Closed Bug 1560106 Opened 5 years ago Closed 5 years ago

[Fission] Crash in [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext]

Categories

(Core :: DOM: Navigation, defect, P2)

69 Branch
All
Windows
defect

Tracking

()

RESOLVED FIXED
mozilla70
Fission Milestone M5
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox67 --- unaffected
firefox67.0.1 --- unaffected
firefox68 --- unaffected
firefox69 --- disabled
firefox70 --- fixed

People

(Reporter: emilghitta, Assigned: u608768)

References

Details

(Keywords: crash, Whiteboard: m4-browsing)

Crash Data

This bug is for crash report bp-d3edca6f-7830-4980-ae4c-a1b320190619.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren dom/ipc/ContentParent.cpp:5850
1 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:10639
2 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
3 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1970
4 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
5 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
6 xul.dll void mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:88
7 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:308
8 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:290
9 xul.dll nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137

Affected Versions:

  • Firefox 69.0a1 (BuildId:20190618214619).

Affected Platforms:

  • Windows 10 64bit.
  • Windows 7 64bit.

Steps to Reproduce:

  1. Launch Firefox.
  2. Access the about:config page.
  3. Create the fission.autostart pref and set it to true.
  4. Access the following link.
  5. Wait a couple of seconds.

Expected Result:

  • The website is successfully displayed and Firefox is stable.

Actual Result:

  • Firefox Crashes.

I ran into this on resizing cnn.com on Mac

Even just scrolling around cnn.com seemed to cause this.

Fission Milestone: --- → ?

I can reliably reproduce by just loading reddit.com/r/videos.

This should probably block m4

Flags: needinfo?(nkochar)
Fission Milestone: ? → M4
Component: General → Document Navigation
Flags: needinfo?(nkochar)
Priority: -- → P2

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression

Not a regression because it is only happening with fission enabled.

Keywords: regression

ni'ing farre for helping Kashav with the cause and explanation.

Assignee: nobody → kmadan
Flags: needinfo?(afarre)

Adding another signature with the same Moz Crash Reason, MOZ_RELEASE_ASSERT(false) (Trying to detach out of process context) .

Crash Signature: [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] → [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext]

This could also be because of bug 1555287.

Flags: needinfo?(afarre)

Bug 1555287 has been backed out so let's keep an eye if the signature disappears.

No longer blocks: fission

mozilla::dom::ContentParent::RecvDetachBrowsingContext continues to be seen.

https://crash-stats.mozilla.org/report/index/fbc892f5-5d16-4efa-bdec-b8d5b0190625

We also experienced a tab crash with the same signature [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren ] while scrolling the main page of Reddit on Windows 10x64 with the latest FF Nightly. (2019-06-27)

(In reply to Vlad Lucaci, QA (:vlucaci) from comment #12)

https://crash-stats.mozilla.org/report/index/fbc892f5-5d16-4efa-bdec-b8d5b0190625

We also experienced a tab crash with the same signature [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren ] while scrolling the main page of Reddit on Windows 10x64 with the latest FF Nightly. (2019-06-27)

The BuildId in this crash is 20190624213657. RecvDetachBrowsingContextChildren was backed out on the 24th, so you should not see this signature in the latest Nightly (you may still see mozilla::dom::ContentParent::RecvDetachBrowsingContext).

I'm able to reliably reproduce the crash at mozilla::dom::ContentParent::RecvDetachBrowsingContext when just scrolling up and down for 3 secs on cnn.com

Summary: [Fission] Crash in [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] → [Fission] Crash in [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext]
Crash Signature: [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext] → [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext(mozilla::dom::BrowsingContext *)]
Crash Signature: [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext(mozilla::dom::BrowsingContext *)] → [@ mozilla::dom::ContentParent::RecvDetachBrowsingContextChildren] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext] [@ mozilla::dom::ContentParent::RecvDetachBrowsingContext(mozilla::dom::BrowsingContext *)]
Whiteboard: m4-browsing

This parent process crash should be fixed by bug 1563619. The problem here is that subframe crashes are crashing the parent process, so fixing 1563619 will probably reveal a number of new child process crashes.

Depends on: 1563619
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Fission Milestone: M4 → M5
You need to log in before you can comment on or make changes to this bug.