1672404 - Crash when going back and forth on Android with Fission

Status: RESOLVED DUPLICATE of bug 1670557

(Core :: DOM: Navigation, defect)

Description

[[ex-Mozilla] Agi Sferro | :agi]

If I try to go back and fort from two non-same-origin pages eventually a get a crash like this:

art_sigsegv_fault 0x00007e78765077b0
art::FaultManager::HandleFault(int, siginfo*, void*) 0x00007e7876507c95
art::SignalChain::Handler(int, siginfo*, void*) 0x0000572473769bb6
__restore_rt 0x00007e78fb6e79e0
pthread_mutex_lock 0x00007e78fb754580
<unknown> 0x00007e785e51e827
mozilla::OffTheBooksMutex::Lock() Mutex.h:62
mozilla::Monitor::Lock() Monitor.h:31
mozilla::MonitorAutoLock::MonitorAutoLock(mozilla::Monitor&) Monitor.h:66
mozilla::ipc::MessageChannel::NotifyImpendingShutdown() MessageChannel.cpp:2656
mozilla::dom::ContentParent::StartForceKillTimer() ContentParent.cpp:2151
mozilla::dom::ContentParent::MaybeBeginShutDown(unsigned int, bool) ContentParent.cpp:1547
mozilla::dom::CanonicalBrowsingContext::PendingRemotenessChange::Clear() CanonicalBrowsingContext.cpp:1196
mozilla::dom::CanonicalBrowsingContext::PendingRemotenessChange::Cancel(nsresult) CanonicalBrowsingContext.cpp:1182
mozilla::dom::CanonicalBrowsingContext::ChangeRemoteness(nsTSubstring<char> const&, unsigned long, bool, unsigned long) CanonicalBrowsingContext.cpp:1267
mozilla::net::DocumentLoadListener::TriggerProcessSwitch(mozilla::dom::CanonicalBrowsingContext*, nsTString<char> const&, bool, unsigned long) DocumentLoadListener.cpp:1719
mozilla::net::DocumentLoadListener::MaybeTriggerProcessSwitch(bool*) DocumentLoadListener.cpp:1648
mozilla::net::DocumentLoadListener::OnStartRequest(nsIRequest*) DocumentLoadListener.cpp:2145
mozilla::net::ParentChannelListener::OnStartRequest(nsIRequest*) ParentChannelListener.cpp:90
nsDocumentOpenInfo::OnStartRequest(nsIRequest*) nsURILoader.cpp:166
mozilla::net::ParentProcessDocumentOpenInfo::OnDocumentStartRequest(nsIRequest*) DocumentLoadListener.cpp:272
mozilla::net::nsHttpChannel::CallOnStartRequest() nsHttpChannel.cpp:2068
mozilla::net::nsHttpChannel::ContinueOnStartRequest4(nsresult) nsHttpChannel.cpp:7940
mozilla::net::nsHttpChannel::ContinueOnStartRequest3(nsresult) nsHttpChannel.cpp:7932
mozilla::net::nsHttpChannel::ContinueOnStartRequest2(nsresult) nsHttpChannel.cpp:7912
mozilla::net::nsHttpChannel::ContinueOnStartRequest1(nsresult) nsHttpChannel.cpp:7885
mozilla::net::nsHttpChannel::OnStartRequest(nsIRequest*) nsHttpChannel.cpp:7849
nsInputStreamPump::OnStateStart() nsInputStreamPump.cpp:481
nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*) nsInputStreamPump.cpp:390
nsInputStreamReadyEvent::Run() nsStreamUtils.cpp:94
mozilla::RunnableTask::Run() TaskController.cpp:245
mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) TaskController.cpp:515
mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) TaskController.cpp:374
mozilla::TaskController::ProcessPendingMTTask(bool) TaskController.cpp:171
mozilla::TaskController::InitializeInternal()::$_3::operator()() const TaskController.cpp:85
mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() nsThreadUtils.h:577
nsThread::ProcessNextEvent(bool, bool*) nsThread.cpp:1197
NS_ProcessNextEvent(nsIThread*, bool) nsThreadUtils.cpp:513
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) MessagePump.cpp:87
MessageLoop::RunInternal() message_loop.cc:334
MessageLoop::RunHandler() message_loop.cc:327
MessageLoop::Run() message_loop.cc:309
nsBaseAppShell::Run() nsBaseAppShell.cpp:137
nsAppStartup::Run() nsAppStartup.cpp:270
XREMain::XRE_mainRun() nsAppRunner.cpp:5083
XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) nsAppRunner.cpp:5275
XRE_main(int, char**, mozilla::BootstrapConfig const&) nsAppRunner.cpp:5331
::GeckoStart(JNIEnv *, char **, int, const mozilla::StaticXREAppData &) nsAndroidStartup.cpp:38
Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun 0x00007e785e4ee6ef
art_quick_generic_jni_trampoline 0x00007e7876928062
<unknown> 0x00007e78769284e0

Comment 1

[Chris Peterson [:cpeterson]]

Nika thinks this is a related to NotifyImpendingShutdown bug 1670557. She's working on a fix in that bug.