1691403 - Crash in [@ nsContentUtils::FirePageShowEventForFrameLoaderSwap]

Status: RESOLVED WORKSFORME

(Core :: DOM: Navigation, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/cfcee72b-e3c9-437c-8f2d-dfcef0210204

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so nsContentUtils::FirePageShowEventForFrameLoaderSwap dom/base/nsContentUtils.cpp:8231
1 libxul.so mozilla::dom::BrowserChild::RecvSwappedWithOtherRemoteLoader dom/ipc/BrowserChild.cpp:2257
2 libxul.so mozilla::dom::PBrowserChild::OnMessageReceived ipc/ipdl/PBrowserChild.cpp:6783
3 libxul.so mozilla::dom::PContentChild::OnMessageReceived ipc/ipdl/PContentChild.cpp:8706
4 libxul.so mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2077
5 libxul.so mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:753
6 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1158
7 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:87
8 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:310
9 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

Low-volume but affects all platforms with identical stacks and crash reason. It seems to me that doc is NULL here.

Comment 1

[Chris Peterson [:cpeterson]]

Easy fix, but why is doc NULL?

This code is firing page hide and show for frame scripts, functionality that we might not even need any more.

Comment 2

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Peter, while you're touching fire pageshow events currently, maybe you'd like to take a look at this as well? Comment 1 says this is an easy fix.

Comment 3

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Hsin-Yi Tsai [:hsinyi] from comment #2)

Peter, while you're touching fire pageshow events currently, maybe you'd like to take a look at this as well? Comment 1 says this is an easy fix.

Next step is to look into if this functionality can be removed.

Comment 4

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Assign to Kris to add a null check.

Comment 5

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Change the severity as the volume is very low and it's not pointing to a security problem.
Kris, NI to bring this back to your radar to add a null check to fix this.

Comment 6

[Carlos E.R.]

I reported an issue in openSUSE bugzilla system which I have been told it is this bug.

I have Firefox tabs crashing constantly, producing coredumps and sending automated reports to the Mozilla system, making work very difficult.
I open a Firefox tab, and it can crash anytime.

Please solve this.

The link to the openSUSE bugzilla is this:

https://bugzilla.opensuse.org/show_bug.cgi?id=1192978

Comment 7

[Chris Peterson [:cpeterson]]

Carlos, can you please share your Firefox's about:support information in this bug?

I see in the openSUSE bug report that you are running "MozillaFirefox-91.7.0". Most of the crash reports we've received in the last six months for this bug are from Firefox ESR version 91, with very few from more recent versions.

Can you update to a more recent version of Firefox? ESR 102 superseded ESR 91 in June and then Mozilla EOL'd ESR 91 in August. openSUSE should have updated their MozillaFirefox package to ESR 102 two or three months ago.

Comment 8

[Carlos E.R.]

91.13.0esr (64-bit)

That's the one openSUSE Leap 15.3 has, I don't see any other in YaST/zypper.

Rpm:

MozillaFirefox-91.13.0-150200.152.56.2.x86_64

Search doesn't find any other, but package search has been broken lately. I'll have to ask.

https://software.opensuse.org/package/MozillaFirefox - download is broken

Comment 9

[Carlos E.R.]

Ok, found the update in mozilla repo, but I can not apply it, too intrusive. I will have to wait till the official update.
Thanks for the information.

Comment 10

[Carlos E.R.]

Minutes after I wrote the previous comment, the 102 package was available for everybody on openSUSE Leap.
And so far, I have not seen tab crashes.
Thank you! :-)

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee is inactive on Bugzilla, so the assignee is being reset.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.