STR:

Go to https://paste.mozilla.org

Paste in text from https://gist.githubusercontent.com/AutomatedTester/1616894e0912b4846968d2440bb51d72/raw/dc29eb5aac84eb0462cd04bac88ed3645d5231b3/gistfile1.txt

Set the text type to text and set to keep for a week.

Click save. Tab or browser will crash

This bug is for crash report bp-cee1d3e4-f11a-4c79-8c94-a374f0191115.

Top 10 frames of crashing thread:

0 XUL mozilla::ipc::FatalError ipc/glue/ProtocolUtils.cpp:165
1 XUL mozilla::ipc::IProtocol::HandleFatalError const ipc/glue/ProtocolUtils.cpp:404
2 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::IPCRemoteStreamType> ipc/glue/IPDLParamTraits.h:68
3 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::IPCRemoteStreamParams> ipc/glue/IPDLParamTraits.h:68
4 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::InputStreamParams> ipc/glue/IPDLParamTraits.h:68
5 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::Maybe<mozilla::ipc::InputStreamParams> > ipc/glue/IPDLParamTraits.h:68
6 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::MIMEInputStreamParams> ipc/glue/IPDLParamTraits.h:68
7 XUL bool mozilla::ipc::ReadIPDLParam<mozilla::ipc::InputStreamParams> ipc/glue/IPDLParamTraits.h:68
8 XUL mozilla::ipc::IPDLParamTraits<mozilla::ipc::IPCStream>::Read ipc/ipdl/IPCStream.cpp:59
9 XUL mozilla::ipc::IPDLParamTraits<mozilla::Maybe<mozilla::ipc::IPCStream> >::Read ipc/glue/IPDLParamTraits.h:260

The crash reason is "IPC FatalError in the parent process!" which is not very useful.

More useful: IPCFatalErrorMsg is "Error deserializing variant TPChildToParentStreamChild of union IPCRemoteStreamType"

Probably failure to deserialize an actor reference; lifetime confusion, maybe?

So the failing message is to construct a PDocumentChannel managed by PNecko; this is from the child to the parent. However, PChildToParentStream is deleted from the parent to the child, so there could be a race condition there.

This seems to have something to do with DocumentChannel (see previous comment); it's not clear whether it's from bug 1556489 or something more recent, but let's start there.

Matt, is this dup of 1595578?

It is indeed!