1259125 - Crash in [@ nsINode::Slots | nsNodeWeakReference::Release] → [@ IPCError-browser | ShutDownKill ]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect, P3)

Description

[alex_mayorga]

This bug was filed from the Socorro interface and is 
report bp-805ce2a6-7ffc-4e92-b6df-721332160321.
=============================================================

¡Hola!

36 crashes (18 startup) like mine in the past month at https://crash-stats.mozilla.com/report/list?product=Firefox&range_unit=days&range_value=28&signature=nsINode%3A%3ASlots

¡Gracias!
Alex

Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsINode::Slots() 	dom/base/nsINode.h
1 	xul.dll 	nsNodeWeakReference::Release() 	dom/base/FragmentOrElement.cpp
2 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base() 	xpcom/glue/nsCOMPtr.h
3 	xul.dll 	nsTArray_Impl<nsCOMPtr<nsIWeakReference>, nsTArrayInfallibleAllocator>::DestructRange(unsigned __int64, unsigned __int64) 	xpcom/glue/nsTArray.h
4 	xul.dll 	nsTArray_Impl<nsCOMPtr<nsIWeakReference>, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned __int64, unsigned __int64) 	xpcom/glue/nsTArray.h
5 	xul.dll 	nsTArray<nsCOMPtr<nsIWeakReference> >::`scalar deleting destructor'(unsigned int) 	
6 	xul.dll 	nsAutoPtr<nsTArray<nsCOMPtr<nsIWeakReference> > >::~nsAutoPtr<nsTArray<nsCOMPtr<nsIWeakReference> > >() 	xpcom/base/nsAutoPtr.h
7 	xul.dll 	nsBaseHashtableET<mozilla::dom::CustomElementHashKey, nsAutoPtr<nsTArray<nsCOMPtr<nsIWeakReference> > > >::`scalar deleting destructor'(unsigned int) 	
8 	xul.dll 	PLDHashTable::~PLDHashTable() 	xpcom/glue/PLDHashTable.cpp
9 	xul.dll 	mozilla::dom::Registry::~Registry() 	dom/base/nsDocument.cpp
10 	xul.dll 	mozilla::dom::Registry::`scalar deleting destructor'(unsigned int) 	
11 	xul.dll 	mozilla::dom::Promise::DeleteCycleCollectable() 	dom/promise/Promise.cpp
12 	xul.dll 	SnowWhiteKiller::~SnowWhiteKiller() 	xpcom/base/nsCycleCollector.cpp
13 	xul.dll 	nsCycleCollector::FreeSnowWhite(bool) 	xpcom/base/nsCycleCollector.cpp
14 	xul.dll 	AsyncFreeSnowWhite::Run() 	js/xpconnect/src/XPCJSRuntime.cpp
15 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
16 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
17 	xul.dll 	nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&) 	dom/base/nsXMLHttpRequest.cpp
18 	xul.dll 	nsXMLHttpRequest::Send(nsXMLHttpRequest::RequestBody const&) 	dom/base/nsXMLHttpRequest.h
19 	xul.dll 	nsXMLHttpRequest::Send(JSContext*, nsAString_internal const&, mozilla::ErrorResult&) 	dom/base/nsXMLHttpRequest.h
20 	xul.dll 	mozilla::dom::XMLHttpRequestBinding::send 	obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp
21 	xul.dll 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
22 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
23 	xul.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
24 	xul.dll 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
25 		@0x9ffba1215c

Comment 1

[Andrew Overholt [:overholt]]

(The reports don't look to be the same root cause.)

Andrew suspects this is something to do with SnowWhiteKiller (sync XHR is spinning the event loop).

Comment 2

[Andrew McCreight [:mccr8]]

Olli, you might find the crash stack in comment 0 interesting. I think we talked about maybe not running FreeSnowWhite in nested event loops.

Comment 3

[Andrew McCreight [:mccr8]]

I suspect this is just the first thing we run when destroying a node or something, so if we try to destroy a trashed node this signature shows up.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

We can't disable SWK to run when spinning event loop, otherwise while showing any modal dialog or running sync XHR we wouldn't free memory.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

This might be related to Bug 1257096, given that Promise dtor ends up calling that code.

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Updating crash signature to reflect changes to signature generation made in bug 1269817 (although reports older than a week will not be reprocessed), and adding dependency to ShutDownKill metabug.

(These probably shouldn't all be separate bugs, but I'm not going to fix that up in a mass-change.)

Comment 7

[alex_mayorga]

¡Hola!

7 crashes in the past week at https://crash-stats.mozilla.com/signature/?product=Firefox&signature=nsINode%3A%3ASlots from Release(2), Beta(1) and Nightly(2).

¡Gracias!
Alex

Comment 8

[Firefox Bug Husbandry Bot]

https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Update_affecteds

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.