Closed Bug 1396368 Opened 6 years ago Closed 6 years ago

Crash in nsPIDOMWindowInner::UpdateWebSocketCount


(Core :: DOM: Core & HTML, defect)

57 Branch
Not set



Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- unaffected
firefox57 --- fixed


(Reporter: philipp, Assigned: farre)



(Keywords: crash, regression)

Crash Data


(2 files)

This bug was filed from the Socorro interface and is 
report bp-ad49ef3c-5afe-41dd-b74c-28e700170903.
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	xul.dll 	nsPIDOMWindowInner::UpdateWebSocketCount(int) 	dom/base/nsGlobalWindow.cpp:4513
1 	xul.dll 	mozilla::dom::WebSocket::DisconnectFromOwner() 	dom/base/WebSocket.cpp:1494
2 	xul.dll 	nsGlobalWindow::DisconnectEventTargetObjects() 	dom/base/nsGlobalWindow.cpp:1882
3 	xul.dll 	nsGlobalWindow::~nsGlobalWindow() 	dom/base/nsGlobalWindow.cpp:1762
4 	xul.dll 	nsGlobalWindow::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	nsGlobalWindow::DeleteCycleCollectable() 	dom/base/nsGlobalWindow.cpp:2232
6 	xul.dll 	SnowWhiteKiller::~SnowWhiteKiller() 	xpcom/base/nsCycleCollector.cpp:2695
7 	xul.dll 	nsCycleCollector::FreeSnowWhite(bool) 	xpcom/base/nsCycleCollector.cpp:2883
8 	xul.dll 	AsyncFreeSnowWhite::Run() 	js/xpconnect/src/XPCJSRuntime.cpp:125
9 	xul.dll 	IdleRunnableWrapper::Run() 	xpcom/threads/nsThreadUtils.cpp:345
10 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1039
11 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:97
12 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:301
13 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/
14 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/
15 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:158
16 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp:230
17 	xul.dll 	XRE_RunAppShell() 	toolkit/xre/nsEmbedFunctions.cpp:866
18 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:269
19 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/
20 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/
21 	xul.dll 	XRE_InitChildProcess(int, char** const, XREChildData const*) 	toolkit/xre/nsEmbedFunctions.cpp:691
22 	firefox.exe 	content_process_main(mozilla::Bootstrap*, int, char** const) 	ipc/contentproc/plugin-container.cpp:63
23 	firefox.exe 	NS_internal_main(int, char**, char**) 	browser/app/nsBrowserApp.cpp:285
24 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:115
25 	firefox.exe 	__scrt_common_main_seh 	f:/dd/vctools/crt/vcstartup/src/startup/exe_common.inl:253
26 	kernel32.dll 	BaseThreadInitThunk 	
27 	ntdll.dll 	RtlUserThreadStart

these cross-platform crash reports started occurring after 57.0a1 build 20170902100317.
most of them show MOZ_RELEASE_ASSERT(aDelta > 0 || ((aDelta + counter) < counter)) that got added with bug 1393056.
Flags: needinfo?(afarre)
Had a chat about this on IRC, and I believe that this could have to do with the unlinking of windos. I'm trying to update mTopInnerWindow when this happens and see if that solves the issue.
Assignee: nobody → afarre
Flags: needinfo?(afarre)
I'm fairly randomly able to reproduce it over the last two days:


It's not very consistent, but I got it when opening a couple times. It happens right after loading a new URL (not necessarily in a new tab). I see a flash of the layout of the new page and then crash.
This crash correlates to a single nightly build (20170902100317). Looks like bug 1393056 fixed this.

(100.0% in signature vs 00.08% overall) moz_crash_reason = MOZ_RELEASE_ASSERT(aDelta > 0 || ((aDelta + counter) < counter))
(100.0% in signature vs 02.18% overall) build_id = 20170902100317
Closed: 6 years ago
Resolution: --- → WORKSFORME
Sorry, that correlation info was incorrect. The main report list has signatures in it on other days.
Resolution: WORKSFORME → ---
I'm having a hard time reproducing it. This patch assumes that the problem is unlinking mTopInnerWindow before decrementing the count of WebSockets and fixes it by counting WebSockets (and gUM, actually) both locally on the current window and on mTopInnerWindow. This is then used to decrement the count on mTomInnerWindow when unlinking.

Since I can't repro, we'll have to see if the asserts go away after this fix.

Try run pending:
Attachment #8905034 - Flags: review?(bkelly)
Comment on attachment 8905034 [details] [diff] [review]

Review of attachment 8905034 [details] [diff] [review]:

Looks reasonable I guess.
Attachment #8905034 - Flags: review?(bkelly) → review+
Pushed by
Update mTopInnerWindow before unlinking it. r=bkelly
Pushed by
Follow up fix: Fixed Windows build error. CLOSED TREE
Closed: 6 years ago6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Depends on: 1398109
This crash signature is still showing up. E.g. it's the #5 Windows topcrash in Nightly 20170910100150. I will reopen.
Flags: needinfo?(afarre)
Resolution: FIXED → ---
Yep, still on it, still no way to reproduce.
Flags: needinfo?(afarre)
Updated the current window when unlinking, when only mTopInnerWindow should've been considered.
Attachment #8907057 - Flags: review?(bkelly)
Attachment #8907057 - Flags: review?(bkelly) → review+
Pushed by
Update WebSocket count on top inner window when unlinking. r=bkelly
Closed: 6 years ago6 years ago
Resolution: --- → FIXED
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.