1974133 - Crash in [@ mozilla::dom::CanonicalBrowsingContext::ReplaceActiveSessionHistoryEntry]

Status: RESOLVED DUPLICATE of bug 1972191

(Core :: DOM: Navigation, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/5841773f-f78d-4184-858c-793af0250625

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::RefPtrTraits<mozilla::dom::SessionHistoryEntry>::AddRef  mfbt/RefPtr.h:48
0  xul.dll  RefPtr<mozilla::dom::SessionHistoryEntry>::ConstRemovingRefPtrTraits<mozilla::dom::SessionHistoryEntry>::AddRef  mfbt/RefPtr.h:408
0  xul.dll  RefPtr<mozilla::dom::SessionHistoryEntry>::assign_with_AddRef  mfbt/RefPtr.h:59
0  xul.dll  RefPtr<mozilla::dom::SessionHistoryEntry>::operator=  mfbt/RefPtr.h:202
0  xul.dll  mozilla::dom::CanonicalBrowsingContext::ReplaceActiveSessionHistoryEntry  docshell/base/CanonicalBrowsingContext.cpp:1358
1  xul.dll  mozilla::dom::ContentParent::RecvReplaceActiveSessionHistoryEntry  dom/ipc/ContentParent.cpp:7755
1  xul.dll  mozilla::dom::PContentParent::OnMessageReceived  ipc/ipdl/PContentParent.cpp:13683
2  xul.dll  mozilla::ipc::MessageChannel::DispatchAsyncMessage  ipc/glue/MessageChannel.cpp:1795
2  xul.dll  mozilla::ipc::MessageChannel::DispatchMessage  ipc/glue/MessageChannel.cpp:1721
2  xul.dll  mozilla::ipc::MessageChannel::RunMessage  ipc/glue/MessageChannel.cpp:1512

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-06-25
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: No
• Is use after free crash: Yes - all crashes happened on or near an allocator poison value

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1952913.

[1] https://hg.mozilla.org/mozilla-central/rev?node=3aacd9fee79a

:avandolder, since you are the author of the potential regressor, could you please take a look?

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1952913

Comment 2

[Adam Vandolder [:avandolder]]

This appears to be another case that should be resolved by the fix for bug 1972191. Both crashes appear to have occurred on nightly versions from before that fix rolled out.

Comment 3

[Andrew McCreight [:mccr8]]

Let's just lump these together for now given that we think the one patch should fix it all.