2061127 - Crash in [@ mozilla::dom::SessionHistoryEntry::GetParent]

Status: NEW

(Core :: DOM: Navigation, defect)

Description

[Calixte Denizet (:calixte)]

Crash report: https://crash-stats.mozilla.org/report/index/f6fe186b-1014-4144-9d2d-ea29d0260806

Crash Reason:

SIGABRT at 0x000003e800004199

Top 10 frames:

0  libxul.so  nsSHistory::FindAdjacentEntryFor(mozilla::dom::SessionHistoryEntry*, nsSHistory:...  docshell/shistory/nsSHistory.cpp:2528
1  libxul.so  nsSHistory::WalkContiguousEntriesInOrder(mozilla::dom::SessionHistoryEntry*, std...  docshell/shistory/nsSHistory.cpp:644
2  libxul.so  std::_Function_handler<void (mozilla::dom::BrowsingContext*), mozilla::dom::Cano...
3  libxul.so  mozilla::dom::BrowsingContext::PreOrderWalkVoid(std::function<void (mozilla::dom...  docshell/base/BrowsingContext.cpp:1443
4  libxul.so  mozilla::dom::BrowsingContext::PreOrderWalkVoid(std::function<void (mozilla::dom...  docshell/base/BrowsingContext.cpp:1449
5  libxul.so  mozilla::dom::CanonicalBrowsingContext::HistoryCommitIndexAndLength(nsID const&,...  docshell/base/CanonicalBrowsingContext.cpp:2865
6  libxul.so  nsSHistory::AddEntry(nsISHEntry*)  docshell/shistory/nsSHistory.cpp:941
7  libxul.so  NS_InvokeByIndex
8  libxul.so  XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode)  js/xpconnect/src/XPCWrappedNative.cpp:1118
9  libxul.so  XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)  js/xpconnect/src/XPCWrappedNativeJSOps.cpp:962

There is 1 crash in nightly 155 with buildid 20260805220233.

Clouseau analysis (confidence probable): The crash occurs inside nsSHistory::FindAdjacentEntryFor's ancestor walk (aEntry->GetParent()), reached via a nested HistoryCommitIndexAndLength → PreOrderWalk → WalkContiguousEntriesInOrder walk that only exists because bug 2042379 (node 7b3553f0a27f) added it, for navigation.entries() forward-truncation bookkeeping. That walk fires from ~SHistoryChangeNotifier, synchronously after nsSHistory::AddEntry has already mutated mEntries (TruncateLength), in a function (FindAdjacentEntryFor) whose own comments admit mEntries can be duplicated/inconsistent (bug 2042897, only partially guarded by bug 2039866). The Navigation API gate is enabled by default, so this path runs on every history commit, not rarely.

The 3 proximity-scored seed candidates (bug 2060131, JS JIT generator-resume) were diffed and ruled out as same-day-landing noise — none touch docshell/ or session-history code, and there is no plausible mechanism connecting JS resume-index JIT internals to a native nsSHistory walk. Widening past the seed list, file_history on the crashing files found no changeset near the crash's build date (2026-08-05) in this area at all; the closest structural match is 7b3553f0a27f, landed ~2.5 months earlier. It is not a fresh regression tied to this specific nightly, but it is the changeset that architecturally created the exact crashing call path, and it remains live and enabled today. This is best treated as a latent defect exposed by that 2026-05-29 change plus the still-unresolved bug 2042897 entry-consistency fragility, not a proven single-commit culprit.

Suspected regressor: 7b3553f0a27f (gh) (bug 2042379) by Andreas Farre.

Code references:

• docshell/base/CanonicalBrowsingContext.cpp:2857
• nsSHistory::AddEntry
• docshell/shistory/nsSHistory.cpp:2532
• js/src/jit/BaselineCodeGen.cpp

Andreas Farre, can you have a look please?

Comment 1

[BugBot [:suhaib / :marco]]

:calixte, since this bug is a regression, could you fill (if possible) the regressed_by field?
For more information, please visit BugBot documentation.