Closed Bug 1259125 Opened 7 years ago Closed 3 years ago

Crash in [@ nsINode::Slots | nsNodeWeakReference::Release] → [@ IPCError-browser | ShutDownKill ]


(Core :: DOM: Core & HTML, defect, P3)

48 Branch



Tracking Status
firefox45 --- affected
firefox46 --- affected
firefox48 --- affected
firefox49 --- affected
firefox51 --- affected
firefox57 --- affected
firefox58 --- affected
firefox59 --- ?


(Reporter: alex_mayorga, Unassigned)


(Blocks 1 open bug)


(Keywords: crash, Whiteboard: btpp-backlog)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-805ce2a6-7ffc-4e92-b6df-721332160321.


36 crashes (18 startup) like mine in the past month at


Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsINode::Slots() 	dom/base/nsINode.h
1 	xul.dll 	nsNodeWeakReference::Release() 	dom/base/FragmentOrElement.cpp
2 	xul.dll 	nsCOMPtr_base::~nsCOMPtr_base() 	xpcom/glue/nsCOMPtr.h
3 	xul.dll 	nsTArray_Impl<nsCOMPtr<nsIWeakReference>, nsTArrayInfallibleAllocator>::DestructRange(unsigned __int64, unsigned __int64) 	xpcom/glue/nsTArray.h
4 	xul.dll 	nsTArray_Impl<nsCOMPtr<nsIWeakReference>, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned __int64, unsigned __int64) 	xpcom/glue/nsTArray.h
5 	xul.dll 	nsTArray<nsCOMPtr<nsIWeakReference> >::`scalar deleting destructor'(unsigned int) 	
6 	xul.dll 	nsAutoPtr<nsTArray<nsCOMPtr<nsIWeakReference> > >::~nsAutoPtr<nsTArray<nsCOMPtr<nsIWeakReference> > >() 	xpcom/base/nsAutoPtr.h
7 	xul.dll 	nsBaseHashtableET<mozilla::dom::CustomElementHashKey, nsAutoPtr<nsTArray<nsCOMPtr<nsIWeakReference> > > >::`scalar deleting destructor'(unsigned int) 	
8 	xul.dll 	PLDHashTable::~PLDHashTable() 	xpcom/glue/PLDHashTable.cpp
9 	xul.dll 	mozilla::dom::Registry::~Registry() 	dom/base/nsDocument.cpp
10 	xul.dll 	mozilla::dom::Registry::`scalar deleting destructor'(unsigned int) 	
11 	xul.dll 	mozilla::dom::Promise::DeleteCycleCollectable() 	dom/promise/Promise.cpp
12 	xul.dll 	SnowWhiteKiller::~SnowWhiteKiller() 	xpcom/base/nsCycleCollector.cpp
13 	xul.dll 	nsCycleCollector::FreeSnowWhite(bool) 	xpcom/base/nsCycleCollector.cpp
14 	xul.dll 	AsyncFreeSnowWhite::Run() 	js/xpconnect/src/XPCJSRuntime.cpp
15 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
16 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
17 	xul.dll 	nsXMLHttpRequest::Send(nsIVariant*, mozilla::dom::Nullable<nsXMLHttpRequest::RequestBody> const&) 	dom/base/nsXMLHttpRequest.cpp
18 	xul.dll 	nsXMLHttpRequest::Send(nsXMLHttpRequest::RequestBody const&) 	dom/base/nsXMLHttpRequest.h
19 	xul.dll 	nsXMLHttpRequest::Send(JSContext*, nsAString_internal const&, mozilla::ErrorResult&) 	dom/base/nsXMLHttpRequest.h
20 	xul.dll 	mozilla::dom::XMLHttpRequestBinding::send 	obj-firefox/dom/bindings/XMLHttpRequestBinding.cpp
21 	xul.dll 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
22 	xul.dll 	js::Invoke(JSContext*, JS::CallArgs const&, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
23 	xul.dll 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
24 	xul.dll 	js::jit::DoCallFallback 	js/src/jit/BaselineIC.cpp
25 		@0x9ffba1215c
Component: XPConnect → DOM
(The reports don't look to be the same root cause.)

Andrew suspects this is something to do with SnowWhiteKiller (sync XHR is spinning the event loop).
Whiteboard: btpp-backlog
Olli, you might find the crash stack in comment 0 interesting. I think we talked about maybe not running FreeSnowWhite in nested event loops.
Flags: needinfo?(bugs)
I suspect this is just the first thing we run when destroying a node or something, so if we try to destroy a trashed node this signature shows up.
We can't disable SWK to run when spinning event loop, otherwise while showing any modal dialog or running sync XHR we wouldn't free memory.
Flags: needinfo?(bugs)
This might be related to Bug 1257096, given that Promise dtor ends up calling that code.
Updating crash signature to reflect changes to signature generation made in bug 1269817 (although reports older than a week will not be reprocessed), and adding dependency to ShutDownKill metabug.

(These probably shouldn't all be separate bugs, but I'm not going to fix that up in a mass-change.)
Blocks: shutdownkill
Crash Signature: [@ nsINode::Slots] → [@ IPCError-browser | ShutDownKill ]

7 crashes in the past week at from Release(2), Beta(1) and Nightly(2).

Crash Signature: [@ IPCError-browser | ShutDownKill ] → [@ IPCError-browser | ShutDownKill ] [@ nsINode::Slots | nsNodeWeakReference::Release]
Summary: crash in nsINode::Slots → crash in nsINode::Slots [@ IPCError-browser | ShutDownKill ]
Crash Signature: [@ IPCError-browser | ShutDownKill ] [@ nsINode::Slots | nsNodeWeakReference::Release] → [@ IPCError-browser | ShutDownKill ] [@ nsINode::Slots | nsNodeWeakReference::Release]…
OS: Windows 7 → Windows
Hardware: x86 → All
Summary: crash in nsINode::Slots [@ IPCError-browser | ShutDownKill ] → Crash in [@ nsINode::Slots | nsNodeWeakReference::Release] → [@ IPCError-browser | ShutDownKill ]
Crash Signature: nsNodeWeakReference::Release] 07T04%3A23%3A16.000… → nsNodeWeakReference::Release] 07T06%3A13%3A10.000…
Priority: -- → P3
Component: DOM → DOM: Core & HTML

Closing because no crashes reported for 12 weeks.

Closed: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.