Closed Bug 1455819 Opened 7 years ago Closed 7 years ago

Crash in nsGlobalWindowInner::CallOnChildren<T>

Categories

(Core :: DOM: Core & HTML, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox-esr52 --- wontfix
firefox-esr60 --- wontfix
firefox59 --- wontfix
firefox60 --- wontfix
firefox61 --- fixed

People

(Reporter: philipp, Assigned: smaug)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file, 2 obsolete files)

This bug was filed from the Socorro interface and is report bp-1201277c-183c-4810-8f7d-4b7ad0180419. ============================================================= Top 10 frames of crashing thread: 0 xul.dll nsGlobalWindowInner::CallOnChildren<void dom/base/nsGlobalWindowInner.cpp:6306 1 xul.dll nsGlobalWindowInner::Resume dom/base/nsGlobalWindowInner.cpp:6122 2 xul.dll mozilla::dom::nsResumeTimeoutsEvent::Run dom/xhr/XMLHttpRequestMainThread.cpp:157 3 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:395 4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1040 5 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:97 6 xul.dll mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:301 7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:319 8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:299 9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:157 ============================================================= this cross-platform crash has been around for a while - it's primarily affecting users of italian builds, so perhaps it's something specific to websites that are frequently visited in that locale (many comments point towards newspaper sites). the url correlations from crash reports may provide more insight here...
Most crashes don't contain a URL. There are a lot of crashes on newspaper websites, such as www.larena.it or www.liberoquotidiano.it.
Null pointer crash. We have similar issue in one other place.
Assignee: nobody → bugs
Priority: -- → P1
Attached patch child_docshell_iteration.diff (obsolete) — Splinter Review
This patch is based on code inspection. remote: View your change here: remote: https://hg.mozilla.org/try/rev/3b3af74cb95e3fb5cbe584cd8ecd2c1905f6c641 remote: remote: Follow the progress of your build on Treeherder: remote: https://treeherder.mozilla.org/#/jobs?repo=try&revision=3b3af74cb95e3fb5cbe584cd8ecd2c1905f6c641 remote: recorded changegroup in replication log in 0.057s
Attachment #8970853 - Flags: review?(nika)
Comment on attachment 8970853 [details] [diff] [review] child_docshell_iteration.diff Review of attachment 8970853 [details] [diff] [review]: ----------------------------------------------------------------- ::: dom/base/nsGlobalWindowInner.cpp @@ +6327,5 @@ > > int32_t childCount = 0; > docShell->GetChildCount(&childCount); > > + AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children; Please add a comment explaining that we copy to avoid concurrent modification errors @@ +6473,5 @@ > if (docShell) { > int32_t childCount = 0; > docShell->GetChildCount(&childCount); > > + AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children; Same here
Attachment #8970853 - Flags: review?(nika) → review+
Attachment #8972074 - Attachment is obsolete: true
Pushed by opettay@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/c80d4798b4e1 Crash in nsGlobalWindowInner::CallOnChildren<T>, r=nika
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Attachment #8970853 - Attachment is obsolete: true
Safe (null) crash, low volume, marking wontfix for 60.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: