1559537 - Crash in [@ mozilla::dom::ContentParent::RecvAttachBrowsingContext]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Julien Cristau [:jcristau]]

This bug is for crash report bp-53389f1c-a785-4027-91bb-d2e540190615.

New crashes in the 20190614100022 nightly, with MOZ_RELEASE_ASSERT(parent) (Parent doesn't exist in parent process)

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ContentParent::RecvAttachBrowsingContext dom/ipc/ContentParent.cpp:5729
1 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:10446
2 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
3 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1970
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1215
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
6 xul.dll void mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Fallout from bug 1555287 maybe?

Comment 2

[Marcia Knous [:marcia]]

We have eclipsed 2600 crashes since this was filed. Can we please have someone take a look at this bug asap? Thanks!

Comment 3

[Andreas Farre [:farre]]

I'm running try for an alternative fix for Bug 1555287. If that seems green, we'll revert Bug 1555287 and try re-landing it.

Try is here: https://treeherder.mozilla.org/#/jobs?repo=try&revision=c9233edf98ebc4f3ec98ed02610c6e1812b9f860

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

I'm hitting this frequently - average of 5-15 minutes when I leave the browser idle (with a number of tabs loaded - ~30 windows; ~5 pinned tabs, plus 2 pocket articles and a bugzilla tab) in a local m-c build. I caught it in gdb.

(gdb) p/x aInit.mParentId
$3 = 0x500000015

I'll attach bt full... note it's an opt build of course

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

Attachment: log

Comment 6

[Andrew McCreight [:mccr8]]

Bug 1560474 contains a test case that hits this assert.

Comment 7

[Julien Cristau [:jcristau]]

Fixed by backout of bug 1555287:
https://hg.mozilla.org/mozilla-central/rev/897742f4ae26

Comment 8

[Chris Peterson [:cpeterson]]

Retroactively moving fixed bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to an appropriate Fission Milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732