This bug is for crash report bp-aad634e7-bdd7-4d14-9254-262f10190619.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::BrowsingContextGroup::EnsureSubscribed docshell/base/BrowsingContextGroup.cpp:76
1 xul.dll nsresult mozilla::dom::BrowserBridgeParent::Init dom/ipc/BrowserBridgeParent.cpp:63
2 xul.dll mozilla::dom::BrowserParent::RecvPBrowserBridgeConstructor dom/ipc/BrowserParent.cpp:1246
3 xul.dll mozilla::dom::PBrowserParent::OnMessageReceived ipc/ipdl/PBrowserParent.cpp:2863
4 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:5576
5 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2082
6 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1970
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1225
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:486
9 xul.dll void mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:88

Affected Versions:

• Firefox 69.0a1 (BuildId:20190618214619).

Affected Platforms:

• Windows 10 64bit.
• Windows 7 64bit.

Steps to Reproduce:

1. Launch Firefox with a clean profile.
2. Access the about:config page.
3. Create the fission.autostart pref and set it to true.
4. Access the facebook.com webpage.
5. Log in with valid credentials.

Expected Result:

• The website is successfully displayed and Firefox is stable.

Actual Result:

• Firefox Crashes.

And this is also because of Bug 1555287.

Reopening since I got this crash on buildid:20190629100032 with enabling fission. bp-91f41329-f620-4f90-bb0a-301b20190629

Updating 70 as affected. I saw this signature in the nightly triage. We are still getting crashes on 70 but most appear to be single installation crashes.

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #3)

Updating 70 as affected. I saw this signature in the nightly triage. We are still getting crashes on 70 but most appear to be single installation crashes.

Marcia, did you see Fission enabled on these signatures? Until bug 1563317 is fixed, we cannot search for it, but I think you can.

(In reply to Neha Kochar [:neha] from comment #4)

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #3)

Updating 70 as affected. I saw this signature in the nightly triage. We are still getting crashes on 70 but most appear to be single installation crashes.

Marcia, did you see Fission enabled on these signatures? Until bug 1563317 is fixed, we cannot search for it, but I think you can.

All of these crashes have this correlation: (100.0% in signature vs 00.05% overall) moz_crash_reason = MOZ_RELEASE_ASSERT(inits.Length() == mContexts.Count()) (Visited the wrong number of contexts!)

I am not sure if that is what I am supposed to see when Fission is enabled - I couldn't find anything in Bug 1560977 which stated exactly what the correlation will say.

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #5)

I am not sure if that is what I am supposed to see when Fission is enabled - I couldn't find anything in Bug 1560977 which stated exactly what the correlation will say.

Under the Metadata tab, the crash report will have DOMFissionEnabled = 1 if Fission is enabled.

I looked at reports from 5 different install times, and they all had Fission enabled.

(In reply to Andrew McCreight [:mccr8] from comment #6)

(In reply to Marcia Knous [:marcia - needinfo? me] from comment #5)

I am not sure if that is what I am supposed to see when Fission is enabled - I couldn't find anything in Bug 1560977 which stated exactly what the correlation will say.

Under the Metadata tab, the crash report will have DOMFissionEnabled = 1 if Fission is enabled.

I looked at reports from 5 different install times, and they all had Fission enabled.

Thanks for the confirmation, Andrew.

Changing platform to all since I see Mac and Linux crashes as well in nightly triage.

Low volume crash, marking fix-optional to remove this from weekly triage.

Another crash report for this: https://crash-stats.mozilla.org/report/index/9b482a7b-285f-4b6f-b7dc-187350190903 seen with fission enabled.

This signature is also seen in mochitests-fission failures.

NI'ing farre to look into this as this is also seen in M-fis failures (bug 1571698).

To be able to reach all BrowsingContexts in
BrowsingContextGroup::EnsureSubscribed we need to make sure that if a
BrowsingContext is detached, we need to cache all of its children in
case we call BrowsingContextGroup::EnsureSubscribed before the
children in turn are detached.

https://hg.mozilla.org/mozilla-central/rev/ccfb50e42937
https://hg.mozilla.org/mozilla-central/rev/0e84d46d732a

Hello,

Confirming this issue as verified fixed on 71.0a1(20190912094122) and 72.0a1 (BuildID:20191103213857). Verified on Windows 10x64, macOS 10.14 and Ubuntu 18.04.