1560106 - [Fission] Crash in [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Emil Ghitta, QA [:emilghitta]]

This bug is for crash report bp-d3edca6f-7830-4980-ae4c-a1b320190619.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren dom/ipc/ContentParent.cpp:5850
1 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:10639
2 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
3 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1970
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
6 xul.dll void mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:88
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

Affected Versions:

• Firefox 69.0a1 (BuildId:20190618214619).

Affected Platforms:

• Windows 10 64bit.
• Windows 7 64bit.

Steps to Reproduce:

1. Launch Firefox.
2. Access the about:config page.
3. Create the fission.autostart pref and set it to true.
4. Access the following link.
5. Wait a couple of seconds.

Expected Result:

• The website is successfully displayed and Firefox is stable.

Actual Result:

• Firefox Crashes.

Comment 1

[Jeff Muizelaar [:jrmuizel]]

I ran into this on resizing cnn.com on Mac

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Even just scrolling around cnn.com seemed to cause this.

Comment 4

[Jeff Muizelaar [:jrmuizel]]

I can reliably reproduce by just loading reddit.com/r/videos.

This should probably block m4

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 6

[Neha Kochar [:neha]]

Not a regression because it is only happening with fission enabled.

Comment 7

[Neha Kochar [:neha]]

ni'ing farre for helping Kashav with the cause and explanation.

Comment 8

[Marcia Knous [:marcia]]

Adding another signature with the same Moz Crash Reason, MOZ_RELEASE_ASSERT(false) (Trying to detach out of process context) .

Comment 9

[Andreas Farre [:farre]]

This could also be because of bug 1555287.

Comment 10

[Andreas Farre [:farre]]

Bug 1555287 has been backed out so let's keep an eye if the signature disappears.

Comment 11

[Neha Kochar [:neha]]

mozilla::dom::ContentParent::RecvDetachBrowsingContext continues to be seen.

Comment 12

[Vlad Lucaci, Desktop QA (:vlucaci)]

https://crash-stats.mozilla.org/report/index/fbc892f5-5d16-4efa-bdec-b8d5b0190625

We also experienced a tab crash with the same signature [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren ] while scrolling the main page of Reddit on Windows 10x64 with the latest FF Nightly. (2019-06-27)

Comment 13

[u608768]

(In reply to Vlad Lucaci, QA (:vlucaci) from comment #12)

https://crash-stats.mozilla.org/report/index/fbc892f5-5d16-4efa-bdec-b8d5b0190625

We also experienced a tab crash with the same signature [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren ] while scrolling the main page of Reddit on Windows 10x64 with the latest FF Nightly. (2019-06-27)

The BuildId in this crash is 20190624213657. RecvDetachBrowsingContextChildren was backed out on the 24th, so you should not see this signature in the latest Nightly (you may still see mozilla::dom::ContentParent::RecvDetachBrowsingContext).

Comment 14

[Neha Kochar [:neha]]

I'm able to reliably reproduce the crash at mozilla::dom::ContentParent::RecvDetachBrowsingContext when just scrolling up and down for 3 secs on cnn.com

Comment 15

[Neha Kochar [:neha]]

https://crash-stats.mozilla.org/report/index/15a58473-0877-4c7f-9a5f-dc2550190704 is the crash report.

Comment 17

[u608768]

This parent process crash should be fixed by bug 1563619. The problem here is that subframe crashes are crashing the parent process, so fixing 1563619 will probably reveal a number of new child process crashes.