940740 - B2G crash in nsXPCWrappedJS::AddRef()

Status: RESOLVED FIXED

(Core :: Networking: WebSockets, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-c18b4ba3-b106-4b33-9722-f8e062131118.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsXPCWrappedJS::AddRef() 	/home/geeksphone/FOS/keon/gecko/js/xpconnect/src/XPCWrappedJS.cpp
1 	libxul.so 	nsXPTCStubBase::AddRef() 	/home/geeksphone/FOS/keon/gecko/xpcom/reflect/xptcall/src/xptcall.cpp
2 	libxul.so 	nsXPTCStubBase::QueryInterface(nsID const&, void**) 	/home/geeksphone/FOS/keon/gecko/xpcom/reflect/xptcall/src/xptcall.cpp
3 	libxul.so 	nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) 	/home/geeksphone/FOS/keon/gecko/xpcom/components/nsComponentManager.cpp
4 	libxul.so 	CallGetService(char const*, nsID const&, void**) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsComponentManagerUtils.cpp
5 	libxul.so 	nsGetServiceByContractIDWithError::operator()(nsID const&, void**) const 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsComponentManagerUtils.cpp
6 	libxul.so 	nsCOMPtr_base::assign_from_gs_contractid_with_error(nsGetServiceByContractIDWithError const&, nsID const&) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsCOMPtr.cpp
7 	libxul.so 	mozilla::net::WebSocketChannel::SaveNetworkStats(bool) 	/home/geeksphone/FOS/keon/objdir-gecko/netwerk/protocol/websocket/../../../dist/include/nsCOMPtr.h
8 	libxul.so 	mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*) 	/home/geeksphone/FOS/keon/gecko/netwerk/protocol/websocket/WebSocketChannel.h
9 	libxul.so 	nsInputStreamReadyEvent::Run() 	
10 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp
11 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp
12 	libxul.so 	nsSocketTransportService::Run() 	/home/geeksphone/FOS/keon/gecko/netwerk/base/src/nsSocketTransportService2.cpp
13 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp
14 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	/home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp
15 	libxul.so 	nsThread::ThreadFunc(void*) 	/home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp
16 	libnss3.so 	_pt_root 	/home/geeksphone/FOS/keon/gecko/nsprpub/pr/src/pthreads/ptthread.c
17 	libc.so 	__thread_entry 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c
18 	libc.so 	pthread_create 	/home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c

More reports : https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsXPCWrappedJS%3A%3AAddRef%28%29

Comment 1

[Bobby Holley (:bholley)]

Looks like something is trying to access an XPCWrappedJS off-main-thread, which is verboten.

Comment 3

[Jason Smith [:jsmith]]

There's a reduced test case in the dupe using the socket.io library.

Comment 4

[Jason Smith [:jsmith]]

Use the dupe's reduced test case to get the regression window here.

Comment 5

[Josh Matthews [:jdm]]

CountRecvBytes and CountSentBytes are called on the socket thread, and they call SaveNetworkStats which can only be called on the main thread. The HTTP channel implementation avoids this by using runnables for calling SaveNetworkStats.

Comment 6

[Josh Matthews [:jdm]]

It's a regression from the introduction of the network statistics for websockets in bug 855949.

Comment 7

[Patrick McManus [:mcmanus]]

jshih - comment 5/6

Comment 8

[John Shih]

will have a fix on it

Comment 10

[John Shih]

Attachment: Bug 940740 - Make sure do_GetService called in mainthread. r=mcmanus

Dispatch every save event to main thread.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2ccd8fb57e71

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2ccd8fb57e71

Comment 13

[Jason Smith [:jsmith]]

Regression from 1.3 feature work, so blocking+

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/bce48171e75c