1646328 - Crash in [@ nsFrameLoader::Create]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P3)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-490d47cd-8b5c-4907-89bf-fae3b0200616.

Top 10 frames of crashing thread:

0 libxul.so nsFrameLoader::Create dom/base/nsFrameLoader.cpp:420
1 libxul.so mozilla::dom::XULFrameElement::LoadSrc dom/xul/XULFrameElement.cpp:91
2 libxul.so mozilla::dom::XULFrameElement::BindToTree dom/xul/XULFrameElement.cpp:144
3 libxul.so nsINode::ReplaceOrInsertBefore dom/base/nsINode.cpp:2690
4 libxul.so mozilla::dom::Node_Binding::appendChild dom/bindings/NodeBinding.cpp:989
5 libxul.so bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3219
6 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:578
7 libxul.so Interpret js/src/vm/Interpreter.cpp:641
8 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:613
9 libxul.so js::Call js/src/vm/Interpreter.cpp:658

There are 12 crashes (from 6 installations) in nightly 79 starting with buildid 20200616092900. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1640019.

[1] https://hg.mozilla.org/mozilla-central/rev?node=d027f301f08c

Comment 1

[Nika Layzell [:nika] (ni? for response)]

It looks like my assertion was a bit too strong here. I would like to eventually replace this with a better solution which doesn't provide mismatched remote types and process IDs.

Comment 2

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1646328 - Downgrade sameProcessAsFrameLoader/remoteType to a debug assert,

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/897f6873d4c1
Downgrade sameProcessAsFrameLoader/remoteType to a debug assert, r=mattwoodrow

Comment 4

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/897f6873d4c1