firefox crash @js_Interpret @js_Invoke @nsXPCWrappedJSClass::CallMethod

[Zooko Wilcox-O'Hearn]

Binary package hint: firefox-3.0

Summary: firefox crash @js_Interpret @js_Invoke @nsXPCWrappedJSClass::CallMethod

Backtrace: http://launchpadlibrarian.net/24206868/Stacktrace.txt

StacktraceTop:

js_Interpret (cx=0x888120) at jsinterp.c:4186
js_Invoke (cx=0x888120, argc=4, vp=0x9012b8,
nsXPCWrappedJSClass::CallMethod (this=0x23e2a90,
PrepareAndDispatch (self=0x1992040,
SharedStub ()

Original description:

I just launched it and it tried to load many (dozens) of remembered tabs, so the js in question could be any of them. I would be willing to help you track it down.

ProblemType: Crash
Architecture: amd64
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/lib/firefox-3.0.7/firefox
Package: firefox-3.0 3.0.7+nobinonly-0ubuntu1
ProcCmdline: /usr/lib/firefox-3.0.7/firefox
ProcEnviron:
 LC_CTYPE=en_DK.UTF-8
 PATH=(custom, user)
 LANG=en_DK.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: firefox-3.0
StacktraceTop:
 ?? () from /usr/lib/xulrunner-1.9.0.7/libmozjs.so
 js_Invoke ()
 ?? () from /usr/lib/xulrunner-1.9.0.7/libxul.so
 ?? () from /usr/lib/xulrunner-1.9.0.7/libxul.so
 ?? () from /usr/lib/xulrunner-1.9.0.7/libxul.so
Title: firefox crashed with SIGSEGV in js_Invoke()
Uname: Linux 2.6.28-9-generic x86_64
UserGroups: admin audio pulse pulse-access pulse-rt

[David-humphrey (david-humphrey)]

My zip is too big, with extjs included, so here is a link:

http://cs.senecac.on.ca/~david.humphrey/tmp/firebugcrash.zip

[David-humphrey (david-humphrey)]

Here are some crashes I've had with this:

http://crash-stats.mozilla.com/report/index/0756292e-fa13-11dc-9aec-001a4bd43e5c?date=2008-03-25-02
http://crash-stats.mozilla.com/report/index/d0d4ab6e-fa12-11dc-b564-001a4bd43ef6?date=2008-03-25-02
http://crash-stats.mozilla.com/report/index/95b3f699-fa0d-11dc-8c52-001a4bd43ed6?date=2008-03-25-01
http://crash-stats.mozilla.com/report/index/ee1e4c0a-fa03-11dc-b15d-001a4bd43ef6?date=2008-03-25-00

[Johnjbarton (johnjbarton)]

See also 425452, top frames are the same.

[Crowder (crowder)]

I can't get this to crash with firebug1.2, and I can't get firebug1.1 (from a very recent svn) to work (ie, show UI at all) in my trunk nightly. John J. Barton: Is there a fix/patch for firebug1.1 that I need?

[Johnjbarton (johnjbarton)]

You could use the release at http://getfirebug.com.

If you use branches/firebug1.1 you'll need to run ant build.xml to get install.rdf . http://code.google.com/p/fbug/source/browse/branches/readme.txt

[Crowder (crowder)]

I did run ant. Nevertheless, I get a number of "failed to load XPCOM components" (for things in my .svn directory, weirdly) and then an "Error: no element found" from chrome://firebug/content/browserOverlay.xul line 1, followed by a "failed to load overlay" warning.

I'll try the release.

[Johnjbarton (johnjbarton)]

(In reply to comment #6)
> I did run ant. Nevertheless, I get a number of "failed to load XPCOM
> components" (for things in my .svn directory, weirdly)

This is a FF3 "feature", happens when you rebuild your profile. Just run FF again if you don't like the messages, I can't do anything about them.

> and then an "Error: no
> element found" from chrome://firebug/content/browserOverlay.xul line 1,

Also a FF message, very unlikely the error is on line 1. Or even in that xul file :-( I've not seen this.

> followed by a "failed to load overlay" warning.

Wow, that's cool! I've never actually seen a message when overlays fail.

You might just try it with FF2, I don't know that 1.1 has been run off of svn against FF3.

>
> I'll try the release

[David-humphrey (david-humphrey)]

fwiw I'm using FB 1.1.0b11 - http://getfirebug.com/releases/firebug/1.1/firebug-1.1.0b11.xpi

[Johnjbarton (johnjbarton)]

I've requested blocking FF3 for this crash. I have a similar one if this one can't be reproduced.

[Crowder (crowder)]

John: Please describe your "similar one" fully?

[Johnjbarton (johnjbarton)]

Please see bug 425452

[Shaver (shaver)]

Do we know when this regressed?

[Hskupin (hskupin)]

*** Bug 425648 has been marked as a duplicate of this bug. ***

[Hskupin (hskupin)]

Igor, possibly a regression from your patch on bug 421266?

[Johnjbarton (johnjbarton)]

(In reply to comment #12)
> Do we know when this regressed?
>
I have crashes from 3/14 (FF3b4) that could be similar if we assume the stack is bogus per 425452:
http://crash-stats.mozilla.com/report/index/9a2b04c5-f250-11dc-ba3e-001a4bd46e84
Frame Signature Source
0 @0x20202a
1 js_Invoke
2 @0x46a06011
3/18 (FF3b5pre) is closer
http://crash-stats.mozilla.com/report/index/ae1c3c9c-f501-11dc-a170-001a4bd46e84

I used FF3b4 quite a bit so I'd put my bet on early in b5pre.

[Igor Bukanov (igor-mir2)]

(In reply to comment #14)
> Igor, possibly a regression from your patch on bug 421266?
>

Is it based on the stack trace alone? AFAICS the trace just tells that the crash happens somewhere in js_Interpret.

[Hskupin (hskupin)]

Got the same crash under OS X 10.5 after installing Firebug 1.1b12, visited the following crashreporter site and clicked on Frames. Seems to be a simpler testcase as the one from comment 1.

bp-43687935-fdb7-11dc-8adb-001a4bd43ef6

[Hskupin (hskupin)]

(In reply to comment #16)
> Is it based on the stack trace alone? AFAICS the trace just tells that the
> crash happens somewhere in js_Interpret.

Yes, and I'm sorry. The assumption was wrong. I did a regression test and found a regression window between 20080322-04 and 20080323-04.

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2008-03-22+03%3A00%3A00&maxdate=2008-03-23+05%3A00%3A00&cvsroot=%2Fcvsroot

Igor, bug 424376 would fit into this timeframe. Could this be the cause?

It's reproducible for me when logging into Gmail. I have to wait some seconds, then Firefox crashes.

[Pkc (pkc)]

I cant see how this is intended behaviour?
Forbidding a download based on a filename policy that can not be disabled/seen anywhere?

[Shaver (shaver)]

(In reply to comment #19)
> I cant see how this is intended behaviour?
> Forbidding a download based on a filename policy that can not be disabled/seen
> anywhere?

Are you commenting in the right bug?

[Pkc (pkc)]

Sorry about that one, wrong manipulation.

[Hskupin (hskupin)]

(In reply to comment #15)
> I have crashes from 3/14 (FF3b4) that could be similar if we assume the stack
> is bogus per 425452:

Mmh, I think that I was wrong with my latest tests. If you really have crashes from 03/14 I probably see a different bug which has mainly the same stacktrace and is caused by some other inconsistencies. I'll try to find some time tomorrow to take a look at the mentioned testcase from comment 1. I hope to find the real regression window now.

[Pkc (pkc)]

On a side note, disabling firebug seems to have fixed the crashes here(not a single one in two days, vs 2-3 before)

[Johnjbarton (johnjbarton)]

(In reply to comment #17)
> Got the same crash under OS X 10.5 after installing Firebug 1.1b12, visited the
> following crashreporter site and clicked on Frames. Seems to be a simpler
> testcase as the one from comment 1.
>
> bp-43687935-fdb7-11dc-8adb-001a4bd43ef6
>

This one has Firebug on the stack. Can you try with FF3pre?

[Chris-tyler (chris-tyler)]

We've done some regression testing and it looks like the problem first appeared on 03-23 (03-21, 03-22 are ok, 03-23 onward crash -- 03-29 didn't seem to crash either (?)).

[Crowder (crowder)]

That would incriminate bug 424376, which has been backed out. Recent builds should no longer exhibit this issue. Is that the case?

[Johnjbarton (johnjbarton)]

2008032805 crashed for me
2008033105 did not.
This is for my version of this crash.

[Crowder (crowder)]

Marking fixed by the backout of bug 424376.

[Matti-mversen (matti-mversen)]

*** Bug 426758 has been marked as a duplicate of this bug. ***

[Bclary (bclary)]

a non-firebug test case would be greatly appreciated by all.

[Crowder (crowder)]

*** Bug 426892 has been marked as a duplicate of this bug. ***

[Paweł Smoliński (linuxuser-czlowieksukcesu)]

*** Bug 431206 has been marked as a duplicate of this bug. ***

[Zooko Wilcox-O'Hearn (zooko)]

Binary package hint: firefox-3.0

I just launched it and it tried to load many (dozens) of remembered tabs, so the js in question could be any of them. I would be willing to help you track it down.

ProblemType: Crash
Architecture: amd64
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/lib/firefox-3.0.7/firefox
Package: firefox-3.0 3.0.7+nobinonly-0ubuntu1
ProcCmdline: /usr/lib/firefox-3.0.7/firefox
ProcEnviron:
 LC_CTYPE=en_DK.UTF-8
 PATH=(custom, user)
 LANG=en_DK.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: firefox-3.0
StacktraceTop:
 ?? () from /usr/lib/xulrunner-1.9.0.7/libmozjs.so
 js_Invoke ()
 ?? () from /usr/lib/xulrunner-1.9.0.7/libxul.so
 ?? () from /usr/lib/xulrunner-1.9.0.7/libxul.so
 ?? () from /usr/lib/xulrunner-1.9.0.7/libxul.so
Title: firefox crashed with SIGSEGV in js_Invoke()
Uname: Linux 2.6.28-9-generic x86_64
UserGroups: admin audio pulse pulse-access pulse-rt

[Apport retracing service (apport)]

StacktraceTop:js_Interpret (cx=0x888120) at jsinterp.c:4186
js_Invoke (cx=0x888120, argc=4, vp=0x9012b8,
nsXPCWrappedJSClass::CallMethod (this=0x23e2a90,
PrepareAndDispatch (self=0x1992040,
SharedStub ()

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Can you provide steps to reproduce this issue?

Thank you in advance.

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Same backtrace than https://bugzilla.mozilla.org/show_bug.cgi?id=425648 which is already a dup of https://bugzilla.mozilla.org/show_bug.cgi?id=425499

[Hilario J. Montoliu (hjmf) (hmontoliu)]

Fix commited upstream

[Wildmyron (wildmyron)]

*** Bug 487417 has been marked as a duplicate of this bug. ***

[Micah Gersten (micahg)]

Thank you for reporting this to Ubuntu. I am marking this invalid as it is for software that we do not support yet. If you'd like to be notified when we package the 64 bit version of Flash, you can subscribe to bug 326555.
Please report any other issues you may find.

[Micah Gersten (micahg)]

Sorry for the last comment. This was indeed fixed.