Closed Bug 1306979 Opened 5 years ago Closed 5 years ago

[e10s] Firefox crashes in [@ mozilla::ipc::FatalError | mozilla::dom::PContentParent::Read ]

Categories

(Core :: IPC, defect)

52 Branch
x86_64
Windows 7
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla52
Tracking Status
firefox49 --- unaffected
firefox-esr45 --- unaffected
firefox50 --- unaffected
firefox51 --- unaffected
firefox52 + verified

People

(Reporter: Virtual, Assigned: baku)

References

Details

(4 keywords, Whiteboard: [fixed by updated patch from bug #1288997])

Crash Data

I enabled e10s in Nightly to see how much it improved, browsed for about 10min and it crahed on one of MEGA website pages, when I wanted to download files or maybe when I wanted to install MEGA extension, I don't remember when now.
It crashes in[@ mozilla::ipc::FatalError | mozilla::dom::PContentParent::Read ]
https://crash-stats.mozilla.com/report/index/d98131b4-a331-4c63-bc34-e50e32161002
This sounds like the same crash reported in https://bugzilla.mozilla.org/show_bug.cgi?id=1288997#c61 .
The crash is happening, intermittently, when downloading blobs larger than
a certain size (e.g. from mega.nz, or the attachment in bug 1288997).

I can also reproduce it by opening https://www.mapbox.com/blog/mapd-taxi/ and
scrolling down. I'm not sure what this site is doing.
All crashes have IPCFatalErrorProtocol=pcontentparent and IPCFatalErrorMsg=Error deserializing Union type.

The first build ID with this crash is 20161001030430, so https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=59db3b0781908d9e2145477ff8dc5a85729e25bf&tochange=87cd291d2db621da6b3eb1057027cc0725b6eb1d.

It is likely the same crash from bug 1288997, a different stack trace because of bug 1294450.
Crash Signature: [@ mozilla::ipc::FatalError | mozilla::dom::PContentParent::Read ] → [@ mozilla::ipc::FatalError | mozilla::dom::PContentParent::Read ] [@ mozilla::ipc::FatalError | mozilla::dom::PContentParent::FatalError | mozilla::dom::PContentParent::Read ]
Currently the top crash on nightly with well over 500 crashes.
Keywords: topcrash
I was hitting this consistently today trying to load http://www.apple.com/macos/sierra/.
I guess for the case when PSendStream is used, BlobDataFromBlobImpl() needs to keep the instances of AutoIPCStream until SendPBlobConstructor() is done. Otherwise the actor in parent may have been destroyed when PBlobConstructor is received.
NI for comment 7.
Flags: needinfo?(josh)
Please look at the patch in https://bugzilla.mozilla.org/show_bug.cgi?id=1288997#c66 .
Flags: needinfo?(josh)
Tracking 52+ for this top crash.
Yes,
no more crashes starting from Mozilla Firefox Nightly 52.0a1 (2016-10-05),
because of updated patch from bug #1288997, like Josh Matthews [:jdm] said in Comment #9, so marking this as VERIFIED.

Thank you very much!
Status: RESOLVED → VERIFIED
Has Regression Range: --- → yes
Has STR: --- → yes
Whiteboard: [fixed by updated patch from bug #1288997]
You need to log in before you can comment on or make changes to this bug.