Closed Bug 1583110 Opened 2 years ago Closed 1 month ago

Fission crash in [@ nsGlobalWindowInner::ThawInternal] | MOZ_DIAGNOSTIC_ASSERT(IsSuspended())

Categories

(Core :: DOM: Core & HTML, defect, P2)

Unspecified
All
defect

Tracking

()

RESOLVED FIXED
96 Branch
Fission Milestone Future
Tracking Status
firefox-esr78 --- wontfix
firefox-esr91 --- wontfix
firefox93 --- wontfix
firefox94 --- wontfix
firefox95 --- fixed
firefox96 --- fixed

People

(Reporter: gsvelto, Assigned: smaug)

Details

(Keywords: crash, Whiteboard: qa-not-actionable)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-ee165c3b-ece5-43d7-a916-e9f2c0190920.

Top 10 frames of crashing thread:

0 xul.dll void nsGlobalWindowInner::ThawInternal dom/base/nsGlobalWindowInner.cpp:5274
1 xul.dll static nsGlobalWindowInner::CallState nsGlobalWindowInner::CallOnChildren<void  dom/base/nsGlobalWindowInner.cpp:5399
2 xul.dll void nsGlobalWindowInner::ThawInternal dom/base/nsGlobalWindowInner.cpp:5276
3 xul.dll nsGlobalWindowInner::Thaw dom/base/nsGlobalWindowInner.cpp:5267
4 xul.dll nsresult nsGlobalWindowOuter::RestoreWindowState dom/base/nsGlobalWindowOuter.cpp:7511
5 xul.dll nsresult nsDocShell::RestoreFromHistory docshell/base/nsDocShell.cpp:7908
6 xul.dll nsresult nsDocShell::RestorePresentationEvent::Run docshell/base/nsDocShell.cpp:7340
7 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:295
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486

Low-volume crash on all platforms, most likely because it's triggered by a diagnostic assertion so it should be happening only on nightly and beta. We're tripping over this assertion:

https://hg.mozilla.org/mozilla-central/annotate/5ac55079c87e4cd25eafafa8662594b4a2917dcc/dom/base/nsGlobalWindowInner.cpp#l5274

Priority: -- → P3
Whiteboard: qa-not-actionable

When searching through the last four weeks of Fission crash pings, I see 237 Aurora crash pings and 75 Nightly crash pings with crash reason MOZ_DIAGNOSTIC_ASSERT(IsSuspended());. I only see 21 user-submitted crash reports with this crash reason, e.g. bp-564cfc51-a6df-4e07-ad44-fec1b0211010. 100% of these crash pings and reports have Fission enabled.

Severity: critical → S2
Fission Milestone: --- → ?
Priority: P3 → --
Summary: Crash in [@ nsGlobalWindowInner::ThawInternal] → Fission crash in [@ nsGlobalWindowInner::ThawInternal]

We are thawing a GlobalWindow that is not suspended. This is an issue in bfcache, both Fission's new bfcache and the old bfcache implementation.

Assigning to Olli because he knows what's going wrong.

This crash is a MOZ_DIAGNOSTIC_ASSERT, so the crash only affects Nightly and Dev Edition. In Beta and Release, a page will be infinitely frozen because we will underflow the freeze counter.

Assignee: nobody → bugs
Severity: S2 → S3
Fission Milestone: ? → Future
Priority: -- → P2
Summary: Fission crash in [@ nsGlobalWindowInner::ThawInternal] → Fission crash in [@ nsGlobalWindowInner::ThawInternal] | MOZ_DIAGNOSTIC_ASSERT(IsSuspended())
Pushed by opettay@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/74faf438c67f
freeze/thaw in a separate step, r=peterv
Status: NEW → RESOLVED
Closed: 1 month ago
Resolution: --- → FIXED
Target Milestone: --- → 96 Branch

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #5)

https://hg.mozilla.org/mozilla-central/rev/74faf438c67f

Setting status-firefox95=fixed because the changeset above says milestone 95.0a1.

Target Milestone: 96 Branch → 95 Branch

Looks like I was wrong about this fix landing in Beta 95. The fix added a new test but don't see it in mozilla-beta: https://hg.mozilla.org/releases/mozilla-beta/file/tip/docshell/test/navigation/test_bug1583110.html

Target Milestone: 95 Branch → 96 Branch

Comment on attachment 9248070 [details]
Bug 1583110, freeze/thaw in a separate step, r=peterv

Beta/Release Uplift Approval Request

  • User impact if declined: When a page comes out for bfcache and adds an iframe during pageshow event listener, the iframe
    will not work correctly, on Fission (the patch affects Fission only)
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Medium
  • Why is the change risky/not risky? (and alternatives if risky): This is preventing a method call (thaw) to happen on those browsing context where it is not needed.
  • String changes made/needed:
Attachment #9248070 - Flags: approval-mozilla-beta?

Comment on attachment 9248070 [details]
Bug 1583110, freeze/thaw in a separate step, r=peterv

Approved for 95 beta 3, thanks.

Attachment #9248070 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.