crash in mozalloc_abort | NS_DebugBreak | mozilla::dom::PBrowser::Transition

RESOLVED DUPLICATE of bug 1269036

Status

()

--
critical
RESOLVED DUPLICATE of bug 1269036
3 years ago
2 years ago

People

(Reporter: khalid32, Unassigned)

Tracking

({crash})

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

(Reporter)

Description

3 years ago
This bug was filed from the Socorro interface and is 
report bp-ae20a091-0701-4ecf-8eb6-697382151218.
=============================================================
Top frames:
0    firefox    mozalloc_abort(char const*)    memory/mozalloc/mozalloc_abort.cpp
1    libxul.so    NS_DebugBreak    xpcom/base/nsDebugImpl.cpp
2    libxul.so    mozilla::dom::PBrowser::Transition(mozilla::dom::PBrowser::State, mozilla::ipc::Trigger, mozilla::dom::PBrowser::State*)    obj-firefox/ipc/ipdl/PBrowser.cpp
3    libxul.so    mozilla::dom::PBrowserParent::SendDestroy()    obj-firefox/ipc/ipdl/PBrowserParent.cpp
4    libxul.so    mozilla::dom::TabParent::DestroyInternal()    dom/ipc/TabParent.cpp
5    libxul.so    mozilla::dom::TabParent::Destroy()    dom/ipc/TabParent.cpp
6    libxul.so    nsFrameLoader::DestroyComplete()    dom/base/nsFrameLoader.cpp
7    libxul.so    mozilla::dom::TabParent::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)    dom/ipc/TabParent.cpp
[...]
Investigating.

The call flow should looks like this:

nsFrameLoader::StartDestroy()
  nsFrameLoader::DestroyDocShell()
    TabParent::Destroy()
      TabParent::DestroyInternal()
        TabParent::SendDestroy()
      TabParent::mIsDestroyed = true

PBrowserParent::OnMessageReceived (should be __delete__)
  TabParent::Recv__delete__()
  TabParent::ActorDestroy()
    nsFrameLoader::DestroyComplete()
      TabParent::Destroy()
        TabParent::DestroyInternal() <-- should not run if mIsDestroyed == true
          TabParent::SendDestroy()
            abort() because mState == _Dead

Not sure why we could reach TabParent::SendDestroy when mIsDestroyed is true. We should never receive __delete__ when mIsDestroyed is false.
Assignee: nobody → kchen
Maybe this is abnormal shutdown. ContentChild could also call PBrowserChild::Send__delete__(). If this happens then TabParent could call DestroyInternal() indirectly from ActorDestroy() without prior Destroy().
(In reply to Cervantes Yu [:cyu] [:cervantes] from comment #2)
> Maybe this is abnormal shutdown. ContentChild could also call
> PBrowserChild::Send__delete__(). If this happens then TabParent could call
> DestroyInternal() indirectly from ActorDestroy() without prior Destroy().

Oh, I didn't see that. So if for some reason we run into
https://dxr.mozilla.org/mozilla-central/rev/a4929411c0aa3ec6b727e2bc2fc050c8199c6573/dom/ipc/ContentChild.cpp#905 then we have a problem.
tracking-e10s: --- → ?

Updated

3 years ago
tracking-e10s: ? → +
Priority: -- → P1
No longer shows up under the new experiment data. Untracking.
No longer blocks: 1249209
tracking-e10s: + → ---
Priority: P1 → --
Not currently working on this.
Assignee: kchen → nobody
:Kan-Ru, what URL are you using to see the latest experiment data? Thank you.
Flags: needinfo?(kchen)
Status: NEW → RESOLVED
Last Resolved: 2 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1269036
You need to log in before you can comment on or make changes to this bug.