1524084 - A message manager created lazily upon a crashed browser never fires message-manager-disconnect

Status: NEW

(Core :: DOM: Content Processes, defect, P3)

Description

[Mike Conley (:mconley) (:⚙️)]

STR:

1. Have a remote <xul:browser>
2. Crash the browser
3. Access the messageManager on the crashed browser so that a new message manager is created lazily upon it
4. Remove the <xul:browser> from the DOM

ER:

Both message-manager-close and message-manager-disconnect should be fired for the node.

AR:

Only message-manager-close fires. Apparently, the nsFrameLoaderDestroyRunnable never ends up calling mFrameLoader->DestroyComplete() (which causes the disconnect) since a crashed browser has mChildMessageManager set to nullptr here:

https://searchfox.org/mozilla-central/rev/78cd247b5d7a08832f87d786541d3e2204842e8e/dom/base/nsFrameLoader.cpp#1622-1630

Comment 1

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1524084 - Test case

Comment 2

[Jens Stutte [:jstutte]]

Hi :mconley, do you think this is still relevant?

Comment 3

[Mike Conley (:mconley) (:⚙️)]

I've updated the test case, and it appears that the bug still exists. We still use message managers these days, albeit rarely - it's more common to use JSActors instead.

So yes, I'd say this is still relevant.

Comment 4

[Mike Conley (:mconley) (:⚙️)]

Attachment: Bug 1524084 - Test case