1619857 - Crash in [@ mozilla::dom::BrowserChild::GetTopLevelViewportVisibleRectInSelfCoords]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

This bug is for crash report bp-570fedc4-8c69-4600-b7b0-d3a8b0200214.

Top 10 frames of crashing thread:

0 XUL mozilla::dom::BrowserChild::GetTopLevelViewportVisibleRectInSelfCoords const dom/ipc/BrowserChild.cpp:3399
1 XUL mozilla::dom::DOMIntersectionObserver::Update dom/base/DOMIntersectionObserver.cpp:425
2 XUL mozilla::dom::Document::UpdateIntersectionObservations dom/base/Document.cpp:14639
3 XUL nsRefreshDriver::UpdateIntersectionObservations layout/base/nsRefreshDriver.cpp:1645
4 XUL nsRefreshDriver::Tick layout/base/nsRefreshDriver.cpp:2093
5 XUL mozilla::RefreshDriverTimer::TickRefreshDrivers layout/base/nsRefreshDriver.cpp:374
6 XUL mozilla::RefreshDriverTimer::Tick layout/base/nsRefreshDriver.cpp:368
7 XUL mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver layout/base/nsRefreshDriver.cpp:740
8 XUL mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync layout/base/nsRefreshDriver.cpp:635
9 XUL mozilla::layout::VsyncChild::RecvNotify layout/ipc/VsyncChild.cpp:64

This is a NULL-pointer dereference of the BrowserChild. Since this is happening on a refresh driver tick I wonder if this might be because of a stale object. The oldest build id for this crash is 20200213214257.

Comment 1

[Henri Sivonen (:hsivonen)]

Hiro, could you, please, take a look?

Comment 2

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1619857 - Early return from GetOopIframeMetrics in cases where either the presshell or the docshell is being destroyed. r?emilio

I gave up writing crash tests for this since it's quite hard to destroy
an OOP iframe during processing IntersectionObserver's update step in the
OOP process.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1c5275a57680
Early return from GetOopIframeMetrics in cases where either the presshell or the docshell is being destroyed. r=emilio

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/1c5275a57680

Comment 5

[Catalin Sasca, Desktop QA [:csasca]]

Hi there Hiroyuki, is there something that QA could verify here? If so, could you please provide some STR? Thanks!

Comment 6

[Hiroyuki Ikezoe (:hiro)]

No, it's a race condition, I don't think there is STR to reproduce this issue.