1631346 - Crash in [@ nsAutoTObserverArray<T>::AppendElementUnlessExists<T>]

Status: RESOLVED FIXED

(Core :: Performance: General, defect, P1)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-ba7fba8d-60db-46d3-be92-44d7e0200419.

Top 10 frames of crashing thread:

0 libxul.so void nsAutoTObserverArray<mozilla::dom::PerformanceObserver*, 0ul>::AppendElementUnlessExists<mozilla::dom::PerformanceObserver*> xpcom/ds/nsTObserverArray.h:199
1 libxul.so mozilla::dom::PerformanceObserver::Observe dom/performance/PerformanceObserver.cpp:296
2 libxul.so mozilla::dom::PerformanceObserver_Binding::observe dom/bindings/PerformanceObserverBinding.cpp:255
3 libxul.so bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3205
4 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:584
5 libxul.so Interpret js/src/vm/Interpreter.cpp:647
6 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:619
7 libxul.so js::fun_call js/src/vm/JSFunction.cpp:1130
8 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:584
9 libxul.so Interpret js/src/vm/Interpreter.cpp:647

Looks like this crash has been around since bug 1539006 landed. From the looks of it we're accessing a NULL pointer hold by the mPerformance field. Not being familiar with this code I don't see how this could happen. Maybe the object was created with a NULL element to begin with?

Comment 1

[Andrew McCreight [:mccr8]]

The performance observer object could have been unlinked. Unlinking doesn't clear out the JS to C++ reference. Of course, this indicates a bug in code somewhere because we should not be able to get at JS that holds unlinked C++ objects.

Comment 2

[Bas Schouten (:bas.schouten)]

Sean, the crash rate isn't too hard here but it seems like it would be an easy fix. Would you like to look at this?

Comment 3

[Sean Feng [:sefeng]]

Attachment: Bug 1631346 - Fix a null ptr crash in PerformanceObserver::Observe r=baku

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/186ec6c80cbd
Fix a null ptr crash in PerformanceObserver::Observe r=baku

Comment 5

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/186ec6c80cbd