925604 - Crash when calling back into javascript repeatedly

Status: RESOLVED INVALID

(Core :: js-ctypes, defect)

Description

[Brendan Dahl [:bdahl]]

Attachment: backtrace.txt

This was first observed in the libadb add-on when we were busy waiting.  I've created a minimal extension and shared library that reproduces the crash. The shared library basically just calls back into js code in a loop and eventually crashes with the attached backtrace.

Comment 1

[Brendan Dahl [:bdahl]]

Attachment: mymod.c

Comment 2

[Brendan Dahl [:bdahl]]

Attachment: bootstrap.js

Comment 3

[Brendan Dahl [:bdahl]]

Attachment: worker.js

Comment 4

[Bobby Holley (:bholley)]

I'm pretty sure bug 915613 fixed this. Which build are you running on?

Comment 5

[Brendan Dahl [:bdahl]]

Debug build, updated yesterday 40c7c53fe9b0

Comment 6

[Bobby Holley (:bholley)]

Oh, I misinterpreted the stack.

What's happening is that the |cinfo| that gets passed from your native code to the JS callback points to freed JS heap memory. The most likely reason is that you're letting the callback object be collected in JS before you invoke it.

See the second warning here: https://developer.mozilla.org/en-US/docs/Mozilla/js-ctypes/js-ctypes_reference/Callbacks

Comment 7

[Brendan Dahl [:bdahl]]

That was it.  Looks like it happens multiple places in the libadb code. Thanks for the help!