Closed Bug 1455819 Opened Last year Closed Last year

Crash in nsGlobalWindowInner::CallOnChildren<T>

Categories

(Core :: DOM: Core & HTML, defect, P1, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox-esr52 --- wontfix
firefox-esr60 --- wontfix
firefox59 --- wontfix
firefox60 --- wontfix
firefox61 --- fixed

People

(Reporter: philipp, Assigned: smaug)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file, 2 obsolete files)

This bug was filed from the Socorro interface and is
report bp-1201277c-183c-4810-8f7d-4b7ad0180419.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsGlobalWindowInner::CallOnChildren<void  dom/base/nsGlobalWindowInner.cpp:6306
1 xul.dll nsGlobalWindowInner::Resume dom/base/nsGlobalWindowInner.cpp:6122
2 xul.dll mozilla::dom::nsResumeTimeoutsEvent::Run dom/xhr/XMLHttpRequestMainThread.cpp:157
3 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:395
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1040
5 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:97
6 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:301
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:319
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:299
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:157

=============================================================

this cross-platform crash has been around for a while - it's primarily affecting users of italian builds, so perhaps it's something specific to websites that are frequently visited in that locale (many comments point towards newspaper sites). the url correlations from crash reports may provide more insight here...
Most crashes don't contain a URL. There are a lot of crashes on newspaper websites, such as www.larena.it or www.liberoquotidiano.it.
Null pointer crash. We have similar issue in one other place.
Assignee: nobody → bugs
Priority: -- → P1
Attached patch child_docshell_iteration.diff (obsolete) — Splinter Review
This patch is based on code inspection.

remote: View your change here:
remote:   https://hg.mozilla.org/try/rev/3b3af74cb95e3fb5cbe584cd8ecd2c1905f6c641
remote: 
remote: Follow the progress of your build on Treeherder:
remote:   https://treeherder.mozilla.org/#/jobs?repo=try&revision=3b3af74cb95e3fb5cbe584cd8ecd2c1905f6c641
remote: recorded changegroup in replication log in 0.057s
Attachment #8970853 - Flags: review?(nika)
Comment on attachment 8970853 [details] [diff] [review]
child_docshell_iteration.diff

Review of attachment 8970853 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/nsGlobalWindowInner.cpp
@@ +6327,5 @@
>  
>    int32_t childCount = 0;
>    docShell->GetChildCount(&childCount);
>  
> +  AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children;

Please add a comment explaining that we copy to avoid concurrent modification errors

@@ +6473,5 @@
>    if (docShell) {
>      int32_t childCount = 0;
>      docShell->GetChildCount(&childCount);
>  
> +    AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children;

Same here
Attachment #8970853 - Flags: review?(nika) → review+
Attached patch child_docshell_iteration_2.diff (obsolete) — Splinter Review
Attachment #8972074 - Attachment is obsolete: true
Pushed by opettay@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c80d4798b4e1
Crash in nsGlobalWindowInner::CallOnChildren<T>, r=nika
https://hg.mozilla.org/mozilla-central/rev/c80d4798b4e1
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Attachment #8970853 - Attachment is obsolete: true
Safe (null) crash, low volume, marking wontfix for 60.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.