Bug 21795

Sorry for the change to a bland description, but FF is now crashing EVERY TIME I try to compose a message at gmx.com. In addition, I noted a reference to instability in FF in bug 21789.

I have yet to see all the dimensions of the problem, but it would seem to go beyond the narrow problem I first described.

Hi Roy! I am getting a crash in the mageia cauldron's firefox whenever I access https://stackoverflow.com/ (including wo login). It happens in a VM or in a fresh profile as well, and doesn't happen with firefox ESR from mozilla.org .

CC: (none) => shlomif

Stack trace is:

.1.4-2.mga6.x86_64 lib64zlib1-1.2.11-4.mga6.x86_64 libgcc1-7.2.1-20170831.1.mga7.x86_64 libstdc++6-7.2.1-20170831.1.mga7.x86_64 npapi-vlc-2.2.0-1.mga6.x86_64
(gdb) bt            
#0  0x00007fffe9e94031 in js::ProxyObject::New(JSContext*, js::BaseProxyHandler const*, JS::Handle<JS::Value>, js::TaggedProto, js::ProxyOptions const&) (cx=cx@entry=0x7fffda39a000, handler=0x7fffeb433a40 <mozilla::dom::HTMLDocumentBinding::DOMProxyHandler::getInstance()::instance>, priv=..., proto_=..., options=...)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/vm/ProxyObject.cpp:50 
#1  0x00007fffe9d653d6 in js::CloneObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<js::TaggedProto>) (cx=cx@entry=0x7fffda39a000, obj=..., proto=..., 
    proto@entry=...)                    
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/jsobj.cpp:1136        
#2  0x00007fffe9d28365 in JS_CloneObject(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>) (cx=cx@entry=0x7fffda39a000, obj=..., 
    obj@entry=..., protoArg=...)        
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/jsfriendapi.cpp:656   
#3  0x00007fffe841db2c in mozilla::dom::ReparentWrapper(JSContext*, JS::Handle<JSObject*>) (aCx=0x7fffda39a000, aObjArg=...)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/dom/bindings/BindingUtils.cpp:2146
#4  0x00007fffe8643ca5 in nsHTMLDocument::Open(JSContext*, nsAString_internal const&, nsAString_internal const&, mozilla::ErrorResult&) (this=0x7fffad3b7000, cx=<optimized out>, aType=..., aReplace=..., rv=...)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/dom/html/nsHTMLDocument.cpp:1634
#5  0x00007fffe8319633 in mozilla::dom::HTMLDocumentBinding::open(JSContext*, JS::Handle<JSObject*>, nsHTMLDocument*, JSJitMethodCallArgs const&) (cx=0x7fffda39a000, obj=..., self=0x7fffad3b7000, args=...)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/objdir/dom/bindings/HTMLDocumentBinding.cpp:527
#6  0x00007fffe84167a4 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (cx=cx@entry=0x7fffda39a000, argc=<optimized out>, vp=<optimized out>)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/dom/bindings/BindingUtils.cpp:2904
#7  0x00007fffe9e80d3e in js::CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&) (args=..., native=<optimized out>, cx=0x7fffda39a000)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/jscntxtinlines.h:239  
#8  0x00007fffe9e80d3e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (cx=cx@entry=0x7fffda39a000, args=..., construct=construct@entry=js::NO_CONSTRUCT)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/vm/Interpreter.cpp:459
#9  0x00007fffe9e81315 in InternalCall (args=..., cx=0x7fffda39a000)            
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/vm/Interpreter.cpp:504
#10 0x00007fffe9e81315 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) (cx=cx@entry=0x7fffda39a000, fval=..., fval@entry=..., thisv=..., args=..., rval=...)
    at /usr/src/debug/firefox-52.4.0-1.mga7.x86_64/js/src/vm/Interpreter.cpp:523
#11 0x00007fffe9dbc569 in js::Wrapper::call(JSContext*, JS::Handle<JSObject*>, JS::CallArgs const&) const (this=this@entry=0x7fffeb5ba500 <js::CrossCompartmentWrapper::singleton>, cx=cx@entry=0x7fffda39a000, proxy=..., 
---Type <return> to continue, or q <return> to quit---

Assigning to all packagers collectively, since there is no registered maintainer for firefox.

CC: (none) => doktor5000, luigiwalser, marja11, thierry.vignaud
Assignee: bugsquad => pkg-bugs

This package is now in Mageia 6 where it is stable, indicating that the cause lies in something other than the FF package.

Here are a couple of quick tests that work in 6, but fail in Cauldron:

1) www.alternet.org (an overlay appears and attempting to close it crashes FF in 7)

2) Restart with extensions disabled causes an immediate crash

I have this problem with "Outlook Web App" when I click the "Nouveau Message" button (New message), firefox crash.
I use cauldron and my cauldron is update.

CC: (none) => liste

It always happens for me when loading https://www.cnx-software.com/

Maybe an issue when building with a newer gcc 7 ?

CC: (none) => mageia, tmb

I think it's time to rebase to ff 56

I'm also getting regular crashes in different JS-using sites, and the backtraces usually end at some JS::something method.

A good chance of getting a crash is looking around imdb.com.

If I disable javascript completely via about:config, nothing ever crashes.

Seeing that FF 52.5.0 ESR works well in Mageia 6, I downloaded and installed it and related language packages. As far as I can tell it is also working fine in Cauldron (tested in gmx.com, imdb, and a local city map website).

So if FF 57 isn't known to fix this problem could we please backlevel cauldron to a version of FF we know works until such time as a fixed version is available ? 

The MLs are full or traffic indicating people bailing on the cauldron FF for any number of replacements, and leaving it the way it is is causing more headaches than it could ever hope to solve.

CC: (none) => ftg

I have not yet seen a crash when browsing in private mode.

I have same issues with Cauldron version - forced to use Chrome right now - waiting for FF 57 to show up in Cauldron (hopefully soon) - Would like to test it and see if issue goes away . . .

CC: (none) => rfox

I can also confirm that disabling Javascript in FF works, but certain sites are then not accessible

Firefox has been updated to 57.0.1. Great job. Thank you. But do we test that something that shouldn't appear (crashes) doesn't appear? ;-)
Jokes aside. Firefox seems stable now. I have tried a lot to make it crash. Phoronix' comments pages used to be a killer, cnx.com, gmx.com, jp.dk. They all work fine.

Nice.

Resolution: (none) => FIXED
Status: NEW => RESOLVED