz Henry (:lizzard)]

The first build it appeared in was 2014031903, so here are the commits between 2014031803 and 2014031903. 

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=082761b7bc54&tochange=3bc3b9e2cd99

Comment 2

[Liz Henry (:lizzard)]

Larissa, does this happen consistently with Facebook and the Socialfixer addon? Can you give steps to reproduce the crash? Or is it intermittent?

Comment 3

[Liz Henry (:lizzard)]

stack: 

0 	XUL 	xpc::WindowOrNull(JSObject*) 	js/xpconnect/src/xpcprivate.h
1 	XUL 	XPCJSRuntime::InterruptCallback(JSContext*) 	js/xpconnect/src/XPCJSRuntime.cpp
2 	XUL 	js::InvokeInterruptCallback(JSContext*) 	js/src/jscntxt.cpp
3 	XUL 	Interpret 	js/src/jscntxt.h
4 	XUL 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
5 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
6 	XUL 	Interpret 	js/src/vm/Interpreter.cpp
7 	XUL 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
8 	XUL 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
9 	XUL 	IntlInitialize 	js/src/builtin/Intl.cpp
10 	XUL 	js_InitIntlClass(JSContext*, JS::Handle<JSObject*>) 	js/src/builtin/Intl.cpp
11 	XUL 	js::GlobalObject::resolveConstructor(JSContext*, JS::Handle<js::GlobalObject*>, JSProtoKey) 	js/src/vm/GlobalObject.cpp
12 	XUL 	js::GlobalObject::initStandardClasses(JSContext*, JS::Handle<js::GlobalObject*>) 	js/src/vm/GlobalObject.cpp
13 	XUL 	JS_InitStandardClasses(JSContext*, JS::Handle<JSObject*>) 	js/src/jsapi.cpp
14 	XUL 	XPCWrappedNative::WrapNewGlobal(xpcObjectHelper&, nsIPrincipal*, bool, bool, JS::CompartmentOptions&, XPCWrappedNative**) 	js/xpconnect/src/XPCWrappedNative.cpp
15 	XUL 	nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext*, nsISupports*, nsIPrincipal*, unsigned int, JS::CompartmentOptions&, nsIXPConnectJSObjectHolder**) 	js/xpconnect/src/nsXPConnect.cpp
16 	XUL 	nsFrameScriptExecutor::InitTabChildGlobalInternal(nsISupports*, nsACString_internal const&) 	content/base/src/nsFrameMessageManager.cpp
17 	XUL 	nsInProcessTabChildGlobal::InitTabChildGlobal() 	content/base/src/nsInProcessTabChildGlobal.cpp
18 	XUL 	nsInProcessTabChildGlobal::LoadFrameScript(nsAString_internal const&, bool) 	content/base/src/nsInProcessTabChildGlobal.cpp
19 	XUL 	nsAsyncScriptLoad::Run() 	content/base/src/nsInProcessTabChildGlobal.cpp
20 	XUL 	nsContentUtils::RemoveScriptBlocker() 	content/base/src/nsContentUtils.cpp
21 	XUL 	nsDocument::EndUpdate(unsigned int) 	content/base/src/nsDocument.cpp
22 	XUL 	mozilla::dom::XULDocument::EndUpdate(unsigned int) 	content/xul/document/src/XULDocument.cpp
23 	XUL 	nsINode::ReplaceOrInsertBefore(bool, nsINode*, nsINode*, mozilla::ErrorResult&) 	content/base/src/mozAutoDocUpdate.h
24 	XUL 	mozilla::dom::NodeBinding::appendChild 	obj-firefox/x86_64/dist/include/nsINode.h
25 	XUL 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
26 		@0x10e4ce791

Comment 4

[Larissa Shapiro]

The crash/freeze is not constant now. Its gotten better in current nightly (31.0a1 (2014-04-08)). I'll upgrade today and see what happens. I think Socialfixer is possibly the culprit (unfortunate, because its an awesome add-on in general)

Comment 5

[Dão Gottwald [:dao]]

I just got this twice upon restoring a session. Facebook was part of that. I don't use the Socialfixer add-on.

Comment 6

[Dão Gottwald [:dao]]

Excluding the facebook tab in about:sessionrestore doesn't seem to help...

Comment 8

[Kevin Brosnan [Ex-Mozilla]]

From the duplicate running the following JS crashes,

function iwindows_crash()

{

	var i, new_win, new_doc;

	for(i = 1; ;++i)
	{
		new_win = window.open("blank.htm", "wind" + i);
		new_doc = new_win.document;
		new_doc.open();
		new_doc.writeln("<html>");
		new_doc.writeln("<head>");
		new_doc.writeln("<title>Windows #" + i + "</title>");
		new_doc.writeln("<h3>Windows #" + i + "</h3>");
		new_doc.writeln("<hr>");
		new_doc.writeln("</head>");
		new_doc.writeln("<body>");
		new_doc.writeln("</body>");
		new_doc.writeln("</html>");
		new_doc.close();
	}

}

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Firefox hasn't seen these crashes since Fx34. There are a couple TB38 crashes with the same top frame, but the stack underneath is completely different. Calling this WFM.