1575163 - [Fission] Crash in [@ mozilla::ipc::IPDLParamTraits<T>::Write]

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Emil Ghitta, QA [:emilghitta]]

This bug is for crash report bp-40090b34-f6c0-442f-97d0-da1d20190820.

Top 10 frames of crashing thread:

0 xul.dll static void mozilla::ipc::IPDLParamTraits<mozilla::dom::BrowsingContext*>::Write docshell/base/BrowsingContext.cpp:1097
1 xul.dll mozilla::dom::PContentChild::SendWindowPostMessage ipc/ipdl/PContentChild.cpp:7278
2 xul.dll mozilla::dom::BrowsingContext::PostMessageMoz docshell/base/BrowsingContext.cpp:918
3 xul.dll static bool mozilla::dom::Window_Binding::postMessage dom/bindings/WindowBinding.cpp
4 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::CrossOriginThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3163
5 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:539
6 xul.dll Interpret js/src/vm/Interpreter.cpp:3084
7 xul.dll js::RunScript js/src/vm/Interpreter.cpp:424
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:567
9 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:3229

Affected Versions:

Firefox 70.0a1 (BuildId:20190819215716).

Steps to Reproduce:

1. Launch Firefox with a fresh profile.
2. Enable Fission.
3. Access the following website.
4. Scroll down through the recent posts.

Expected Result:

The website is successfully displayed and Firefox is stable.

Actual Result:

At some point the recent posts are no longer visible (some portions of the website becomes blank) and a tab crash occurs.

Comment 1

[Andrew Overholt [:overholt]]

Related to bug 1516240? Nika's away but maybe mccr8 (AFAICT he reviewed patches in bug 1516240) has thoughts?

Comment 2

[Andrew McCreight [:mccr8]]

The crash here is a release assert:
MOZ_RELEASE_ASSERT(!aParam->IsDiscarded()) (Cannot send discarded BrowsingContext between processes!)

I feel like I've seen other Fission crashes with that assertion, but I don't remember exactly where. Andreas is more familiar with browsing context stuff than I am.

Comment 3

[Emil Ghitta, QA [:emilghitta]]

Another bug was reported (and fixed) with the same crash id (Bug 1579437) but I am still reproducing this crash with Fission enabled on Firefox 71.0a1 (BuildId:20190910032956) - which contains the fix for Bug 1579437.

bp-bdf36d89-8f94-456c-b921-f0ab10190910

Occurred while navigating through tripadvisor

Comment 4

[Pascal Chevrel:pascalc]

The volume of crashes is high on both beta and nightly and Fission is not enabled by default, Neha can we get this bug triaged and get the confirmation that this is a crash we won't ship to our users when 70 ships? Thanks

Comment 5

[Andrew McCreight [:mccr8]]

The crash on beta has the same assertion: MOZ_RELEASE_ASSERT(!aParam->IsDiscarded()) (Cannot send discarded BrowsingContext between processes!)

However, Fission is not enabled on beta, and the crash reports I looked at didn't have Fission enabled, so it does look like something that would affect release users.

Comment 6

[Andrew McCreight [:mccr8]]

Nika added this assert. Maybe she has a theory as to why this is happening without Fission.

Comment 7

[Nika Layzell [:nika] (ni? for response)]

I think this is the same issue as bug 1579437. This should be fixed when we uplift those changes.

Comment 9

[Emil Ghitta, QA [:emilghitta]]

I am still hitting this crash on Firefox 71.0a1 (BuildId:20190910213950) with Fission pref enabled. (See Comment 3 as well)
bp-f6c29400-03ac-416f-9e42-cd3710190911

I was not able to reproduce this crash on Firefox beta or Nightly with fission disabled. Only on Firefox Nightly with Fission enabled.

Comment 10

[Neha Kochar [:neha]]

I was able to reproduce this (https://crash-stats.mozilla.org/report/index/0a3e0491-6e85-4fcd-a6e8-0ef7d0190911) with latest Nightly while navigating through tripadvisor with Fission enabled.

Comment 11

[Nika Layzell [:nika] (ni? for response)]

(note) This bug is re-opened for Fission only - the non-fission case should be fixed.

Comment 12

[Neha Kochar [:neha]]

Pascal, the crashes on beta without Fission should be fixed once the patch for bug 1579437 gets uplifted. The issue being tracked on this bug is specifically only with Fission enabled, so we probably don't need to track this bug for the releases.

Comment 13

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1575163 - Dont send PostMessage events to a discarded BrowsingContext,

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/74853f54a5a7
Dont send PostMessage events to a discarded BrowsingContext, r=farre

Comment 15

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/74853f54a5a7

Comment 16

[Vlad Lucaci, Thunderbird QA (:vlucaci)]

Hello,
Confirming this issue as verified fixed on 71.0a(BuildID:120191010092637) and 72.0a1 (BuildID:20191103213857). Verified on Windows 10x64, macOS 10.14 and Ubuntu 18.04.