1717619 - Crash in [@ mozilla::ipc::MessageChannel::Send | mozilla::dom::PContentChild::SendSetURITitle | IPC_Message_Name=PContent::Msg_SetURITitle]

Status: RESOLVED WORKSFORME

(Core :: DOM: Navigation, defect, P3)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/e6bfd70e-658d-43a5-9e10-36bb90210614

MOZ_CRASH Reason: MOZ_CRASH(IPC message size is too large)

Top 10 frames of crashing thread:

0 libxul.so mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:974
1 libxul.so mozilla::dom::PContentChild::SendSetURITitle ipc/ipdl/PContentChild.cpp:3110
2 libxul.so mozilla::places::History::SetURITitle toolkit/components/places/History.cpp:1891
3 libxul.so nsDocShell::SetTitle docshell/base/nsDocShell.cpp:5104
4 libxul.so {virtual override thunk} 
5 libxul.so mozilla::dom::Document::DoNotifyPossibleTitleChange dom/base/Document.cpp:8914
6 libxul.so mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void  xpcom/threads/nsThreadUtils.h:1203
7 libxul.so mozilla::SchedulerGroup::Runnable::Run xpcom/threads/SchedulerGroup.cpp:143
8 libxul.so mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:782
9 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1159

This is one of many crashes of this type though I wonder what could be in a page title so large to overflow IPC?

Comment 1

[Chris Peterson [:cpeterson]]

We should ignore or truncate URI titles that are too long instead of crashing in IPC. Is the maximum URI title length defined in a spec? Ignoring long URI titles is probably safer than passing around truncated data.

Bug 1605371 has two-year-old STR for a debug assertion in this Msg_SetURITitle code.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.