This bug was filed from the Socorro interface and is report bp-1ff11b90-b2ad-4592-96c7-726200170608. ============================================================= There is 1 crash in nightly 55 with buildid 20170608030205 . In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1292600. [1] https://hg.mozilla.org/mozilla-central/rev?node=e5901d855fafdce064137ab1c72126e43b06c971

This crash report is confusing me, I'm not sure how this could happen at https://hg.mozilla.org/mozilla-central/annotate/7efda263a842/xpcom/threads/nsThread.cpp#l1288. At least the crash happens inside #ifndef RELEASE_OR_BETA, which basically means #ifdef NIGHTLY now that there's no Aurora, right? I'm going to need to ask for some extra eyes on this. This patch is very much a shot in the dark. Nathan, am I missing something obvious here?

(In reply to Andreas Farre [:farre] from comment #1) > This crash report is confusing me, I'm not sure how this could happen at > https://hg.mozilla.org/mozilla-central/annotate/7efda263a842/xpcom/threads/ > nsThread.cpp#l1288. I too do not see how this could happen. Memory corruption? > At least the crash happens inside #ifndef RELEASE_OR_BETA, which basically > means #ifdef NIGHTLY now that there's no Aurora, right? Sort of. We have Dev edition, which is rebranded Beta, which is #ifndef RELEASE_OR_BETA...I think?

Comment on attachment 8876053 [details] [diff] [review] 0001-Bug-1371440-Add-nsCOMPtr-variable-to-hold-nsIRunnabl.patch Review of attachment 8876053 [details] [diff] [review]: ----------------------------------------------------------------- I mean, we *could* do this, but I can't see how it could make any difference, because the underlying QueryObject implementation just winds up dealing with raw pointers anyway: http://dxr.mozilla.org/mozilla-central/source/xpcom/base/nsQueryObject.h#17 Were we using a strong reference before and never had crashes?

(In reply to Nathan Froyd [:froydnj] from comment #3) > Comment on attachment 8876053 [details] [diff] [review] > 0001-Bug-1371440-Add-nsCOMPtr-variable-to-hold-nsIRunnabl.patch > > Review of attachment 8876053 [details] [diff] [review]: > ----------------------------------------------------------------- > > I mean, we *could* do this, but I can't see how it could make any > difference, because the underlying QueryObject implementation just winds up > dealing with raw pointers anyway: > > http://dxr.mozilla.org/mozilla-central/source/xpcom/base/nsQueryObject.h#17 > > Were we using a strong reference before and never had crashes? It's the strong reference we still have in ProcessNextEvent. But yes, I'm very confused, but good that you are too. I

(In reply to Andreas Farre [:farre] from comment #4) > It's the strong reference we still have in ProcessNextEvent. But yes, I'm > very confused, but good that you are too. I ...need to complete my bug comments? :)

I can only see one report of this that happened last week ... should we close this as a weird fluke (i.e. WORKSFORME)?

Yeah, there is no real way I can see this happening. If it comes back we'll have more info.