1581138 - Crash in [@ mozilla::dom::BrowsingContext::IPCInitializer::GetParent]

Status: RESOLVED DUPLICATE of bug 1582832

(Core :: DOM: Navigation, defect, P2)

Description

[Taegeon Lee]

This bug is for crash report bp-09a699b3-d8e2-4df6-af7c-547290190913.

Top 10 frames of crashing thread:

0 xul.dll struct already_AddRefed<mozilla::dom::BrowsingContext> mozilla::dom::BrowsingContext::IPCInitializer::GetParent docshell/base/BrowsingContext.cpp:1048
1 xul.dll mozilla::dom::BrowsingContext::CreateFromIPC docshell/base/BrowsingContext.cpp:163
2 xul.dll mozilla::dom::ContentChild::RecvRegisterBrowsingContextGroup dom/ipc/ContentChild.cpp:3884
3 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:12063
4 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2109
5 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1985
6 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
7 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
8 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:88
9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308

Comment 1

[Marcia Knous [:marcia]]

Small volume crash so far. Moving to hopefully a better home. Crashes appear to have started in 20190911215306: https://mzl.la/2kgrxkW. Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f321dd9af076f19d966c17bf4bfcab9ab7b504dd&tochange=26711f10f5f45471b5856fb5cef08948f0e5bc21

Possibly Bug 1560110? Adding ni on farre.

Comment 2

[Julien Cristau [:jcristau]]

Crashes with fission enabled, so nightly only at the moment.

Comment 4

[Andrew McCreight [:mccr8]]

Bug 1591705 has a possible URL to reproduce the crash.

Comment 5

[Chris Peterson [:cpeterson]]

Tentatively moving all bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to the "?" triage milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

Comment 6

[Andrew McCreight [:mccr8]]

I hit a crash with this signature on my Windows machine, when I clicked on a bugzilla link in my bugmail from gmail. I could not reproduce it.

Comment 7

[Andrew McCreight [:mccr8]]

Kris said this is the same issue as bug 1580565 and he's looking at some perhaps unfiled bug that should fix this, so I'll mark the dependency and assign it to him. It sounded like the basic issue is that we're attaching a BC where the parent was already detached.

Comment 8

[Andrew McCreight [:mccr8]]

This is the same crash as bug 1582832, it looks like, and that one has more info, so I'll dupe it over.