Closed Bug 1544765 Opened 2 years ago Closed 9 months ago

Crash in [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] | Error deserializing 'BrowsingContext'

Categories

(Core :: DOM: Content Processes, defect, P3)

defect

Tracking

()

RESOLVED WORKSFORME
Fission Milestone M5
Tracking Status
firefox-esr60 --- unaffected
firefox66 --- unaffected
firefox67 --- unaffected
firefox68 --- fix-optional

People

(Reporter: marcia, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression)

Crash Data

This bug is for crash report bp-ff31c60c-550d-4f90-9b5d-fea440190415.

Small cross platform spike on nightly 68 which started in 20190415213626: https://bit.ly/2De0zko

All crashes have Moz Crash reason: IPDL error: "Error deserializing 'RefPtr'". abort()ing as a result.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=adc32d869e58d0c052094f718bc9e4cff8390be4&tochange=b8f49a14c458f56a6a08e4c177671108e386be3a

The only IPC related bug in that range is Bug 1494469, unless the crash is being caused by something else.

Top 10 frames of crashing thread:

0 XUL mozilla::ipc::FatalError ipc/glue/ProtocolUtils.cpp:264
1 XUL mozilla::ipc::IProtocol::HandleFatalError const ipc/glue/ProtocolUtils.cpp:440
2 XUL mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp
3 XUL mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2151
4 XUL mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1968
5 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1180
6 XUL NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
7 XUL mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110
8 XUL nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
9 XUL nsAppShell::Run widget/cocoa/nsAppShell.mm:704

ni on Jed Davis to see if he can clarify what might have caused this small spike.

Flags: needinfo?(jld)

It could be related to changes about BrowsingContext too.
:nika, could you have look please ?

Forgot to set the needinfo.

Flags: needinfo?(nika)

I'm inclined to wait for :jld's work on bug 1544825, as it can greatly improve diagnostics and help figure out what might be going on here.

Until bug 1544421, we didn't actually check validity of BrowsingContext within the deserializer correctly, so I doubt it's caused by that in particular.

Flags: needinfo?(nika)

(In reply to :Nika Layzell (ni? for response) from comment #4)

I'm inclined to wait for :jld's work on bug 1544825, as it can greatly improve diagnostics and help figure out what might be going on here.

The patch I have will tell us what type is causing the problem, but if it's something complex like nsIInputStream there's still a lot of information about what went wrong that won't be captured.

Flags: needinfo?(jld)
Crash Signature: [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] → [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceive]
Crash Signature: [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceive] → [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceived]

In the last week it looks like we've had:

The priority flag is not set for this bug.
:jld, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(jld)

Breaking down the recent failures under this bug's crash signatures by Ipc fatal error msg, there are a lot of Error deserializing 'PBrowserParent' but they're only on ESR. Limiting to Nightly, it's only Error deserializing 'BrowsingContext' (the other ones mentioned in comment #6 have different signatures), so I'm handing this over to DOM.

Component: IPC → DOM: Content Processes
Flags: needinfo?(jld)
Summary: Crash in [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] → Crash in [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] | Error deserializing 'BrowsingContext'
Duplicate of this bug: 1549865
Duplicate of this bug: 1550776
Crash Signature: [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceived] → [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceived] [@ mozill…

The priority flag is not set for this bug.
:jimm, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(jmathies)
Crash Signature: [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceived] [@ → [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentChild::OnMessageReceived] [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::dom::PContentParent::OnMessageReceived] [@
Flags: needinfo?(jmathies)
Priority: -- → P3

I have encountered this issue while fast scrolling through 9gag.com with fission enabled.
bp-0ed6613a-3836-4f22-ac78-d157a0190710

Fission Milestone: --- → M5

WFM. No crash reports since December. This crash signature is extremely generic and not useful.

Status: NEW → RESOLVED
Closed: 9 months ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.