1560220 - Crash in [@ nsDocShell::SetTreeOwner]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-c9744c2a-2d46-430d-a164-b65100190619.

Seen while looking at crash stats - crashes started using 20190613095633 - https://bit.ly/2N0fMwz. 23 crashes/12 installs so far. MOZ_RELEASE_ASSERT(oldBrowserChild == newBrowserChild) (Cannot cahnge BrowserChild during nsDocShell lifetime!)

Possible regression range based on crash stats - https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e7e81a32c2ab11f089f9c53eab71da94902f8e6d&tochange=d72ab884f0394d6e9ab723f03bd43c90a84d7e5b

Possibly Bug 1557887? ni on :ehsan

Top 10 frames of crashing thread:

0 xul.dll nsDocShell::SetTreeOwner docshell/base/nsDocShell.cpp:3251
1 xul.dll nsWebBrowser::Create toolkit/components/browser/nsWebBrowser.cpp:149
2 xul.dll mozilla::dom::BrowserChild::Init dom/ipc/BrowserChild.cpp:509
3 xul.dll mozilla::dom::ContentChild::RecvConstructBrowser dom/ipc/ContentChild.cpp:1846
4 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:7336
5 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
6 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1970
7 xul.dll nsresult mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:295
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486

Comment 1

[Neha Kochar [:neha]]

A lot of these, if not all, are from my crash reports (macOS 10.14 (18A391)), which I didn't mean to submit (sorry!) when I was running with fission pref'ed on. I don't think this is a non-fission regression, unless there is clear evidence of that.

Comment 2

[Marcia Knous [:marcia]]

(In reply to Neha Kochar [:neha] from comment #1)

A lot of these, if not all, are from my crash reports (macOS 10.14 (18A391)), which I didn't mean to submit (sorry!) when I was running with fission pref'ed on. I don't think this is a non-fission regression, unless there is clear evidence of that.

Thanks Neha - If in the future you add a brief comment to that effect, that would be helpful. Thanks!

Comment 3

[Andreas Farre [:farre]]

So this starts and stops happening (June 13th to June 21st ) exactly when Bug 1555287 and is backed out.

Comment 4

[Neha Kochar [:neha]]

Since the fix for Bug 1555287 got backed out, let's keep this until the new patch for Bug 1555287 gets enough settling time to ensure this doesn't re-appear with the new patch.

Comment 5

[Neha Kochar [:neha]]

did not mean to close this, re-opening.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Looks like bug 1555287 was indeed able to re-land without this crash returning.