1066725 - abort in mozilla::dom::PBrowserParent::Write with message "ABORT: NULL actor value passed to non-nullable param"

Status: RESOLVED WONTFIX

(Core :: IPC, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-8ca141a1-1d60-4769-b8ea-b1b992140911.
=============================================================

Full abort message:
[Parent 16652] ###!!! ABORT: NULL actor value passed to non-nullable param: file c:\builds\moz2_slave\m-cen-w64-ntly-000000000000000\build\obj-firefox\ipc\ipdl\PBrowserParent.cpp, line 4311

Top frames:
0 	mozalloc.dll 	mozalloc_abort(char const* const) 	memory/mozalloc/mozalloc_abort.cpp
1 	xul.dll 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	xul.dll 	mozilla::dom::PBrowserParent::Write(mozilla::dom::PBrowserParent*, IPC::Message*, bool) 	obj-firefox/ipc/ipdl/PBrowserParent.cpp
3 	xul.dll 	mozilla::dom::PBrowserParent::OnCallReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PBrowserParent.cpp
4 	xul.dll 	mozilla::dom::PContentParent::OnCallReceived(IPC::Message const&, IPC::Message*&) 	obj-firefox/ipc/ipdl/PContentParent.cpp
5 	xul.dll 	mozilla::ipc::MessageChannel::DispatchInterruptMessage(IPC::Message const&, unsigned __int64) 	ipc/glue/MessageChannel.cpp
6 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp


This happens on Firefox 33 and up on mostly Windows 7 and 8.1 so there might be a connection with OTMC.


More reports and stats at https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char%20const%2A%20const%29%20%7C%20NS_DebugBreak%20%7C%20mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ADebugAbort%28char%20const%2A%2C%20int%2C%20char%20const%2A%2C%20char%20const%2A%2C%20bool%29%20%7C%20mozilla%3A%3Aipc%3A%3AMessageChannel%3A%3ASend%28IPC%3A%3AMessage%2A%2C%20IPC%3A%3AMessage%2A%29

Comment 1

[Benjamin Smedberg]

Almost certainly not OMTC. It's the parent side of a content process, so it may be the content process used for thumbnailing, or people who have e10s turned on. Can you check this against the e10s annotation?

Comment 2

[Robert Kaiser]

https://crash-stats.mozilla.com/search/?signature=~mozilla%3A%3Adom%3A%3APBrowserParent%3A%3AWrite&_facets=dom_ipc_enabled&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform says 75 of the total 120 crashes with this signature have e10s enabled (all of those are Nightly 35). The 33 beta crashes with this signature do not have it set.
There is a spread with most of those crashes being content processes but some being browser processes, and that across release, from what I can tell (unfortunately the process type facet in super search doesn't work right).

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.