100% reproducible. 1. edit | find | search messages 2. pick an imap account (or local folder) 3. with no search terms added, click "Save" crash perhaps regression - earliest crash I find is version 27.0a1 bp-4db9b4d8-c5f8-4530-9f97-e40542131030 build 20131028030203 This bug was filed from the Socorro interface and is report bp-4acb2d04-d014-4653-848a-06b362131103. ============================================================= 0 xul.dll mozilla::dom::WindowBinding::get_content objdir-tb/mozilla/dom/bindings/WindowBinding.cpp 1 xul.dll mozilla::dom::WindowBinding::genericGetter objdir-tb/mozilla/dom/bindings/WindowBinding.cpp 2 mozjs.dll js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) js/src/vm/Interpreter.cpp 3 mozjs.dll js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 4 mozjs.dll js::InvokeGetterOrSetter(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 5 mozjs.dll js::Shape::get(JSContext *,JS::Handle<JSObject *>,JSObject *,JSObject *,JS::MutableHandle<JS::Value>) js/src/vm/Shape-inl.h 6 mozjs.dll js::baseops::GetProperty(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) js/src/jsobj.cpp 7 mozjs.dll js::DirectProxyHandler::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) js/src/jsproxy.cpp 8 xul.dll nsOuterWindowProxy::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) dom/base/nsGlobalWindow.cpp 9 mozjs.dll js::Proxy::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) js/src/jsproxy.cpp 10 mozjs.dll proxy_GetGeneric js/src/jsproxy.cpp 11 mozjs.dll js::DirectProxyHandler::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) js/src/jsproxy.cpp 12 mozjs.dll js::CrossCompartmentWrapper::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) js/src/jswrapper.cpp 13 mozjs.dll js::Proxy::get(JSContext *,JS::Handle<JSObject *>,JS::Handle<JSObject *>,JS::Handle<int>,JS::MutableHandle<JS::Value>) js/src/jsproxy.cpp 14 mozjs.dll proxy_GetGeneric js/src/jsproxy.cpp 15 mozjs.dll js::jit::DoGetElemFallback js/src/jit/BaselineIC.cpp 16 @0x7e604b 17 @0x7e15f9 18 mozjs.dll EnterBaseline js/src/jit/BaselineJIT.cpp 19 mozjs.dll js::jit::EnterBaselineAtBranch(JSContext *,js::StackFrame *,unsigned char *) js/src/jit/BaselineJIT.cpp 20 mozjs.dll Interpret js/src/vm/Interpreter.cpp 21 mozjs.dll js::RunScript(JSContext *,js::RunState &) js/src/vm/Interpreter.cpp 22 mozjs.dll js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) js/src/vm/Interpreter.cpp 23 mozjs.dll js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 24 mozjs.dll js::DirectProxyHandler::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) js/src/jsproxy.cpp 25 mozjs.dll js::CrossCompartmentWrapper::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) js/src/jswrapper.cpp 26 mozjs.dll js::Proxy::call(JSContext *,JS::Handle<JSObject *>,JS::CallArgs const &) js/src/jsproxy.cpp 27 mozjs.dll proxy_Call js/src/jsproxy.cpp 28 mozjs.dll js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) js/src/vm/Interpreter.cpp 29 mozjs.dll Interpret js/src/vm/Interpreter.cpp 30 mozjs.dll js::RunScript(JSContext *,js::RunState &) js/src/vm/Interpreter.cpp 31 mozjs.dll js::Invoke(JSContext *,JS::CallArgs,js::MaybeConstruct) js/src/vm/Interpreter.cpp 32 mozjs.dll js::Invoke(JSContext *,JS::Value const &,JS::Value const &,unsigned int,JS::Value *,JS::MutableHandle<JS::Value>) js/src/vm/Interpreter.cpp 33 mozjs.dll JS_CallFunctionValue(JSContext *,JSObject *,JS::Value,unsigned int,JS::Value *,JS::Value *) js/src/jsapi.cpp 34 xul.dll mozilla::dom::EventListener::HandleEvent(JSContext *,JS::Handle<JSObject *>,nsDOMEvent &,mozilla::ErrorResult &) objdir-tb/mozilla/dom/bindings/EventListenerBinding.cpp 35 xul.dll mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>(mozilla::dom::EventTarget * const &,nsDOMEvent &,mozilla::ErrorResult &,mozilla::dom::CallbackObject::ExceptionHandling) objdir-tb/mozilla/dist/include/mozilla/dom/EventListenerBinding.h 36 xul.dll nsEventListenerManager::HandleEventSubType(nsListenerStruct *,mozilla::dom::CallbackObjectHolder<mozilla::dom::EventListener,nsIDOMEventListener> const &,nsIDOMEvent *,mozilla::dom::EventTarget *,nsCxPusher *) content/events/src/nsEventListenerManager.cpp 37 xul.dll nsEventListenerManager::HandleEventInternal(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *,nsCxPusher *) content/events/src/nsEventListenerManager.cpp 38 xul.dll nsEventListenerManager::HandleEvent(nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent * *,mozilla::dom::EventTarget *,nsEventStatus *,nsCxPusher *) content/events/src/nsEventListenerManager.h 39 xul.dll nsEventTargetChainItem::HandleEvent(nsEventChainPostVisitor &,ELMCreationDetector &,nsCxPusher *) content/events/src/nsEventDispatcher.cpp 40 xul.dll nsEventTargetChainItem::HandleEventTargetChain(nsTArray<nsEventTargetChainItem> &,nsEventChainPostVisitor &,nsDispatchingCallback *,ELMCreationDetector &,nsCxPusher *) content/events/src/nsEventDispatcher.cpp 41 xul.dll nsEventDispatcher::Dispatch(nsISupports *,nsPresContext *,mozilla::WidgetEvent *,nsIDOMEvent *,nsEventStatus *,nsDispatchingCallback *,nsCOMArray<mozilla::dom::EventTarget> *) content/events/src/nsEventDispatcher.cpp 42 xul.dll nsDocumentViewer::LoadComplete(tag_nsresult) layout/base/nsDocumentViewer.cpp 43 xul.dll nsDocShell::EndPageLoad(nsIWebProgress *,nsIChannel *,tag_nsresult) docshell/base/nsDocShell.cpp

I incorrectly assumed this was not a *major* regression. Item 3a is NOT required. Just try to create normal saved search 1. edit | find | search messages 2. pick an imap account (or local folder) 3. a) with no search terms added, b) click "Save" crash

Looking at the stack, shouldn't this be fixed in JS/DOM core?

It's likely a dupe of bug 931794 or friends because crashes end after 10-31 [1] and I'm on TB28.0a1 (2013-10-30), so it's within the period where that crash is live. But bugs that go to core can get lost, so I'd just as soon it stay here, and dupe it from here if it's a regression that's already has a bug report and/or is already fixed in core. Or anyone else can do the testing just as well as me - I'm happy to not both file and kill the bugs :) [1] https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3AWindowBinding%3A%3Aget_content&product=Thunderbird&query_type=is_exactly&range_unit=weeks&process_type=any&hang_type=any&date=2013-11-04+11%3A00%3A00&range_value=4#reports

Yeah, should be a dupe.

definitely the dupe - crash ends starting with 2013-11-01 nightly