1590048 - Crash in [@ mozilla::dom::BrowsingContext::Get]

Status: RESOLVED DUPLICATE of bug 1580194

(Core :: DOM: Navigation, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-4b925c1d-61bd-49c8-9490-f7b240191020.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::BrowsingContext::Get docshell/base/BrowsingContext.cpp:89
1 xul.dll mozilla::dom::BrowsingContext::GetOpener docshell/base/BrowsingContext.h:225
2 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp:7714
3 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp
4 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp
5 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp
6 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp
7 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp
8 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp
9 xul.dll nsGlobalWindowOuter::TabGroupOuter dom/base/nsGlobalWindowOuter.cpp

This is a stack overflow caused by excessive (infinite?) recursion in nsGlobalWindowOuter::TabGroupOuter(). This could be a regression as it happens only on nightly and the oldest build for which I could find a crash is 20190916155843.

A quick glance at the crashes shows that most of them have a few addons installed.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 2

[Andrew McCreight [:mccr8]]

These crashes all have Fission enabled.

Comment 3

[Nika Layzell [:nika] (ni? for response)]

Interesting. I'm guessing that the window window.open-ed itself, meaning it's opener is set to itself, and then changed process. The TabGroup code doesn't handle process switches well, and so bugs out when in this state.

This should be fixed by removing the mechanism entirely in bug 1561715, though may also be possible to work around if that isn't going to be happening super soon.

Comment 5

[Andrew McCreight [:mccr8]]

Bug 1592403 has some STR for this infinite recursion.

Comment 6

[Darkspirit]

Are they all related?
https://crash-stats.mozilla.org/search/?proto_signature=~TabGroupOuter&dom_fission_enabled=%21__null__&product=Firefox&date=%3E%3D2019-10-22T20%3A32%3A00.000Z&date=%3C2019-10-29T20%3A32%3A00.000Z&_facets=signature&_sort=-date&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Because of removal of TabGroup possibly fixing this, perhaps farre you could retest this stuff (using Bug 1592403) after TabGroups are gone.

Comment 8

[Chris Peterson [:cpeterson]]

Tentatively moving all bugs whose summaries mention "Fission" (or other Fission-related keywords) but are not assigned to a Fission Milestone to the "?" triage milestone.

This will generate a lot of bugmail, so you can filter your bugmail for the following UUID and delete them en masse:

0ee3c76a-bc79-4eb2-8d12-05dc0b68e732

Comment 9

[Neha Kochar [:neha]]

Andreas confirmed that this depends on TabGroup removal.