1656854 - Crash in [@ IPCError-browser | RecvCreateBrowsingContext Parent has different group object]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Gabriele Svelto [:gsvelto] (PTO)]

This bug is for crash report bp-85b2a2f3-368c-4f56-a769-e92d90200802.

This started in buildid 20200802214843, I'll attach the full stack trace of the parent process.

Comment 1

[Gabriele Svelto [:gsvelto] (PTO)]

Attachment: Main process full stack trace

Comment 2

[Andrew McCreight [:mccr8]]

Nika, it looks like you added this check in bug 1652085 (by making an existing failure more fine-grained), so you might be interested in this crash.

Comment 3

[Andrew McCreight [:mccr8]]

FWIW, I don't see any crashes for "Parent has different group ID", "Opener has different group ID", or "Opener has different group object" crashes, which were also "added" in that bug.

Comment 4

[Nika Layzell [:nika] (ni? for response)]

Hmm, interesting. I suppose the code I added in bug 1652085 to wait for the discard to be acked before discarding the BrowsingContextGroup in the parent process wasn't enough.

I've got a few ideas for where this could be coming from, so I'll put up a patch which might help.

Comment 5

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1656854 - Part 1: Block subframe creation in discarded BCs,

This should help catch and/or prevent any cases where we're creating a new
subframe at an unfortunate time during BrowsingContext or WindowContext
teardown.

Comment 6

[Nika Layzell [:nika] (ni? for response)]

Attachment: Bug 1656854 - Part 2: Add a BrowsingContextGroup keepalive to BrowserParent shutdown,

In bug 1652085, I added BrowsingContextGroup keepalives while waiting for
replies to the discard message, however that message isn't actually sent to the
current owner process. Instead, the BrowsingContext is discarded by the
PBrowser being destroyed.

This should help ensure we also keep the group alive during normal BrowserParent
destruction.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d5f1c00144e2
Part 1: Block subframe creation in discarded BCs, r=farre
https://hg.mozilla.org/integration/autoland/rev/ee09cb88af17
Part 2: Add a BrowsingContextGroup keepalive to BrowserParent shutdown, r=farre

Comment 8

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/d5f1c00144e2
https://hg.mozilla.org/mozilla-central/rev/ee09cb88af17