crash in mozilla::dom::quota::QuotaObject::DisableQuotaCheck

NEW
Assigned to

Status

()

Core
DOM: Quota Manager
P2
normal
19 days ago
17 days ago

People

(Reporter: shawnjohnjr, Assigned: shawnjohnjr)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Assignee)

Description

19 days ago
Copied from:
https://crash-stats.mozilla.com/report/index/83d18b0a-c1cf-49ea-a136-5b2920171106


0 	xul.dll 	mozilla::dom::quota::QuotaObject::DisableQuotaCheck() 	dom/quota/ActorsParent.cpp:2714
1 	xul.dll 	mozilla::dom::indexedDB::`anonymous namespace'::DatabaseConnection::DisableQuotaChecks 	dom/indexedDB/ActorsParent.cpp:11355
2 	xul.dll 	mozilla::dom::indexedDB::`anonymous namespace'::Database::StartTransactionOp::DoDatabaseWork 	dom/indexedDB/ActorsParent.cpp:14927
3 	xul.dll 	mozilla::dom::indexedDB::`anonymous namespace'::TransactionDatabaseOperationBase::RunOnConnectionThread 	dom/indexedDB/ActorsParent.cpp:23735
4 	xul.dll 	mozilla::dom::indexedDB::`anonymous namespace'::Database::StartTransactionOp::RunOnConnectionThread 	dom/indexedDB/ActorsParent.cpp:14914
5 	xul.dll 	mozilla::dom::indexedDB::`anonymous namespace'::TransactionDatabaseOperationBase::Run 	dom/indexedDB/ActorsParent.cpp:23906
6 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1216
7 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp:361
(Assignee)

Comment 1

19 days ago
Hmm. It doesn't make any sense to see crash there.

https://hg.mozilla.org/mozilla-central/annotate/e64846245b00/dom/quota/ActorsParent.cpp#l3002

Comment 2

19 days ago
Maybe the QuotaObject has been removed without being null'd? So that, firefox crash while accessing its member variables.
(Assignee)

Comment 3

19 days ago
Ok. It's not a regression. Reports are showing the earliest reports since v48.
(Assignee)

Comment 4

19 days ago
(In reply to Tom Tung [:tt] from comment #2)
> Maybe the QuotaObject has been removed without being null'd? So that,
> firefox crash while accessing its member variables.

https://hg.mozilla.org/mozilla-central/annotate/e64846245b00/dom/indexedDB/ActorsParent.cpp#l11193

But we do have check mQuotaObject there. So it's possible that before mQuotaObject->DisableQuotaCheck() called, mQuotaObject is cleared on different threads.

Comment 5

19 days ago
(In reply to Shawn Huang [:shawnjohnjr] from comment #4)
> (In reply to Tom Tung [:tt] from comment #2)
> > Maybe the QuotaObject has been removed without being null'd? So that,
> > firefox crash while accessing its member variables.
> 
> https://hg.mozilla.org/mozilla-central/annotate/e64846245b00/dom/indexedDB/
> ActorsParent.cpp#l11193
> 
> But we do have check mQuotaObject there. So it's possible that before
> mQuotaObject->DisableQuotaCheck() called, mQuotaObject is cleared on
> different threads.

Indeed. Besides, idb::DatabaseConnection holds it by a RefPtr [1]. It shouldn't become a dangling while DatabaseConnection is accessing it.

[1] http://searchfox.org/mozilla-central/source/dom/indexedDB/ActorsParent.cpp#5054
Priority: -- → P2
(Assignee)

Updated

17 days ago
Crash Signature: [@ mozilla::dom::quota::QuotaObject::DisableQuotaCheck]
(Assignee)

Updated

17 days ago
Assignee: nobody → shuang
You need to log in before you can comment on or make changes to this bug.