Open Bug 1398979 Opened 8 years ago Updated 4 years ago

Crash in TimerThread::RemoveTimer

Categories

(Core :: XPCOM, defect)

Product:
Core
Component:
XPCOM
Platform:
Unspecified
macOS
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox57 --- affected

People

(Reporter: mcomella, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is report bp-85788b55-0a4f-42ff-b2a1-3a4ed0170912. ============================================================= I did a keyword search in searchfox for "favicon_bg" and I crashed. I filed because there doesn't seem to be a bug on file for this. This was FF57 on macOS.
:bwc, looks like you've looked at this type of stuff before... could you take a look?
Component: General → XPCOM
Flags: needinfo?(docfaraday)
Product: Firefox → Core
This stack claims the crash is in RefPtr<T>::operator!(), and the only place I can find where we might be invoking that is in nsTimerImplHolder::Forget(). If this is the case, it strongly implies that nsTimerImpl::mHolder is dangling, or wild. I am unsure of how this could happen.
Flags: needinfo?(docfaraday)
The crash just happened to me once in the moment after I fast-forwarded a Netflix movie with the right arrow key on my Mac. macOS High Sierra with current Nightly build

Hello Michael! Is this issue still valid in the latest Firefox versions? If so could you please provide some steps to reproduce or a testcase in order to reproduce this issue.

Flags: needinfo?(michael.l.comella)

I don't know if this crash was ever 100% reproducible but I can't reproduce it with the original steps mentioned above. It's possible it was a race condition though.

Flags: needinfo?(michael.l.comella)
Severity: critical → S3
You need to log in before you can comment on or make changes to this bug.