1524188 - Crash in InvalidArrayIndex_CRASH | mozilla::dom::CanonicalBrowsingContext::CleanupContexts

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-1780dd7d-e879-46af-98aa-9d6590190131.

Top 10 frames of crashing thread:

0 mozglue.dll static void MOZ_CrashOOL mfbt/Assertions.h:314
1 mozglue.dll MOZ_CrashPrintf mfbt/Assertions.cpp:55
2 xul.dll InvalidArrayIndex_CRASH xpcom/ds/nsTArray.cpp:27
3 xul.dll mozilla::dom::CanonicalBrowsingContext::CleanupContexts docshell/base/CanonicalBrowsingContext.cpp:47
4 xul.dll mozilla::dom::ContentParent::ActorDestroy dom/ipc/ContentParent.cpp:1753
5 xul.dll void mozilla::dom::PContentParent::DestroySubtree ipc/ipdl/PContentParent.cpp:10445
6 xul.dll mozilla::dom::PContentParent::OnChannelError ipc/ipdl/PContentParent.cpp:10094
7 xul.dll mozilla::dom::ContentParent::OnChannelError dom/ipc/ContentParent.cpp:1548
8 xul.dll nsresult mozilla::detail::RunnableMethodImpl<mozilla::dom::ServiceWorkerRegistration*, void  xpcom/threads/nsThreadUtils.h:1171
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1161

There are 3 crashes (from 3 installations) in nightly 67 with buildid 20190130215539. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1521149.

[1] https://hg.mozilla.org/mozilla-central/rev?node=db3c21efe3c0

Comment 1

[Andreas Farre [:farre]]

Attachment: Bug 1524188 - Avoid array mutation when cleaning browsing contexts.

Detaching a browsing context may mutate its parent or toplevel
list. Take copies when iterating and detaching browsing contexts of
crashed processes.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cc322acff7a7
Avoid array mutation when cleaning browsing contexts. r=nika

Comment 3

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/cc322acff7a7

Comment 4

[Chris Peterson [:cpeterson]]

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732