Closed Bug 940740 Opened 6 years ago Closed 6 years ago

B2G crash in nsXPCWrappedJS::AddRef()

Categories

(Core :: Networking: WebSockets, defect, critical)

28 Branch
ARM
Gonk (Firefox OS)
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla29
blocking-b2g 1.3+
Tracking Status
firefox27 --- wontfix
firefox28 --- fixed
firefox29 --- fixed
b2g-v1.3 --- fixed

People

(Reporter: nhirata, Assigned: johnshih.bugs)

References

Details

(Keywords: crash, regression, testcase, Whiteboard: [b2g-crash][osrestartcrash])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-c18b4ba3-b106-4b33-9722-f8e062131118.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsXPCWrappedJS::AddRef() 	/home/geeksphone/FOS/keon/gecko/js/xpconnect/src/XPCWrappedJS.cpp
1 	libxul.so 	nsXPTCStubBase::AddRef() 	/home/geeksphone/FOS/keon/gecko/xpcom/reflect/xptcall/src/xptcall.cpp
2 	libxul.so 	nsXPTCStubBase::QueryInterface(nsID const&, void**) 	/home/geeksphone/FOS/keon/gecko/xpcom/reflect/xptcall/src/xptcall.cpp
3 	libxul.so 	nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) 	/home/geeksphone/FOS/keon/gecko/xpcom/components/nsComponentManager.cpp
4 	libxul.so 	CallGetService(char const*, nsID const&, void**) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsComponentManagerUtils.cpp
5 	libxul.so 	nsGetServiceByContractIDWithError::operator()(nsID const&, void**) const 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsComponentManagerUtils.cpp
6 	libxul.so 	nsCOMPtr_base::assign_from_gs_contractid_with_error(nsGetServiceByContractIDWithError const&, nsID const&) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsCOMPtr.cpp
7 	libxul.so 	mozilla::net::WebSocketChannel::SaveNetworkStats(bool) 	/home/geeksphone/FOS/keon/objdir-gecko/netwerk/protocol/websocket/../../../dist/include/nsCOMPtr.h
8 	libxul.so 	mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*) 	/home/geeksphone/FOS/keon/gecko/netwerk/protocol/websocket/WebSocketChannel.h
9 	libxul.so 	nsInputStreamReadyEvent::Run() 	
10 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp
11 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp
12 	libxul.so 	nsSocketTransportService::Run() 	/home/geeksphone/FOS/keon/gecko/netwerk/base/src/nsSocketTransportService2.cpp
13 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp
14 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp
15 	libxul.so 	nsThread::ThreadFunc(void*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp
16 	libnss3.so 	_pt_root 	/home/geeksphone/FOS/keon/gecko/nsprpub/pr/src/pthreads/ptthread.c
17 	libc.so 	__thread_entry 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c
18 	libc.so 	pthread_create 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c

More reports : https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsXPCWrappedJS%3A%3AAddRef%28%29
Looks like something is trying to access an XPCWrappedJS off-main-thread, which is verboten.
Duplicate of this bug: 947316
There's a reduced test case in the dupe using the socket.io library.
blocking-b2g: --- → 1.3?
Keywords: regression, testcase
Use the dupe's reduced test case to get the regression window here.
Whiteboard: [b2g-crash] → [b2g-crash][osrestartcrash]
CountRecvBytes and CountSentBytes are called on the socket thread, and they call SaveNetworkStats which can only be called on the main thread. The HTTP channel implementation avoids this by using runnables for calling SaveNetworkStats.
Component: XPConnect → Networking: WebSockets
It's a regression from the introduction of the network statistics for websockets in bug 855949.
Blocks: 855949
will have a fix on it
Assignee: nobody → jshih
Duplicate of this bug: 944313
Dispatch every save event to main thread.
Attachment #8347113 - Flags: review?(mcmanus)
Blocks: 949956
Attachment #8347113 - Flags: review?(mcmanus) → review+
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/2ccd8fb57e71
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla29
Regression from 1.3 feature work, so blocking+
blocking-b2g: 1.3? → 1.3+
You need to log in before you can comment on or make changes to this bug.