Closed Bug 1578398 Opened Last month Closed Last month

Send__delete__() when !CanSend() crashes


(Core :: IPC, defect, P3, critical)




Fission Milestone M5
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- disabled
firefox69 --- disabled
firefox70 --- disabled
firefox71 --- fixed


(Reporter: neha, Assigned: Nika)


(Blocks 1 open bug)


(Keywords: crash)

Crash Data


(1 file)

This bug is for crash report bp-065b48ad-a32f-4387-9d48-42cdb0190903.

Top 10 frames of crashing thread:

0 XUL mozilla::ipc::FatalError ipc/glue/ProtocolUtils.cpp:170
1 XUL mozilla::ipc::IProtocol::HandleFatalError const ipc/glue/ProtocolUtils.cpp:404
2 XUL void mozilla::ipc::WriteIPDLParam<mozilla::dom::PBrowserBridgeChild*&> ipc/glue/IPDLParamTraits.h:59
3 XUL mozilla::dom::PBrowserBridgeChild::Send__delete__ ipc/ipdl/PBrowserBridgeChild.cpp:53
4 XUL mozilla::dom::BrowserBridgeHost::DestroyComplete dom/ipc/BrowserBridgeHost.cpp:57
5 XUL nsFrameLoaderDestroyRunnable::Run dom/base/nsFrameLoader.cpp:1814
6 XUL mozilla::dom::Document::MaybeInitializeFinalizeFrameLoaders dom/base/Document.cpp:8467
7 XUL mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void  xpcom/threads/nsThreadUtils.h:1176
8 XUL nsContentUtils::RemoveScriptBlocker dom/base/nsContentUtils.cpp:5178
9 XUL nsDocumentViewer::Destroy layout/base/nsDocumentViewer.cpp:1921

This happened while I was viewing user history on bugzilla and navigating and editing bugs with fission enabled. Don't have better STR to report.

Fission Milestone: --- → M5
Priority: -- → P3
Flags: needinfo?(nika)

We shouldn't be crashing here with a fatal IPC error. We should recover if CanSend() is returning false.

I'm guessing this happens if a remote iframe in the bfcache crashes while the entry is being evicted, or something like that. I'm not 100% sure how it is being triggered.

Should have a quick fix for the IPC bug, so I'll take it.

Assignee: nobody → nika
Component: Document Navigation → IPC
Flags: needinfo?(nika)
Summary: Crash in [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::ipc::WriteIPDLParam<T> | mozilla::dom::PBrowserBridgeChild::Send__delete__] → Send__delete__() when !CanSend() crashes

The component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit auto_nag documentation.

Priority: P3 → --
Priority: -- → P3
Pushed by
Check 'CanSend()' when calling Send__delete__(), r=mccr8
Closed: Last month
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
You need to log in before you can comment on or make changes to this bug.