Crash in nsCycleCollector::ScanWhiteNodes

RESOLVED FIXED in Firefox 57

Status

()

Core
DOM
RESOLVED FIXED
9 months ago
9 months ago

People

(Reporter: mccr8, Assigned: Ehsan)

Tracking

({regression, topcrash})

unspecified
mozilla57
regression, topcrash
Points:
---

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox55 unaffected, firefox56 unaffected, firefox57+ fixed)

Details

(crash signature)

(Reporter)

Description

9 months ago
This is a long-standing issue, but it seems to have become a top crash in Nightly. I see annotations on these crashes like:
  More references to an object than its refcount, for class nsGenericDOMDataNode
  for instance: bp-b166d28b-f760-4169-a00d-882960170816
I've also seen FragmentOrElement, as in this crash:bp-f11a1a07-f5a3-4672-9cfa-b60ac0170817
(Reporter)

Updated

9 months ago
Crash Signature: [@ nsCycleCollector::ScanWhiteNodes ]
(Reporter)

Comment 1

9 months ago
It looks like this first showed up on Nightly in great number with the 20170815100349 build.
(Reporter)

Comment 2

9 months ago
Regression range for the 8-15 build:
  https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=df9beb781895fcd0493c21e95ad313e0044515ec&tochange=564e82f0f289af976da01c2d50507017bbc152b5

Olli, do you have any ideas of what might have caused refcounting of elements to break?
Flags: needinfo?(bugs)
(Reporter)

Updated

9 months ago
status-firefox56: --- → unaffected
status-firefox57: --- → affected
tracking-firefox57: --- → ?
Keywords: regression, topcrash
(Reporter)

Comment 3

9 months ago
Olli pointed out bug 1386480 in IRC, and I agree that is probably at fault, as the patch looks wrong to me.
Blocks: 1386480

Updated

9 months ago
Flags: needinfo?(bugs)
(Assignee)

Comment 4

9 months ago
Fixed by backout.
Status: NEW → RESOLVED
Last Resolved: 9 months ago
Resolution: --- → FIXED
Assignee: nobody → ehsan
status-firefox55: --- → unaffected
status-firefox57: affected → fixed
status-firefox-esr52: --- → unaffected
Target Milestone: --- → mozilla57

Updated

9 months ago
tracking-firefox57: ? → +
You need to log in before you can comment on or make changes to this bug.