Closed Bug 1323425 Opened 3 years ago Closed 3 years ago

Firefox crashes in [@ mozilla::dom::WebSocket::CreateAndDispatchCloseEvent ]


(Core :: DOM: Core & HTML, defect, critical)

53 Branch
Not set



Tracking Status
firefox-esr45 --- wontfix
firefox50 --- wontfix
firefox51 --- wontfix
firefox52 --- verified
firefox53 --- verified


(Reporter: Virtual, Assigned: baku)


(Keywords: crash, nightly-community)

Crash Data


(1 file)

I was opening about 50-100 tabs in one go and Firefox tabs crashes in [@ mozilla::dom::WebSocket::CreateAndDispatchCloseEvent ]

Crashlog report:
Michal, can you take a look at this when you get a chance? (I seem to remember you being Mr. WebSockets)
Flags: needinfo?(michal.novotny)
Whiteboard: [necko-next]
It seems this has nothing to with the WebSocketChannel living in necko. I guess WebSocketImpl::Disconnect() which nulled out mImpl member was called before WebSocket::CreateAndDispatchCloseEvent(), but I don't know the code at all. Andrea, can you have a look at it?
Component: Networking: WebSockets → DOM
Flags: needinfo?(michal.novotny) → needinfo?(amarchesini)
Whiteboard: [necko-next]
Assignee: nobody → amarchesini
Flags: needinfo?(amarchesini)
Attached patch ws.patchSplinter Review
Attachment #8824024 - Flags: review?(bugs)
Attachment #8824024 - Flags: review?(bugs) → review+
Pushed by
WebSocket::CreateAndDispatchCloseEvent must check if mImpl has been nullified, r=smaug
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla53
Has Regression Range: --- → irrelevant
Has STR: --- → yes
Looks like a low-risk patch? Please nominate for Aurora uplift.
Flags: needinfo?(amarchesini)
Comment on attachment 8824024 [details] [diff] [review]

Approval Request Comment
[Feature/Bug causing the regression]: WebSockets in workers
[User impact if declined]: a crash can occur.
[Is this code covered by automated tests?]: no, it's racy.
[Has the fix been verified in Nightly?]: yes.
[Needs manual test from QE? If yes, steps to reproduce]: yes, see the description of the bug. 
[List of other uplifts needed for the feature/fix]: none
[Is the change risky?]: no
[Why is the change risky/not risky?]: It's just the use of a nullified pointer.
[String changes made/needed]: none
Flags: needinfo?(amarchesini)
Attachment #8824024 - Flags: approval-mozilla-aurora?
Attachment #8824024 - Flags: approval-mozilla-aurora? → approval-mozilla-beta?
Comment on attachment 8824024 [details] [diff] [review]

crash fix for beta52, should be in 52.0b2
Attachment #8824024 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
I tried to reproduce this crash multiple times but without success (windows 7 x86 using Nightly from 2016-12-30). Reporter would you be able to verify if you get this crash on latest Firefox 52 beta build? Thanks!
Flags: needinfo?(virtual)
It's kinda very hard to reproduce, as only less than 5% tried will produce the crash), but in the end the bug looks fixed also on 52, because I didn't encounter any crash for a whole day and crash statistics looks clean.
Flags: needinfo?(virtual)
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.