615762 - crash [@ WrapperIsNotMainThreadOnly]

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[Wayne Mery (:wsmwk)]

crash [@ WrapperIsNotMainThreadOnly]

correlates to dhcp. almost none are startup. #124 crash for v3.1.6

bp-27eed2f3-1eb6-49b3-b440-3e9482101118
EXCEPTION_ACCESS_VIOLATION_READ
0x0
0	thunderbird.exe	WrapperIsNotMainThreadOnly	js/src/xpconnect/src/nsXPConnect.cpp:703
1	thunderbird.exe	thunderbird.exe@0x8e28cf	
2		@0x1d2	
3	xpcom_core.dll	PL_DHashTableOperate	objdir-tb/mozilla/xpcom/build/pldhash.c:661
4	xpcom_core.dll	GCGraphBuilder::AddNode	xpcom/base/nsCycleCollector.cpp:1361
5	xpcom_core.dll	GCGraphBuilder::NoteScriptChild	xpcom/base/nsCycleCollector.cpp:1533
6	xpcom_core.dll	GCGraphBuilder::Traverse	xpcom/base/nsCycleCollector.cpp:1389
7	xpcom_core.dll	nsCycleCollector::MarkRoots	xpcom/base/nsCycleCollector.cpp:1611
8	xpcom_core.dll	nsCycleCollector::BeginCollection	xpcom/base/nsCycleCollector.cpp:2554
9	thunderbird.exe	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:391
10	js3250.dll	js_GC	js/src/jsgc.cpp:3537
11	thunderbird.exe	nsXPConnect::GetInfoForName	js/src/xpconnect/src/nsXPConnect.cpp:363
12	thunderbird.exe	nsTArray<XPCJSContextInfo>::AppendElements<JSContext*>	objdir-tb/mozilla/dist/include/nsTArray.h:618

Comment 1

[Wayne Mery (:wsmwk)]

the only recent crash with a comment is bp-36571049-8312-4eb0-bbe9-b7e992101111 "Setting up a new IMAP account"
EXCEPTION_ACCESS_VIOLATION_READ
0x6b752e6f
0	thunderbird.exe	WrapperIsNotMainThreadOnly	js/src/xpconnect/src/nsXPConnect.cpp:703
1	thunderbird.exe	nsXPConnect::Traverse	js/src/xpconnect/src/nsXPConnect.cpp:740
2	xpcom_core.dll	GCGraphBuilder::Traverse	xpcom/base/nsCycleCollector.cpp:1389
3	xpcom_core.dll	nsCycleCollector::MarkRoots	xpcom/base/nsCycleCollector.cpp:1611
4	xpcom_core.dll	nsCycleCollector::BeginCollection	xpcom/base/nsCycleCollector.cpp:2554
5	thunderbird.exe	XPCCycleCollectGCCallback	js/src/xpconnect/src/nsXPConnect.cpp:391
6	js3250.dll	js_GC	js/src/jsgc.cpp:3537
7	js3250.dll	JS_GC	js/src/jsapi.cpp:2439
8	thunderbird.exe	nsXPConnect::Collect	js/src/xpconnect/src/nsXPConnect.cpp:478
9	xpcom_core.dll	nsCycleCollector::Collect	xpcom/base/nsCycleCollector.cpp:2434
10	xpcom_core.dll	nsCycleCollector_collect	xpcom/base/nsCycleCollector.cpp:3129
11	thunderbird.exe	nsJSContext::CC	dom/base/nsJSEnvironment.cpp:3641
12	thunderbird.exe	nsJSContext::IntervalCC	dom/base/nsJSEnvironment.cpp:3729
13	thunderbird.exe	nsJSContext::CCIfUserInactive	dom/base/nsJSEnvironment.cpp:3717

Comment 2

[Scoobidiver (away)]

It's also a FennecAndroid crash. See https://crash-stats.mozilla.com/report/list?signature=WrapperIsNotMainThreadOnly

Comment 3

[Andrew McCreight [:mccr8]]

The FennecAndroid crashes I'm seeing in 16 look similar to some CPG fallout I'm investigating: the CC hits a JS wrapper object with a null private.  There are also some in 15 that could be from the same thing.  There's also one from 14 which can't be CPG fallout, so maybe none of it is.  There are only a handful of these, though, most are from Thunderbird.

Comment 4

[Andrew McCreight [:mccr8]]

I see a handful of these crashes on Nightly, with null derefs, but in bug 763773 I deleted this function entirely so these crashes aren't possible any more. Any null wrappers will get passed along to the cycle collector, which will just null check them and ignore them.