Crash in nsPIDOMWindowInner::UpdateWebSocketCount

RESOLVED FIXED in Firefox 57



2 years ago
a month ago


(Reporter: philipp, Assigned: farre)


({crash, regression})

57 Branch
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr52 unaffected, firefox55 unaffected, firefox56 unaffected, firefox57 fixed)


(crash signature)


(2 attachments)



2 years ago
This bug was filed from the Socorro interface and is 
report bp-ad49ef3c-5afe-41dd-b74c-28e700170903.
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsPIDOMWindowInner::UpdateWebSocketCount(int) 	dom/base/nsGlobalWindow.cpp:4513
1 	xul.dll 	mozilla::dom::WebSocket::DisconnectFromOwner() 	dom/base/WebSocket.cpp:1494
2 	xul.dll 	nsGlobalWindow::DisconnectEventTargetObjects() 	dom/base/nsGlobalWindow.cpp:1882
3 	xul.dll 	nsGlobalWindow::~nsGlobalWindow() 	dom/base/nsGlobalWindow.cpp:1762
4 	xul.dll 	nsGlobalWindow::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	nsGlobalWindow::DeleteCycleCollectable() 	dom/base/nsGlobalWindow.cpp:2232
6 	xul.dll 	SnowWhiteKiller::~SnowWhiteKiller() 	xpcom/base/nsCycleCollector.cpp:2695
7 	xul.dll 	nsCycleCollector::FreeSnowWhite(bool) 	xpcom/base/nsCycleCollector.cpp:2883
8 	xul.dll 	AsyncFreeSnowWhite::Run() 	js/xpconnect/src/XPCJSRuntime.cpp:125
9 	xul.dll 	IdleRunnableWrapper::Run() 	xpcom/threads/nsThreadUtils.cpp:345
10 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1039
11 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:97
12 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:301
13 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/
14 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/
15 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:158
16 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:230
17 	xul.dll 	XRE_RunAppShell() 	toolkit/xre/nsEmbedFunctions.cpp:866
18 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
19 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/
20 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/
21 	xul.dll 	XRE_InitChildProcess(int, char** const, XREChildData const*) 	toolkit/xre/nsEmbedFunctions.cpp:691
22 	firefox.exe 	content_process_main(mozilla::Bootstrap*, int, char** const) 	ipc/contentproc/plugin-container.cpp:63
23 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:285
24 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
25 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
26 	kernel32.dll 	BaseThreadInitThunk 	
27 	ntdll.dll 	RtlUserThreadStart

these cross-platform crash reports started occurring after 57.0a1 build 20170902100317.
most of them show MOZ_RELEASE_ASSERT(aDelta > 0 || ((aDelta + counter) < counter)) that got added with bug 1393056.
Flags: needinfo?(afarre)

Comment 1

2 years ago
Had a chat about this on IRC, and I believe that this could have to do with the unlinking of windos. I'm trying to update mTopInnerWindow when this happens and see if that solves the issue.
Assignee: nobody → afarre
Flags: needinfo?(afarre)
I'm fairly randomly able to reproduce it over the last two days:


It's not very consistent, but I got it when opening a couple times. It happens right after loading a new URL (not necessarily in a new tab). I see a flash of the layout of the new page and then crash.
This crash correlates to a single nightly build (20170902100317). Looks like bug 1393056 fixed this.

(100.0% in signature vs 00.08% overall) moz_crash_reason = MOZ_RELEASE_ASSERT(aDelta > 0 || ((aDelta + counter) < counter))
(100.0% in signature vs 02.18% overall) build_id = 20170902100317
Last Resolved: 2 years ago
Resolution: --- → WORKSFORME
Sorry, that correlation info was incorrect. The main report list has signatures in it on other days.
Resolution: WORKSFORME → ---

Comment 5

2 years ago
I'm having a hard time reproducing it. This patch assumes that the problem is unlinking mTopInnerWindow before decrementing the count of WebSockets and fixes it by counting WebSockets (and gUM, actually) both locally on the current window and on mTopInnerWindow. This is then used to decrement the count on mTomInnerWindow when unlinking.

Since I can't repro, we'll have to see if the asserts go away after this fix.

Try run pending:
Attachment #8905034 - Flags: review?(bkelly)
Comment on attachment 8905034 [details] [diff] [review]

Review of attachment 8905034 [details] [diff] [review]:

Looks reasonable I guess.
Attachment #8905034 - Flags: review?(bkelly) → review+

Comment 7

2 years ago
Pushed by
Update mTopInnerWindow before unlinking it. r=bkelly

Comment 8

2 years ago
Pushed by
Follow up fix: Fixed Windows build error. CLOSED TREE
Last Resolved: 2 years ago2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Depends on: 1398109
This crash signature is still showing up. E.g. it's the #5 Windows topcrash in Nightly 20170910100150. I will reopen.
Flags: needinfo?(afarre)
Resolution: FIXED → ---

Comment 11

2 years ago
Yep, still on it, still no way to reproduce.
Flags: needinfo?(afarre)

Comment 13

2 years ago
Updated the current window when unlinking, when only mTopInnerWindow should've been considered.
Attachment #8907057 - Flags: review?(bkelly)
Attachment #8907057 - Flags: review?(bkelly) → review+

Comment 14

2 years ago
Pushed by
Update WebSocket count on top inner window when unlinking. r=bkelly
Last Resolved: 2 years ago2 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.