Closed Bug 1455819 Opened 4 years ago Closed 4 years ago

Crash in nsGlobalWindowInner::CallOnChildren<T>


(Core :: DOM: Core & HTML, defect, P1)




Tracking Status
firefox-esr52 --- wontfix
firefox-esr60 --- wontfix
firefox59 --- wontfix
firefox60 --- wontfix
firefox61 --- fixed


(Reporter: philipp, Assigned: smaug)


(Keywords: crash)

Crash Data


(1 file, 2 obsolete files)

This bug was filed from the Socorro interface and is
report bp-1201277c-183c-4810-8f7d-4b7ad0180419.

Top 10 frames of crashing thread:

0 xul.dll nsGlobalWindowInner::CallOnChildren<void  dom/base/nsGlobalWindowInner.cpp:6306
1 xul.dll nsGlobalWindowInner::Resume dom/base/nsGlobalWindowInner.cpp:6122
2 xul.dll mozilla::dom::nsResumeTimeoutsEvent::Run dom/xhr/XMLHttpRequestMainThread.cpp:157
3 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:395
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1040
5 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:97
6 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:301
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/
8 xul.dll MessageLoop::Run ipc/chromium/src/base/
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:157


this cross-platform crash has been around for a while - it's primarily affecting users of italian builds, so perhaps it's something specific to websites that are frequently visited in that locale (many comments point towards newspaper sites). the url correlations from crash reports may provide more insight here...
Most crashes don't contain a URL. There are a lot of crashes on newspaper websites, such as or
Null pointer crash. We have similar issue in one other place.
Assignee: nobody → bugs
Priority: -- → P1
Attached patch child_docshell_iteration.diff (obsolete) — Splinter Review
This patch is based on code inspection.

remote: View your change here:
remote: Follow the progress of your build on Treeherder:
remote: recorded changegroup in replication log in 0.057s
Attachment #8970853 - Flags: review?(nika)
Comment on attachment 8970853 [details] [diff] [review]

Review of attachment 8970853 [details] [diff] [review]:

::: dom/base/nsGlobalWindowInner.cpp
@@ +6327,5 @@
>    int32_t childCount = 0;
>    docShell->GetChildCount(&childCount);
> +  AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children;

Please add a comment explaining that we copy to avoid concurrent modification errors

@@ +6473,5 @@
>    if (docShell) {
>      int32_t childCount = 0;
>      docShell->GetChildCount(&childCount);
> +    AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children;

Same here
Attachment #8970853 - Flags: review?(nika) → review+
Attached patch child_docshell_iteration_2.diff (obsolete) — Splinter Review
Attachment #8972074 - Attachment is obsolete: true
Pushed by
Crash in nsGlobalWindowInner::CallOnChildren<T>, r=nika
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Attachment #8970853 - Attachment is obsolete: true
Safe (null) crash, low volume, marking wontfix for 60.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.