1583110 - Fission crash in [@ nsGlobalWindowInner::ThawInternal] | MOZ_DIAGNOSTIC_ASSERT(IsSuspended())

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-ee165c3b-ece5-43d7-a916-e9f2c0190920.

Top 10 frames of crashing thread:

0 xul.dll void nsGlobalWindowInner::ThawInternal dom/base/nsGlobalWindowInner.cpp:5274
1 xul.dll static nsGlobalWindowInner::CallState nsGlobalWindowInner::CallOnChildren<void  dom/base/nsGlobalWindowInner.cpp:5399
2 xul.dll void nsGlobalWindowInner::ThawInternal dom/base/nsGlobalWindowInner.cpp:5276
3 xul.dll nsGlobalWindowInner::Thaw dom/base/nsGlobalWindowInner.cpp:5267
4 xul.dll nsresult nsGlobalWindowOuter::RestoreWindowState dom/base/nsGlobalWindowOuter.cpp:7511
5 xul.dll nsresult nsDocShell::RestoreFromHistory docshell/base/nsDocShell.cpp:7908
6 xul.dll nsresult nsDocShell::RestorePresentationEvent::Run docshell/base/nsDocShell.cpp:7340
7 xul.dll mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:295
8 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486

Low-volume crash on all platforms, most likely because it's triggered by a diagnostic assertion so it should be happening only on nightly and beta. We're tripping over this assertion:

https://hg.mozilla.org/mozilla-central/annotate/5ac55079c87e4cd25eafafa8662594b4a2917dcc/dom/base/nsGlobalWindowInner.cpp#l5274

Comment 1

[Chris Peterson [:cpeterson]]

When searching through the last four weeks of Fission crash pings, I see 237 Aurora crash pings and 75 Nightly crash pings with crash reason MOZ_DIAGNOSTIC_ASSERT(IsSuspended());. I only see 21 user-submitted crash reports with this crash reason, e.g. bp-564cfc51-a6df-4e07-ad44-fec1b0211010. 100% of these crash pings and reports have Fission enabled.

Comment 2

[Chris Peterson [:cpeterson]]

We are thawing a GlobalWindow that is not suspended. This is an issue in bfcache, both Fission's new bfcache and the old bfcache implementation.

Assigning to Olli because he knows what's going wrong.

This crash is a MOZ_DIAGNOSTIC_ASSERT, so the crash only affects Nightly and Dev Edition. In Beta and Release, a page will be infinitely frozen because we will underflow the freeze counter.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1583110, freeze/thaw in a separate step, r=peterv

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/74faf438c67f
freeze/thaw in a separate step, r=peterv

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/74faf438c67f

Comment 6

[Chris Peterson [:cpeterson]]

(In reply to Sebastian Hengst [:aryx] (needinfo on intermittent or backout) from comment #5)

https://hg.mozilla.org/mozilla-central/rev/74faf438c67f

Setting status-firefox95=fixed because the changeset above says milestone 95.0a1.

Comment 7

[Chris Peterson [:cpeterson]]

Looks like I was wrong about this fix landing in Beta 95. The fix added a new test but don't see it in mozilla-beta: https://hg.mozilla.org/releases/mozilla-beta/file/tip/docshell/test/navigation/test_bug1583110.html

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 9248070 [details]
Bug 1583110, freeze/thaw in a separate step, r=peterv

Beta/Release Uplift Approval Request

• User impact if declined: When a page comes out for bfcache and adds an iframe during pageshow event listener, the iframe
  will not work correctly, on Fission (the patch affects Fission only)
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): This is preventing a method call (thaw) to happen on those browsing context where it is not needed.
• String changes made/needed:

Comment 9

[Pascal Chevrel:pascalc]

Comment on attachment 9248070 [details]
Bug 1583110, freeze/thaw in a separate step, r=peterv

Approved for 95 beta 3, thanks.

Comment 10

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/b855849fd300