1634596 - Crash in [@ IPCError-content | RecvConstructBrowser Null or discarded initial BrowsingContext]

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect, P2)

Description

[Andrew McCreight [:mccr8]]

This bug is for crash report bp-4a257f1c-25b3-47d8-9766-a85810200430.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ContentChild::ProcessingError dom/ipc/ContentChild.cpp:2230
1 xul.dll static mozilla::ipc::IPCResult::Fail ipc/glue/ProtocolUtils.cpp:58
2 xul.dll mozilla::dom::ContentChild::RecvConstructBrowser dom/ipc/ContentChild.cpp:1756
3 xul.dll mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:8517
4 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2110
5 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1989
6 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1200
7 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:481
8 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308

It looks like this first showed up in the 20200425094923 build. These are the changesets added in that build: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=db2e1d780268ab0a7dca1ea1ca81febcb33e926e&tochange=d8a8178627c4fab05f1eb46ee40f55db207c7c18

Bug 1580565 is in the range. Bug 1632098 is also kind of Fission-y.

It is still showing up in the April 29th builds.

Comment 1

[Andrew McCreight [:mccr8]]

Nika, do you think this might be a regression from bug 1580565? And might it be fixed by one of the other regression fixes you landed recently? Thanks.

It looks like this crash is Fission-only.

Comment 2

[Andrew McCreight [:mccr8]]

(It looks like bug 1632098 got backed out and didn't make it to a Nightly.)

Comment 3

[Nika Layzell [:nika] (ni? for response)]

This looks like it might be the same as the new crash signature :mattwoodrow noticed in bug 1618156 comment 12.

I think this is a regression from bug 1580565, caused in some of the similar situations as the crash which was fixed unfortunately. I think I know how it happens, but I haven't had the time to fix it properly.

Self-assigning this so I fix it soon.

Comment 4

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1634596 - Avoid switching into a new process if an ancestor is discarded,

This is a temporary workaround for the crashes this can cause. A more thorough
fix to discarded ancestor issues will be implemented in bug 1634759.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/67c5870aef72
Avoid switching into a new process if an ancestor is discarded, r=farre

Comment 7

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/67c5870aef72

Comment 8

[Intermittent Failures Robot]

1 failures in 5276 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform breakdown:

• linux64-shippable-qr: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1634596&startday=2020-05-04&endday=2020-05-10&tree=all