1596789 - Crash in [@ mozilla::ipc::FatalError | mozilla::ipc::IProtocol::HandleFatalError | mozilla::ipc::ReadIPDLParam<T>]

Status: RESOLVED DUPLICATE of bug 1595578

(Core :: Networking, defect)

Description

[David Burns :automatedtester]

STR:

Go to https://paste.mozilla.org

Paste in text from https://gist.githubusercontent.com/AutomatedTester/1616894e0912b4846968d2440bb51d72/raw/dc29eb5aac84eb0462cd04bac88ed3645d5231b3/gistfile1.txt

Set the text type to text and set to keep for a week.

Click save. Tab or browser will crash

This bug is for crash report bp-cee1d3e4-f11a-4c79-8c94-a374f0191115.

Top 10 frames of crashing thread:

0 XUL mozilla::ipc::FatalError ipc/glue/ProtocolUtils.cpp:165
1 XUL mozilla::ipc::IProtocol::HandleFatalError const ipc/glue/ProtocolUtils.cpp:404
2 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::IPCRemoteStreamType> ipc/glue/IPDLParamTraits.h:68
3 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::IPCRemoteStreamParams> ipc/glue/IPDLParamTraits.h:68
4 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::InputStreamParams> ipc/glue/IPDLParamTraits.h:68
5 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::Maybe<mozilla::ipc::InputStreamParams> > ipc/glue/IPDLParamTraits.h:68
6 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::MIMEInputStreamParams> ipc/glue/IPDLParamTraits.h:68
7 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::InputStreamParams> ipc/glue/IPDLParamTraits.h:68
8 XUL mozilla::ipc::IPDLParamTraits<mozilla::ipc::IPCStream>::Read ipc/ipdl/IPCStream.cpp:59
9 XUL mozilla::ipc::IPDLParamTraits<mozilla::Maybe<mozilla::ipc::IPCStream> >::Read ipc/glue/IPDLParamTraits.h:260

Comment 1

[Andrew McCreight [:mccr8]]

The crash reason is "IPC FatalError in the parent process!" which is not very useful.

Comment 2

[Andrew McCreight [:mccr8]]

More useful: IPCFatalErrorMsg is "Error deserializing variant TPChildToParentStreamChild of union IPCRemoteStreamType"

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Probably failure to deserialize an actor reference; lifetime confusion, maybe?

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

So the failing message is to construct a PDocumentChannel managed by PNecko; this is from the child to the parent. However, PChildToParentStream is deleted from the parent to the child, so there could be a race condition there.

Comment 5

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

This seems to have something to do with DocumentChannel (see previous comment); it's not clear whether it's from bug 1556489 or something more recent, but let's start there.

Comment 6

[Dragana Damjanovic [:dragana]]

Matt, is this dup of 1595578?

Comment 7

[Matt Woodrow (:mattwoodrow)]

It is indeed!