This bug was filed from the Socorro interface and is report bp-c18b4ba3-b106-4b33-9722-f8e062131118. ============================================================= Frame Module Signature Source 0 libxul.so nsXPCWrappedJS::AddRef() /home/geeksphone/FOS/keon/gecko/js/xpconnect/src/XPCWrappedJS.cpp 1 libxul.so nsXPTCStubBase::AddRef() /home/geeksphone/FOS/keon/gecko/xpcom/reflect/xptcall/src/xptcall.cpp 2 libxul.so nsXPTCStubBase::QueryInterface(nsID const&, void**) /home/geeksphone/FOS/keon/gecko/xpcom/reflect/xptcall/src/xptcall.cpp 3 libxul.so nsComponentManagerImpl::GetServiceByContractID(char const*, nsID const&, void**) /home/geeksphone/FOS/keon/gecko/xpcom/components/nsComponentManager.cpp 4 libxul.so CallGetService(char const*, nsID const&, void**) /home/geeksphone/FOS/keon/gecko/xpcom/glue/nsComponentManagerUtils.cpp 5 libxul.so nsGetServiceByContractIDWithError::operator()(nsID const&, void**) const /home/geeksphone/FOS/keon/gecko/xpcom/glue/nsComponentManagerUtils.cpp 6 libxul.so nsCOMPtr_base::assign_from_gs_contractid_with_error(nsGetServiceByContractIDWithError const&, nsID const&) /home/geeksphone/FOS/keon/gecko/xpcom/glue/nsCOMPtr.cpp 7 libxul.so mozilla::net::WebSocketChannel::SaveNetworkStats(bool) /home/geeksphone/FOS/keon/objdir-gecko/netwerk/protocol/websocket/../../../dist/include/nsCOMPtr.h 8 libxul.so mozilla::net::WebSocketChannel::OnInputStreamReady(nsIAsyncInputStream*) /home/geeksphone/FOS/keon/gecko/netwerk/protocol/websocket/WebSocketChannel.h 9 libxul.so nsInputStreamReadyEvent::Run() 10 libxul.so nsThread::ProcessNextEvent(bool, bool*) /home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp 11 libxul.so NS_ProcessNextEvent(nsIThread*, bool) /home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp 12 libxul.so nsSocketTransportService::Run() /home/geeksphone/FOS/keon/gecko/netwerk/base/src/nsSocketTransportService2.cpp 13 libxul.so nsThread::ProcessNextEvent(bool, bool*) /home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp 14 libxul.so NS_ProcessNextEvent(nsIThread*, bool) /home/geeksphone/FOS/keon/gecko/xpcom/glue/nsThreadUtils.cpp 15 libxul.so nsThread::ThreadFunc(void*) /home/geeksphone/FOS/keon/gecko/xpcom/threads/nsThread.cpp 16 libnss3.so _pt_root /home/geeksphone/FOS/keon/gecko/nsprpub/pr/src/pthreads/ptthread.c 17 libc.so __thread_entry /home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c 18 libc.so pthread_create /home/geeksphone/FOS/keon_nightly/bionic/libc/bionic/pthread.c More reports : https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsXPCWrappedJS%3A%3AAddRef%28%29

Looks like something is trying to access an XPCWrappedJS off-main-thread, which is verboten.

There's a reduced test case in the dupe using the socket.io library.

Use the dupe's reduced test case to get the regression window here.

CountRecvBytes and CountSentBytes are called on the socket thread, and they call SaveNetworkStats which can only be called on the main thread. The HTTP channel implementation avoids this by using runnables for calling SaveNetworkStats.

It's a regression from the introduction of the network statistics for websockets in bug 855949.

jshih - comment 5/6

will have a fix on it

Dispatch every save event to main thread.

Regression from 1.3 feature work, so blocking+