1832321 - Crash in [@ IPCError-content | RecvUpdateDocumentURI Setting DocumentURI with a different Origin than principal URI]

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/9bf3dde2-a77a-4b7b-92ac-9ea650230509

Reason: DUMP_REQUESTED

Top 10 frames of crashing thread:

0  libxul.so  mozilla::nsDisplayList::nsDisplayList  layout/painting/nsDisplayList.h:3054
0  libxul.so  mozilla::nsDisplayListCollection::nsDisplayListCollection  layout/painting/nsDisplayList.h:3545
0  libxul.so  nsIFrame::BuildDisplayListForStackingContext  layout/generic/nsIFrame.cpp:3434
1  libxul.so  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4288
2  libxul.so  DisplayLine  layout/generic/nsBlockFrame.cpp:7086
3  libxul.so  nsBlockFrame::BuildDisplayList  layout/generic/nsBlockFrame.cpp:7243
4  libxul.so  nsIFrame::BuildDisplayListForSimpleChild  layout/generic/nsIFrame.cpp:4007
4  libxul.so  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4111
5  libxul.so  nsHTMLScrollFrame::BuildDisplayList  layout/generic/nsGfxScrollFrame.cpp:4136
6  libxul.so  nsIFrame::BuildDisplayListForChild  layout/generic/nsIFrame.cpp:4338

It looks like we're hitting this fairly often, but only on Android.

Artur, could you take a look? Thanks.

Comment 1

[Andrew McCreight [:mccr8]]

I'm not sure what the best way to investigate this is. I think there's some way to get the stack of the crashing process from the minidump, but I'm not sure how exactly.

Comment 2

[Andrew McCreight [:mccr8]]

I've marked this as a sec bug, because it is a regression from a sec bug, and I don't know whether this indicates a security issue in Android, or just some incompatibility of this change with non-Fission.

Comment 3

[Artur Iunusov]

I asked the sheriffs to backout that patch. Thanks!
Looking..

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out bug 1783504. Please close this bug if the fix will be part of the other one.

Comment 5

[Artur Iunusov]

will be resolved as a part of 1783504

Comment 6

[BugBot [:suhaib / :marco]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 AArch64 and ARM crashes on nightly

For more information, please visit BugBot documentation.

Comment 7

[Andrew McCreight [:mccr8]]

Fixed by backout.

Comment 8

[Andrew McCreight [:mccr8]]

I'll unhide this to make it easier to find. There's no security information in this bug that I can see.