1750070 - Crash in [@ nsFrameLoader::RequestTabStateFlush]

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Sean Feng [:sefeng]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/7ab4469c-1b50-4e58-aba2-081740211204

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0 xul.dll nsFrameLoader::RequestTabStateFlush dom/base/nsFrameLoader.cpp:3226
1 xul.dll mozilla::dom::FrameLoader_Binding::requestTabStateFlush_promiseWrapper dom/bindings/FrameLoaderBinding.cpp:700
2 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises> dom/bindings/BindingUtils.cpp:3300
3 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:472
4 xul.dll Interpret js/src/vm/Interpreter.cpp:3239
5 xul.dll js::Call js/src/vm/Interpreter.cpp:549
6 xul.dll JS_CallFunctionValue js/src/vm/CallAndConstruct.cpp:53
7 xul.dll nsXPCWrappedJS::CallMethod js/xpconnect/src/XPCWrappedJSClass.cpp:973
8 xul.dll PrepareAndDispatch xpcom/reflect/xptcall/md/win32/xptcstubs_x86_64.cpp:168
9 xul.dll SharedStub 

Looks like a nullptr crash, perhaps GetOwnerDoc() could be null?

Comment 1

[Sean Feng [:sefeng]]

Attachment: Bug 1750070 - Fix nullptr crash in nsFrameLoader::RequestTabStateFlush r=nika

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f341a7779297
Use default scope in nsFrameLoader::RequestTabStateFlush r=nika

Comment 3

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/40a963c61248
Backed out changeset f341a7779297 for causing bc failures on browser_aboutNewTab_bookmarksToolbarPrefs.js and others. CLOSED TREE

Comment 4

[Cosmin Sabou [:CosminS]]

Backed out for causing bc failures on browser_aboutNewTab_bookmarksToolbarPrefs.js and others.

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Csuccess%2Cusercancel%2Crunning%2Cpending%2Crunnable&fromchange=ba66242256351dcfd045aade16d150dc7e42a2e4&searchStr=bc&tochange=40a963c61248331f06c7b02fe97fec08279d56b2&selectedTaskRun=GZ7OwmnDSqWJcVK0tkZMWA.0

Failure log:

• https://treeherder.mozilla.org/logviewer?job_id=366258746&repo=autoland
• https://treeherder.mozilla.org/logviewer?job_id=366255412&repo=autoland
• https://treeherder.mozilla.org/logviewer?job_id=366259310&repo=autoland
• https://treeherder.mozilla.org/logviewer?job_id=366260172&repo=autoland
• https://treeherder.mozilla.org/logviewer?job_id=366256405&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/40a963c61248331f06c7b02fe97fec08279d56b2

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:sefeng, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 6

[Nika Layzell [:nika] (ni? for response)]

Commented on phabricator.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/49943a3a5f98
Fix nullptr crash in nsFrameLoader::RequestTabStateFlush r=nika,farre

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/49943a3a5f98