Closed Bug 1575163 Opened 5 years ago Closed 5 years ago

[Fission] Crash in [@ mozilla::ipc::IPDLParamTraits<T>::Write]

Categories

(Core :: DOM: Navigation, defect, P2)

70 Branch
defect

Tracking

()

VERIFIED FIXED
mozilla71
Fission Milestone M4
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox67 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 - disabled
firefox71 - verified
firefox72 --- verified

People

(Reporter: emilghitta, Assigned: nika)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-40090b34-f6c0-442f-97d0-da1d20190820.

Top 10 frames of crashing thread:

0 xul.dll static void mozilla::ipc::IPDLParamTraits<mozilla::dom::BrowsingContext*>::Write docshell/base/BrowsingContext.cpp:1097
1 xul.dll mozilla::dom::PContentChild::SendWindowPostMessage ipc/ipdl/PContentChild.cpp:7278
2 xul.dll mozilla::dom::BrowsingContext::PostMessageMoz docshell/base/BrowsingContext.cpp:918
3 xul.dll static bool mozilla::dom::Window_Binding::postMessage dom/bindings/WindowBinding.cpp
4 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::CrossOriginThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3163
5 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:539
6 xul.dll Interpret js/src/vm/Interpreter.cpp:3084
7 xul.dll js::RunScript js/src/vm/Interpreter.cpp:424
8 xul.dll js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:567
9 xul.dll js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:3229

Affected Versions:

Firefox 70.0a1 (BuildId:20190819215716).

Steps to Reproduce:

  1. Launch Firefox with a fresh profile.
  2. Enable Fission.
  3. Access the following website.
  4. Scroll down through the recent posts.

Expected Result:

The website is successfully displayed and Firefox is stable.

Actual Result:

At some point the recent posts are no longer visible (some portions of the website becomes blank) and a tab crash occurs.

Related to bug 1516240? Nika's away but maybe mccr8 (AFAICT he reviewed patches in bug 1516240) has thoughts?

Flags: needinfo?(continuation)

The crash here is a release assert:
MOZ_RELEASE_ASSERT(!aParam->IsDiscarded()) (Cannot send discarded BrowsingContext between processes!)

I feel like I've seen other Fission crashes with that assertion, but I don't remember exactly where. Andreas is more familiar with browsing context stuff than I am.

Flags: needinfo?(continuation) → needinfo?(afarre)
See Also: → 1579437

Another bug was reported (and fixed) with the same crash id (Bug 1579437) but I am still reproducing this crash with Fission enabled on Firefox 71.0a1 (BuildId:20190910032956) - which contains the fix for Bug 1579437.

bp-bdf36d89-8f94-456c-b921-f0ab10190910

Occurred while navigating through tripadvisor

The volume of crashes is high on both beta and nightly and Fission is not enabled by default, Neha can we get this bug triaged and get the confirmation that this is a crash we won't ship to our users when 70 ships? Thanks

Flags: needinfo?(nkochar)

The crash on beta has the same assertion: MOZ_RELEASE_ASSERT(!aParam->IsDiscarded()) (Cannot send discarded BrowsingContext between processes!)

However, Fission is not enabled on beta, and the crash reports I looked at didn't have Fission enabled, so it does look like something that would affect release users.

Nika added this assert. Maybe she has a theory as to why this is happening without Fission.

Flags: needinfo?(nika)

I think this is the same issue as bug 1579437. This should be fixed when we uplift those changes.

Flags: needinfo?(nika)
Status: NEW → RESOLVED
Closed: 5 years ago
Flags: needinfo?(nkochar)
Flags: needinfo?(afarre)
Resolution: --- → DUPLICATE

I am still hitting this crash on Firefox 71.0a1 (BuildId:20190910213950) with Fission pref enabled. (See Comment 3 as well)
bp-f6c29400-03ac-416f-9e42-cd3710190911

I was not able to reproduce this crash on Firefox beta or Nightly with fission disabled. Only on Firefox Nightly with Fission enabled.

I was able to reproduce this (https://crash-stats.mozilla.org/report/index/0a3e0491-6e85-4fcd-a6e8-0ef7d0190911) with latest Nightly while navigating through tripadvisor with Fission enabled.

Status: RESOLVED → REOPENED
Resolution: DUPLICATE → ---
Assignee: nobody → kmaglione+bmo

(note) This bug is re-opened for Fission only - the non-fission case should be fixed.

Pascal, the crashes on beta without Fission should be fixed once the patch for bug 1579437 gets uplifted. The issue being tracked on this bug is specifically only with Fission enabled, so we probably don't need to track this bug for the releases.

Flags: needinfo?(pascalc)
Priority: -- → P2
Fission Milestone: --- → M4
Pushed by nlayzell@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/74853f54a5a7
Dont send PostMessage events to a discarded BrowsingContext, r=farre
Assignee: kmaglione+bmo → nika
Status: REOPENED → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 5 years ago5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71

Hello,
Confirming this issue as verified fixed on 71.0a(BuildID:120191010092637) and 72.0a1 (BuildID:20191103213857). Verified on Windows 10x64, macOS 10.14 and Ubuntu 18.04.

Status: RESOLVED → VERIFIED
Flags: qe-verify+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: