Closed Bug 1549373 Opened 2 years ago Closed 2 years ago

Mozilla Firefox Nightly 68.0a1 (2019-05-06) crashes in [@ mozilla::dom::BrowsingContext::Detach ]


(Core :: DOM: Core & HTML, defect, P1)

68 Branch
Windows 7



Root Cause Coding: Other
Fission Milestone M4
Tracking Status
firefox-esr60 --- unaffected
firefox66 --- unaffected
firefox67 --- unaffected
firefox68 blocking verified


(Reporter: Virtual, Assigned: farre)




(4 keywords)

Crash Data


(1 file)


  1. Open this website page
  2. Open some image
  3. Press back browser button
    and enjoy crash in [@ mozilla::dom::BrowsingContext::Detach ]

Same STR like from bug #1547911, so I suspect it's not fixed completely and regression range is same.

Flags: needinfo?(afarre)
Has Regression Range: --- → yes
Has STR: --- → yes
Crash Signature: [@ mozilla::dom::BrowsingContext::Detach ]
Flags: needinfo?(afarre)
Keywords: crash
Version: 68 Branch → Trunk
Assignee: nobody → afarre
Flags: needinfo?(afarre)
Pushed by
Make BrowsingContexts stay alive long enough to be detached. r=nika

My steps to reproduce the tab crashes as of Build-ID: 20190506130308 for Nightly (64-bit) on Windows 10 (64-bit):

  1. Create a brand new profile in Nightly.

  2. Launch Nightly using that new profile.

  3. Add extension: either uBlock Origin or AdBlock Plus

  4. Shut down that Nightly.

  5. Launch Nightly using that same (new) profile.

  6. Navigate to

  7. Click on an image to go into a story. (Can be video or still picture)

  8. Click on the Back button by the URL bar.


This does not happen if in step 3 I had added IPvFoo instead of an ad blocker.

I don't know what makes special since I can use an ad blocker and on many sites drill down and later click on the Back button without any crashes.

Thanks for the updated STR! I can confirm that patch in Comment 4 fixes this.

Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68

I'm confirming that bug is fixed, no more crashes in Mozilla Firefox Nightly 68.0a1 (2019-05-07) looking at Reports, so I'm marking this bug as VERIFIED.
Thank you very much! \o/

Version: Trunk → 68 Branch

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:


Fission Milestone: --- → M4

Please specify a root cause for this bug. See :tmaity for more information.

Root Cause: --- → ?

Description of root cause:

Race between parent having closed a browsing context that a child wanted to detach from a tree. Possible sub-category for Coding could be Parallelism issue (similar to concurrency, but not the same since handling cross process errors

Root Cause: ? → Coding: Other
You need to log in before you can comment on or make changes to this bug.