1577432 - Crash in [@ mozilla::dom::BrowserChild::RecvSizeModeChanged]

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect, P5)

Description

[[:philipp]]

This bug is for crash report bp-3ca35096-1141-43b3-8970-0cdeb0190829.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::BrowserChild::RecvSizeModeChanged dom/ipc/BrowserChild.cpp:1256
1 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived ipc/ipdl/PBrowserChild.cpp:4397
2 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:7197
3 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
4 xul.dll mozilla::ipc::MessageChannel::RunMessage ipc/glue/MessageChannel.cpp:1939
5 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:295
6 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
7 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
8 xul.dll nsresult mozilla::dom::XMLHttpRequestMainThread::SendInternal dom/xhr/XMLHttpRequestMainThread.cpp:2913
9 xul.dll void mozilla::dom::XMLHttpRequestMainThread::Send dom/xhr/XMLHttpRequestMainThread.cpp

this is a cross-platform content crash signature, hanging around in firefox with a low volume for some time already.

Comment 1

[Chris Peterson [:cpeterson]]

P5 because, while we're still getting some crash reports, the volume is very low: only 33 from 73.0.x and 6 from 74.0a1.

https://crash-stats.mozilla.com/search/?signature=~Child%3A%3ARecvSizeModeChanged&date=%3E%3D2019-08-24T22%3A04%3A00.000Z&date=%3C2020-02-24T22%3A04%3A00.000Z&_facets=signature&_facets=cpu_arch&_facets=version&_facets=platform_pretty_version&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-version

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Looks like null+offset crash.
And this has been there forever.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1577432 - Null check document in BrowserChild::RecvSizeModeChanged, r=bdahl

Based on crash stats the crash is null+offset, and I think the issue can happen during closing down
BrowserChild if there is a pending RecvSizeModeChanged message.
The crash has been there for ages, I think since bug 1104916

Note, BrowserChild::RecvUpdateDimensions does have a null check for the document.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/813b87f46a51
Null check document in BrowserChild::RecvSizeModeChanged, r=bdahl

Comment 5

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/813b87f46a51

Comment 6

[Julien Cristau [:jcristau]]

The patch is just an added null check, OTOH this is a low volume crash. We probably don't need to uplift.