1876651 - Crash in [@ nsISHEntry::GetWindowState] from nsDocShell::RestoreFromHistory() on Android

Status: NEW

(Core :: DOM: Navigation, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/e863736a-584d-4d0d-a3f5-5f9a50240125

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  nsISHEntry::GetWindowState  dist/include/nsISHEntry.h:221
0  libxul.so  nsDocShell::RestoreFromHistory  docshell/base/nsDocShell.cpp:7391
0  libxul.so  nsDocShell::RestorePresentationEvent::Run  docshell/base/nsDocShell.cpp:7010
1  libxul.so  mozilla::RunnableTask::Run  xpcom/threads/TaskController.cpp:549
2  libxul.so  mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal  xpcom/threads/TaskController.cpp:876
3  libxul.so  mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal  xpcom/threads/TaskController.cpp:699
3  libxul.so  mozilla::TaskController::ProcessPendingMTTask  xpcom/threads/TaskController.cpp:485
3  libxul.so  mozilla::TaskController::TaskController const  xpcom/threads/TaskController.cpp:211
3  libxul.so  mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController  xpcom/threads/nsThreadUtils.h:548
4  libxul.so  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1199

This looks like a null deref.

Comment 1

[Andrew McCreight [:mccr8]]

The crash is on this line: nsCOMPtr<nsISupports> windowState = mLSHE->GetWindowState();

So maybe mLSHE is null?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

This is coming from the old session history, so yes, Android only.

Comment 3

[Peter Van der Beken [:peterv]]

The recent peak is odd.

Note that nsDocShell::RestoreFromHistory does check mLSHE at the beginning (https://searchfox.org/mozilla-central/rev/2c3d657cbba5484ccac44443c4417baed7b5fafb/docshell/base/nsDocShell.cpp#7221-7223) and again after firing pageHide (https://searchfox.org/mozilla-central/rev/2c3d657cbba5484ccac44443c4417baed7b5fafb/docshell/base/nsDocShell.cpp#7246,7261-7263).