Closed Bug 1791978 Opened 2 years ago Closed 1 year ago

Crash in [@ mozilla::CrashOnDanglingCheckedUnsafePtr::NotifyCheckFailure]

Categories

(Core :: Storage: StorageManager, defect)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1752856
Tracking Status
firefox-esr102 --- unaffected
firefox105 --- unaffected
firefox106 + disabled
firefox107 --- disabled

People

(Reporter: aryx, Assigned: edenchuang)

References

Details

(Keywords: crash, regression, topcrash)

Crash Data

22 crashes for Firefox v106 and v107, on many different devices and operating systems

Crash report: https://crash-stats.mozilla.org/report/index/a871c900-9aa3-44ee-961f-48ceb0220922

MOZ_CRASH Reason: MOZ_CRASH(Found dangling CheckedUnsafePtr)

Top 10 frames of crashing thread:

0 xul.dll mozilla::CrashOnDanglingCheckedUnsafePtr::NotifyCheckFailure dom/quota/CheckedUnsafePtr.h:247
0 xul.dll mozilla::CheckingPolicyAccess::NotifyCheckFailure dom/quota/CheckedUnsafePtr.h:215
0 xul.dll mozilla::CheckCheckedUnsafePtrs<mozilla::CrashOnDanglingCheckedUnsafePtr>::Check dom/quota/CheckedUnsafePtr.h:239
0 xul.dll mozilla::detail::SupportCheckedUnsafePtrImpl<mozilla::CrashOnDanglingCheckedUnsafePtr, mozilla::CheckingSupport::Enabled>::~SupportCheckedUnsafePtrImpl dom/quota/CheckedUnsafePtr.h:284
1 xul.dll mozilla::dom::WorkerPrivate::Release dom/workers/WorkerPrivate.h:142
1 xul.dll mozilla::RefPtrTraits<mozilla::dom::WorkerPrivate>::Release mfbt/RefPtr.h:50
1 xul.dll RefPtr<mozilla::dom::WorkerPrivate>::ConstRemovingRefPtrTraits<mozilla::dom::WorkerPrivate>::Release mfbt/RefPtr.h:381
1 xul.dll RefPtr<mozilla::dom::WorkerPrivate>::assign_assuming_AddRef mfbt/RefPtr.h:69
1 xul.dll RefPtr<mozilla::dom::WorkerPrivate>::operator= mfbt/RefPtr.h:168
1 xul.dll mozilla::dom::WorkerPrivate::ClearSelfAndParentEventTargetRef dom/workers/WorkerPrivate.h:165
Flags: needinfo?(jvarga)

I think this is something Eden is looking at.

Flags: needinfo?(jvarga) → needinfo?(echuang)

The bug is marked as tracked for firefox106 (beta). However, the bug still isn't assigned.

:jstutte, could you please find an assignee for this tracked bug? If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit auto_nag documentation.

Flags: needinfo?(jstutte)

The bug is linked to a topcrash signature, which matches the following criterion:

  • Top 10 content process crashes on beta

For more information, please visit auto_nag documentation.

Keywords: topcrash

This is a reminder regarding comment #2!

The bug is marked as tracked for firefox106 (beta). We have limited time to fix this, the soft freeze is in 10 days. However, the bug still isn't assigned.

This is a reminder regarding comment #2!

The bug is marked as tracked for firefox106 (beta). We have limited time to fix this, the soft freeze is in 9 days. However, the bug still isn't assigned.

This is a reminder regarding comment #2!

The bug is marked as tracked for firefox106 (beta). We have limited time to fix this, the soft freeze is in 8 days. However, the bug still isn't assigned.

Depends on: 1789399
Flags: needinfo?(jstutte)

We stopped crashing after beta 6 which coincides with the end of our early betas which contain experimental features.

(In reply to Pascal Chevrel:pascalc from comment #7)

We stopped crashing after beta 6 which coincides with the end of our early betas which contain experimental features.

Yes, despite the signature saying just MOZ_CRASH these are bound to MOZ_DIAGNOSTIC_ASSERT_ENABLED.

Assignee: nobody → echuang
Flags: needinfo?(echuang)
Depends on: 1752856, 1766272

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit auto_nag documentation.

Keywords: topcrash

The bug is linked to a topcrash signature, which matches the following criteria:

  • Top 10 content process crashes on beta
  • Top 5 desktop browser crashes on Mac on beta

For more information, please visit auto_nag documentation.

Keywords: topcrash

I found a couple of new signatures

Crash Signature: [@ mozilla::CrashOnDanglingCheckedUnsafePtr::NotifyCheckFailure] → [@ mozilla::CrashOnDanglingCheckedUnsafePtr::NotifyCheckFailure] [@ mozilla::CheckingPolicyAccess::NotifyCheckFailure<T>] [@ mozilla::CheckCheckedUnsafePtrs<T>::Check | mozilla::detail::SupportCheckedUnsafePtrImpl<T>::~SupportCheckedUnsafePtrImpl | RefP…

Since the crash signature are almost the same with bug 1752856, set this as a duplicate to 1752856.
There is a landing patch on 1752856, and I set it as leave-open for tracking the new crash reports after the patch landed.

Status: NEW → RESOLVED
Closed: 1 year ago
Duplicate of bug: 1752856
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.