Closed Bug 1407350 Opened 7 years ago Closed 7 years ago

Crash in mozilla::UniquePtr<T>::reset

Categories

(Core :: DOM: Events, defect, P2)

Product:
Core
Component:
DOM: Events
Version:
58 Branch
Platform:
x86_64
Windows 10
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla58
Tracking Flags:
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- unaffected
firefox57 --- unaffected
firefox58 --- fixed

People

(Reporter: Harald, Assigned: stone)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, topcrash, Whiteboard: [clouseau])

Crash Data

This bug was filed from the Socorro interface and is 
report bp-2fe29902-7fd9-489c-afc1-0e5320171010.
=============================================================

To test behaviour of the debugger, I hit the pause button and closed the debugger. After hanging for a bit the tab crashed.

What is concerning is that this crash stack connects to the coalesced mouse events landed in bug 1361067.
There are 15 crashes in nightly 58 starting with buildid 20171010100200.
In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1404273.

[1] https://hg.mozilla.org/mozilla-central/rev?node=5e0a1d82ef670c537b7b5c60ba0f2606a9f04ef7
Blocks: 1404273, clouseau
status-firefox56: --- → unaffected
status-firefox57: --- → unaffected
status-firefox-esr52: --- → unaffected
Component: General → DOM: Events
Flags: needinfo?(sshih)
Keywords: regression
Product: Firefox → Core
Whiteboard: [clouseau]
Target Milestone: --- → mozilla58
Version: Trunk → 58 Branch
I came up with a test-case that always triggers this on Windows 10. See Bug 1407700.
I guess we could dupe this to bug 1407700 but let's leave it separate for now.
Assignee: nobody → sshih
Priority: -- → P2
There are 6 crashes with signature "std::unique_ptr<T>::reset" in nightly 58 with buildid 20171012220111.
The backtraces are very similar to the ones with signature "mozilla::UniquePtr<T>::reset".
Crash Signature: [@ mozilla::UniquePtr<T>::reset] → [@ mozilla::UniquePtr<T>::reset] [@ std::unique_ptr<T>::reset]
There are 388 crashes in nightly and the signature 'mozilla::UniquePtr<T>::reset' is ranked #7 in content top-crashers for nightly.
Keywords: topcrash
No crash happened with a build later than 20171019100107. I'll close it if no crash happened in the next few days.
Flags: needinfo?(sshih)
Only one crash happened with different signature on a build later than 20171019100107. So closed this.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.