1611764 - Crash in [@ nsFrameLoader::MaybeCreateDocShell]

Status: RESOLVED DUPLICATE of bug 1612431

(Core :: DOM: Navigation, defect, P1)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

This bug is for crash report bp-6e19e95d-7e8d-4aab-a0ec-6ecd80200126.

Top 10 frames of crashing thread:

0 xul.dll nsFrameLoader::MaybeCreateDocShell dom/base/nsFrameLoader.cpp:1989
1 xul.dll nsFrameLoader::GetBrowsingContext dom/base/nsFrameLoader.cpp:3215
2 xul.dll nsGenericHTMLFrameElement::AfterMaybeChangeAttr dom/html/nsGenericHTMLFrameElement.cpp:343
3 xul.dll nsGenericHTMLFrameElement::AfterSetAttr dom/html/nsGenericHTMLFrameElement.cpp:285
4 xul.dll mozilla::dom::Element::SetAttrAndNotify dom/base/Element.cpp:2339
5 xul.dll mozilla::dom::Element::SetAttr dom/base/Element.cpp:2199
6 xul.dll mozilla::dom::Element::SetAttribute dom/base/Element.cpp:1266
7 xul.dll mozilla::dom::Element_Binding::setAttribute dom/bindings/ElementBinding.cpp:1306
8 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3151
9 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:542

The raw crash reason is:

MOZ_DIAGNOSTIC_ASSERT(nsContentUtils::IsSafeToRunScript() || mOwnerContent->OwnerDoc()->IsStaticDocument()) (FrameLoader should never be initialized during document update or reflow!)

This seems to have started happening in build 20200125094527.

Note that there's older non-nightly crashes with this signature but they seem unrelated.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Uh, GetBrowsingContext() is still so broken concept. I think it has caused similar issues before too.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

One could argue the regression is from https://hg.mozilla.org/mozilla-central/rev/3b9e96b71449

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

Comment 5

[Alice0775 White]

Nightly74.0a1 Windows10 crashes, However, Firefox73.0b11 does not crash.

Reproducible: yes, I tried twice with the following steps, but every time the browser crashed

Steps to reproduce:
0. Clear history everything

1. Open http://edition.cnn.com/videos/us/2015/05/13/inside-supermax-prison-orig.cnn/video/playlists/trending-video/
2. No beed to play the video
3. Open https://www.msn.com/ja-jp in same tab and then scroll down while page is loading

Actual Results:
Tab crashes
bp-db520134-afd9-4dd8-b00f-ccea20200202
bp-56e0cc68-8b44-4aea-9946-9b6a60200202

Comment 6

[Alice0775 White]

Regression window:
At least the bad build(8e70567acc3b890065d51a50056be99a5176c819) crashes with str of comment#5, but the crash is intermittently.
The good build(d3dc60cc5291b6ff3eaacc892a18b683dcb20530) does not crash yet.

https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6f6e201853c8f5053d6f8837acf89e76f5a334c5&tochange=f7f534f08b4827c90ed4ec421c14355cb81dfaaa

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d3dc60cc5291b6ff3eaacc892a18b683dcb20530&tochange=8e70567acc3b890065d51a50056be99a5176c819

Suspect: Bug 1595936 (not 100% sure)

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

kmag, could you take a look at this?

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Or, hmm, I can take a look at this in bug 1612431.