Backed out 3 changesets (bug 1559244) for causing bug 1370046

Backed out changeset de76712278a6 (bug 1559244) Backed out changeset 467caef2ef9c (bug 1559244) Backed out changeset 17ab0c52dca0 (bug 1559244)
2025-02-26 20:30:41 +00:00 · 2019-07-25 17:42:32 +03:00 · 2019-07-25 17:42:32 +03:00 · fc92f585e2
commit fc92f585e2
parent f114ac3f4a
29 changed files with 71 additions and 245 deletions
--- a/browser/base/content/test/general/browser_restore_isAppTab.js
+++ b/browser/base/content/test/general/browser_restore_isAppTab.js
@ -48,7 +48,7 @@ var restart = async function(browser) {
  // Make sure the main process has all of the current tab state before crashing
  await TabStateFlusher.flush(browser);

-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  let tab = gBrowser.getTabForBrowser(browser);
  SessionStore.reviveCrashedTab(tab);
--- a/browser/base/content/test/tabcrashed/browser_autoSubmitRequest.js
+++ b/browser/base/content/test/tabcrashed/browser_autoSubmitRequest.js
@ -34,7 +34,7 @@ add_task(async function test_show_form() {
      await TabStateFlusher.flush(browser);

      // Now crash the browser.
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);

      let doc = browser.contentDocument;

@ -87,7 +87,7 @@ add_task(async function test_show_form() {
    async function(browser) {
      await TabStateFlusher.flush(browser);
      // Now crash the browser.
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);

      let doc = browser.contentDocument;

@ -138,7 +138,7 @@ add_task(async function test_no_offer() {
      prepareNoDump();

      // Now crash the browser.
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);

      let doc = browser.contentDocument;

--- a/browser/base/content/test/tabcrashed/browser_clearEmail.js
+++ b/browser/base/content/test/tabcrashed/browser_clearEmail.js
@ -37,7 +37,7 @@ add_task(async function test_clear_email() {
      prefs.setBoolPref("emailMe", true);

      let tab = gBrowser.getTabForBrowser(browser);
-      await BrowserTestUtils.crashFrame(
+      await BrowserTestUtils.crashBrowser(
        browser,
        /* shouldShowTabCrashPage */ true,
        /* shouldClearMinidumps */ false
--- a/browser/base/content/test/tabcrashed/browser_noPermanentKey.js
+++ b/browser/base/content/test/tabcrashed/browser_noPermanentKey.js
@ -20,7 +20,7 @@ add_task(async function test_without_dump() {
    async function(browser) {
      delete browser.permanentKey;

-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);
      let crashReport = promiseCrashReport();

      await ContentTask.spawn(browser, null, async function() {
--- a/browser/base/content/test/tabcrashed/browser_showForm.js
+++ b/browser/base/content/test/tabcrashed/browser_showForm.js
@ -27,7 +27,7 @@ add_task(async function test_show_form() {
      });

      // Now crash the browser.
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);

      let doc = browser.contentDocument;

--- a/browser/base/content/test/tabcrashed/browser_shown.js
+++ b/browser/base/content/test/tabcrashed/browser_shown.js
@ -58,7 +58,7 @@ function crashTabTestHelper(fieldValues, expectedExtra) {
      let originalEmail = prefs.getCharPref("email");

      let tab = gBrowser.getTabForBrowser(browser);
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);
      let doc = browser.contentDocument;

      // Since about:tabcrashed will run in the parent process, we can safely
--- a/browser/base/content/test/tabcrashed/browser_shownRestartRequired.js
+++ b/browser/base/content/test/tabcrashed/browser_shownRestartRequired.js
@ -23,7 +23,7 @@ function crashTabTestHelper() {
      // Simulate buildID mismatch.
      TabCrashHandler.testBuildIDMismatch = true;

-      await BrowserTestUtils.crashFrame(browser, false);
+      await BrowserTestUtils.crashBrowser(browser, false);
      let doc = browser.contentDocument;

      // Since about:restartRequired will run in the parent process, we can safely
--- a/browser/base/content/test/tabcrashed/browser_withoutDump.js
+++ b/browser/base/content/test/tabcrashed/browser_withoutDump.js
@ -18,7 +18,7 @@ add_task(async function test_without_dump() {
    },
    async function(browser) {
      let tab = gBrowser.getTabForBrowser(browser);
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);

      let tabClosingPromise = BrowserTestUtils.waitForTabClosing(tab);

--- a/browser/components/extensions/test/browser/browser_ext_port_disconnect_on_crash.js
+++ b/browser/components/extensions/test/browser/browser_ext_port_disconnect_on_crash.js
@ -47,7 +47,7 @@ add_task(async function connect_from_tab_to_bg_and_crash_tab() {
  await extension.awaitMessage("bg_runtime_onConnect");
  // Force the message manager to disconnect without giving the content a
  // chance to send an "Extension:Port:Disconnect" message.
-  await BrowserTestUtils.crashFrame(tab.linkedBrowser);
+  await BrowserTestUtils.crashBrowser(tab.linkedBrowser);
  await extension.awaitMessage("port_disconnected");
  BrowserTestUtils.removeTab(tab);
  await extension.unload();
@ -104,7 +104,7 @@ add_task(async function connect_from_bg_to_tab_and_crash_tab() {
  await extension.awaitMessage("tab_runtime_onConnect");
  // Force the message manager to disconnect without giving the content a
  // chance to send an "Extension:Port:Disconnect" message.
-  await BrowserTestUtils.crashFrame(tab.linkedBrowser);
+  await BrowserTestUtils.crashBrowser(tab.linkedBrowser);
  await extension.awaitMessage("port_disconnected");
  BrowserTestUtils.removeTab(tab);
  await extension.unload();
--- a/browser/components/sessionstore/test/browser_async_flushes.js
+++ b/browser/components/sessionstore/test/browser_async_flushes.js
@ -74,7 +74,7 @@ add_task(async function test_crash() {
  // the content process. The "crash" message makes it first so that we don't
  // get a chance to process the flush. The TabStateFlusher however should be
  // notified so that the flush still completes.
-  let promise1 = BrowserTestUtils.crashFrame(browser);
+  let promise1 = BrowserTestUtils.crashBrowser(browser);
  let promise2 = TabStateFlusher.flush(browser);
  await Promise.all([promise1, promise2]);

--- a/browser/components/sessionstore/test/browser_background_tab_crash.js
+++ b/browser/components/sessionstore/test/browser_background_tab_crash.js
@ -93,7 +93,7 @@ async function crashBackgroundTabs(tabs) {
    return promiseTabRestoring(t);
  });

-  await BrowserTestUtils.crashFrame(tabs[0].linkedBrowser, false);
+  await BrowserTestUtils.crashBrowser(tabs[0].linkedBrowser, false);
  await Promise.all(remotenessChangePromises);
  await Promise.all(tabsRevived);

@ -246,7 +246,7 @@ add_task(async function test_preload_crash() {
  // Create a fresh preloaded browser
  NewTabPagePreloading.maybeCreatePreloadedBrowser(window);

-  await BrowserTestUtils.crashFrame(gBrowser.preloadedBrowser, false);
+  await BrowserTestUtils.crashBrowser(gBrowser.preloadedBrowser, false);

  Assert.ok(!gBrowser.preloadedBrowser);
 });
--- a/browser/components/sessionstore/test/browser_crashedTabs.js
+++ b/browser/components/sessionstore/test/browser_crashedTabs.js
@ -150,7 +150,7 @@ add_task(async function test_crash_page_not_in_history() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  // Check the tab state and make sure the tab crashed page isn't
  // mentioned.
@ -182,7 +182,7 @@ add_task(async function test_revived_history_from_remote() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  // Browse to a new site that will cause the browser to
  // become remote again.
@ -230,7 +230,7 @@ add_task(async function test_revived_history_from_non_remote() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  // Browse to a new site that will not cause the browser to
  // become remote again.
@ -291,7 +291,7 @@ add_task(async function test_revive_tab_from_session_store() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);
  // Background tabs should not be crashed, but should be in the "to be restored"
  // state.
  ok(!newTab2.hasAttribute("crashed"), "Second tab should not be crashed.");
@ -355,7 +355,7 @@ add_task(async function test_revive_all_tabs_from_session_store() {
  await TabStateFlusher.flush(browser2);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);
  // Both tabs should now be crashed.
  is(newTab.getAttribute("crashed"), "true", "First tab should be crashed");
  is(
@ -408,7 +408,7 @@ add_task(async function test_close_tab_after_crash() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  let promise = BrowserTestUtils.waitForEvent(
    gBrowser.tabContainer,
@ -439,7 +439,7 @@ add_task(async function test_hide_restore_all_button() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  let doc = browser.contentDocument;
  let restoreAllButton = doc.getElementById("restoreAll");
@ -473,7 +473,7 @@ add_task(async function test_hide_restore_all_button() {
  let otherBrowserReady = promiseTabCrashedReady(otherWinBrowser);

  // Crash the first tab.
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);
  await otherBrowserReady;

  doc = browser.contentDocument;
@ -513,7 +513,7 @@ add_task(async function test_aboutcrashedtabzoom() {
  await TabStateFlusher.flush(browser);

  // Crash the tab
-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  ok(
    ZoomManager.getZoomForBrowser(browser) === 1,
--- a/browser/components/sessionstore/test/browser_revive_crashed_bg_tabs.js
+++ b/browser/components/sessionstore/test/browser_revive_crashed_bg_tabs.js
@ -37,7 +37,7 @@ add_task(async function test_revive_bg_tabs_on_demand() {

  // Now crash the selected tab
  let windowReady = BrowserTestUtils.waitForEvent(window, "SSWindowStateReady");
-  await BrowserTestUtils.crashFrame(browser1);
+  await BrowserTestUtils.crashBrowser(browser1);

  ok(newTab1.hasAttribute("crashed"), "Selected tab should be crashed");
  ok(!newTab2.hasAttribute("crashed"), "Background tab should not be crashed");
--- a/browser/components/sessionstore/test/browser_tabicon_after_bg_tab_crash.js
+++ b/browser/components/sessionstore/test/browser_tabicon_after_bg_tab_crash.js
@ -38,7 +38,7 @@ add_task(async function test_tabicon_after_bg_tab_crash() {
      );
      Assert.equal(browser.mIconURL, FAVICON, "Favicon is correctly set.");
      await BrowserTestUtils.switchTab(gBrowser, originalTab);
-      await BrowserTestUtils.crashFrame(
+      await BrowserTestUtils.crashBrowser(
        browser,
        false /* shouldShowTabCrashPage */
      );
--- a/browser/components/sessionstore/test/browser_unrestored_crashedTabs.js
+++ b/browser/components/sessionstore/test/browser_unrestored_crashedTabs.js
@ -44,7 +44,7 @@ add_task(async function test() {
      ok(unrestoredTab.hasAttribute("pending"), "tab is pending");

      // Now crash the selected browser.
-      await BrowserTestUtils.crashFrame(browser);
+      await BrowserTestUtils.crashBrowser(browser);

      ok(!unrestoredTab.hasAttribute("crashed"), "tab is still not crashed");
      ok(unrestoredTab.hasAttribute("pending"), "tab is still pending");
--- a/dom/base/ChromeUtils.cpp
+++ b/dom/base/ChromeUtils.cpp
@ -14,7 +14,6 @@
 #include "mozilla/Base64.h"
 #include "mozilla/BasePrincipal.h"
 #include "mozilla/CycleCollectedJSRuntime.h"
-#include "mozilla/IntentionalCrash.h"
 #include "mozilla/PerformanceMetricsCollector.h"
 #include "mozilla/PerfStats.h"
 #include "mozilla/Preferences.h"
@ -1119,15 +1118,5 @@ bool ChromeUtils::IsClassifierBlockingErrorCode(GlobalObject& aGlobal,
      static_cast<nsresult>(aError));
 }

-/* static */
-void ChromeUtils::PrivateNoteIntentionalCrash(const GlobalObject& aGlobal,
-                                              ErrorResult& aError) {
-  if (XRE_IsContentProcess()) {
-    NoteIntentionalCrash("tab");
-    return;
-  }
-  aError.Throw(NS_ERROR_NOT_IMPLEMENTED);
-}
-
 }  // namespace dom
 }  // namespace mozilla
--- a/dom/base/ChromeUtils.h
+++ b/dom/base/ChromeUtils.h
@ -192,9 +192,6 @@ class ChromeUtils {

  static bool IsClassifierBlockingErrorCode(GlobalObject& aGlobal,
                                            uint32_t aError);
-
-  static void PrivateNoteIntentionalCrash(const GlobalObject& aGlobal,
-                                          ErrorResult& aError);
 };

 }  // namespace dom
--- a/dom/chrome-webidl/ChromeUtils.webidl
+++ b/dom/chrome-webidl/ChromeUtils.webidl
@ -427,14 +427,6 @@ partial namespace ChromeUtils {
  [ChromeOnly]
  // aError should a nsresult.
  boolean isClassifierBlockingErrorCode(unsigned long aError);
-
-  /**
-   * If leak detection is enabled, print a note to the leak log that this
-   * process will intentionally crash. This should be called only on child
-   * processes for testing purpose.
-   */
-  [ChromeOnly, Throws]
-  void privateNoteIntentionalCrash();
 };

 /**
--- a/dom/ipc/tests/browser.ini
+++ b/dom/ipc/tests/browser.ini
@ -4,8 +4,6 @@ support-files =
  file_domainPolicy_base.html
  file_cancel_content_js.html

-[browser_crash_oopiframe.js]
-skip-if = true # Disabled until bug 1566196 is fixed
 [browser_domainPolicy.js]
 skip-if = fission
 [browser_memory_distribution_telemetry.js]
--- a/dom/ipc/tests/browser_crash_oopiframe.js
+++ b/dom/ipc/tests/browser_crash_oopiframe.js
@ -1,90 +0,0 @@
-"use strict";
-
-/**
- * In this test, we crash an out-of-process iframe and
- * verify that :
- *  1. the "oop-browser-crashed" event is dispatched with
- *     the browsing context of the crashed oop subframe.
- *  2. the crashed subframe is now pointing at "about:framecrashed"
- *     page.
- */
-add_task(async function() {
-  // Open a new window with fission enabled.
-  let win = await BrowserTestUtils.openNewBrowserWindow({
-    remote: true,
-    fission: true,
-  });
-
-  // Wait for the provided URL to load in our browser.
-  let url = "about:blank";
-  let browser = win.gBrowser.selectedBrowser;
-  BrowserTestUtils.loadURI(browser, url);
-  await BrowserTestUtils.browserLoaded(browser, false, url);
-
-  let rootBC = browser.browsingContext;
-
-  // Create an oop iframe.
-  let iframeID = await SpecialPowers.spawn(browser, [], async () => {
-    let iframe = content.document.createElement("iframe");
-    iframe.setAttribute("fission", "true");
-    iframe.setAttribute("src", "http://example.com");
-
-    const { ContentTaskUtils } = ChromeUtils.import(
-      "resource://testing-common/ContentTaskUtils.jsm"
-    );
-
-    content.document.body.appendChild(iframe);
-    await ContentTaskUtils.waitForEvent(iframe, "load");
-
-    let iframeBC = iframe.frameLoader.browsingContext;
-    return iframeBC.id;
-  });
-
-  let iframeBC = BrowsingContext.get(iframeID);
-  is(iframeBC.parent, rootBC, "oop frame has root as parent");
-
-  BrowserTestUtils.crashFrame(
-    browser,
-    true /* shouldShowTabCrashPage */,
-    true /* shouldClearMinidumps */,
-    iframeBC
-  );
-
-  let eventFiredPromise = BrowserTestUtils.waitForEvent(
-    browser,
-    "oop-browser-crashed"
-  );
-
-  await eventFiredPromise.then(event => {
-    isnot(
-      event.browsingContextId,
-      rootBC,
-      "top frame browsing context id not expected."
-    );
-
-    is(
-      event.browsingContextId,
-      iframeBC.id,
-      "oop frame browsing context id expected."
-    );
-  });
-
-  info("Wait for a new browsing context to get attached to our oop iframe.");
-  await BrowserTestUtils.waitForCondition(
-    () => rootBC.getChildren()[0] != iframeBC
-  );
-
-  let newIframeBC = rootBC.getChildren()[0];
-  let newIframeURI = await SpecialPowers.spawn(
-    newIframeBC,
-    [],
-    () => content.document.documentURI
-  );
-
-  ok(
-    newIframeURI.startsWith("about:framecrashed"),
-    "The iframe is now pointing at about:framecrashed"
-  );
-
-  await BrowserTestUtils.closeWindow(win);
-});
--- a/dom/ipc/tests/process_error.xul
+++ b/dom/ipc/tests/process_error.xul
@ -46,7 +46,7 @@
           "Expected the right browsing context id on the oop-browser-crashed event.");
      })

-      BrowserTestUtils.crashFrame(browser, true, false);
+      BrowserTestUtils.crashBrowser(browser, true, false);

      Promise.all([observerPromise, eventPromise]).then(done);
    });
--- a/netwerk/test/browser/browser_child_resource.js
+++ b/netwerk/test/browser/browser_child_resource.js
@ -86,7 +86,7 @@ var restart = async function() {
    return browser;
  }

-  await BrowserTestUtils.crashFrame(browser);
+  await BrowserTestUtils.crashBrowser(browser);

  browser.reload();

--- a/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
+++ b/testing/mochitest/BrowserTestUtils/BrowserTestUtils.jsm
@ -87,23 +87,6 @@ var gSynthesizeCompositionChangeCount = 0;
 const kAboutPageRegistrationContentScript =
  "chrome://mochikit/content/tests/BrowserTestUtils/content-about-page-utils.js";

-/**
- * Create and register BrowserTestUtils Window Actor.
- */
-function registerActor() {
-  let actorOptions = {
-    child: {
-      moduleURI: "resource://testing-common/BrowserTestUtilsChild.jsm",
-    },
-
-    allFrames: true,
-    includeChrome: true,
-  };
-  ChromeUtils.registerWindowActor("BrowserTestUtils", actorOptions);
-}
-
-registerActor();
-
 var BrowserTestUtils = {
  /**
   * Loads a page in a new tab, executes a Task and closes the tab.
@ -1595,7 +1578,7 @@ var BrowserTestUtils = {
  },

  /**
-   * Crashes a remote frame tab and cleans up the generated minidumps.
+   * Crashes a remote browser tab and cleans up the generated minidumps.
   * Resolves with the data from the .extra file (the crash annotations).
   *
   * @param (Browser) browser
@ -1606,19 +1589,15 @@ var BrowserTestUtils = {
   *        tab crash page has loaded.
   * @param (bool) shouldClearMinidumps
   *        True if the minidumps left behind by the crash should be removed.
-   * @param (BrowsingContext) browsingContext
-   *        The context where the frame leaves. Default to
-   *        top level context if not supplied.
   *
   * @returns (Promise)
   * @resolves An Object with key-value pairs representing the data from the
   *           crash report's extra file (if applicable).
   */
-  async crashFrame(
+  async crashBrowser(
    browser,
    shouldShowTabCrashPage = true,
-    shouldClearMinidumps = true,
-    browsingContext
+    shouldClearMinidumps = true
  ) {
    let extra = {};
    let KeyValueParser = {};
@ -1661,6 +1640,26 @@ var BrowserTestUtils = {
      }
    }

+    // This frame script is injected into the remote browser, and used to
+    // intentionally crash the tab. We crash by using js-ctypes and dereferencing
+    // a bad pointer. The crash should happen immediately upon loading this
+    // frame script.
+    let frame_script = () => {
+      const { ctypes } = ChromeUtils.import(
+        "resource://gre/modules/ctypes.jsm"
+      );
+
+      let dies = function() {
+        privateNoteIntentionalCrash();
+        let zero = new ctypes.intptr_t(8);
+        let badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
+        badptr.contents;
+      };
+
+      dump("\nEt tu, Brute?\n");
+      dies();
+    };
+
    let expectedPromises = [];

    let crashCleanupPromise = new Promise((resolve, reject) => {
@ -1752,12 +1751,10 @@ var BrowserTestUtils = {
      );
    }

-    // Trigger crash by sending a message to BrowserTestUtils actor.
-    BrowserTestUtils.sendAsyncMessage(
-      browsingContext || browser.browsingContext,
-      "BrowserTestUtils:CrashFrame",
-      {}
-    );
+    // This frame script will crash the remote browser as soon as it is
+    // evaluated.
+    let mm = browser.messageManager;
+    mm.loadFrameScript("data:,(" + frame_script.toString() + ")();", false);

    await Promise.all(expectedPromises);

@ -2190,25 +2187,4 @@ var BrowserTestUtils = {
    }
    return tabbrowser.addTab(uri, params);
  },
-
-  /**
-   * Sends a message to a specific BrowserTestUtils window actor.
-   * @param aBrowsingContext
-   *        The browsing context where the actor lives.
-   * @param {string} aMessageName
-   *        Name of the message to be sent to the actor.
-   * @param {object} aMessageData
-   *        Extra information to pass to the actor.
-   */
-  async sendAsyncMessage(aBrowsingContext, aMessageName, aMessageData) {
-    if (!aBrowsingContext.currentWindowGlobal) {
-      await TestUtils.waitForCondition(
-        () => aBrowsingContext.currentWindowGlobal
-      );
-    }
-    let actor = aBrowsingContext.currentWindowGlobal.getActor(
-      "BrowserTestUtils"
-    );
-    actor.sendAsyncMessage(aMessageName, aMessageData);
-  },
 };
--- a/testing/mochitest/BrowserTestUtils/BrowserTestUtilsChild.jsm
+++ b/testing/mochitest/BrowserTestUtils/BrowserTestUtilsChild.jsm
@ -1,34 +0,0 @@
-/* vim: set ts=2 sw=2 sts=2 et tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-"use strict";
-
-var EXPORTED_SYMBOLS = ["BrowserTestUtilsChild"];
-
-class BrowserTestUtilsChild extends JSWindowActorChild {
-  receiveMessage(aMessage) {
-    switch (aMessage.name) {
-      case "BrowserTestUtils:CrashFrame": {
-        // This is to intentionally crash the frame.
-        // We crash by using js-ctypes and dereferencing
-        // a bad pointer. The crash should happen immediately
-        // upon loading this frame script.
-
-        const { ctypes } = ChromeUtils.import(
-          "resource://gre/modules/ctypes.jsm"
-        );
-
-        let dies = function() {
-          ChromeUtils.privateNoteIntentionalCrash();
-          let zero = new ctypes.intptr_t(8);
-          let badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
-          badptr.contents;
-        };
-
-        dump("\nEt tu, Brute?\n");
-        dies();
-      }
-    }
-  }
-}
--- a/testing/mochitest/BrowserTestUtils/moz.build
+++ b/testing/mochitest/BrowserTestUtils/moz.build
@ -6,7 +6,6 @@

 TESTING_JS_MODULES += [
    'BrowserTestUtils.jsm',
-    'BrowserTestUtilsChild.jsm',
    'content/content-task.js',
    'ContentTask.jsm',
    'ContentTaskUtils.jsm',
--- a/toolkit/components/extensions/test/xpcshell/test_ext_background_early_shutdown.js
+++ b/toolkit/components/extensions/test/xpcshell/test_ext_background_early_shutdown.js
@ -2,10 +2,6 @@
 /* vim: set sts=2 sw=2 et tw=80: */
 "use strict";

-const { BrowserTestUtils } = ChromeUtils.import(
-  "resource://testing-common/BrowserTestUtils.jsm"
-);
-
 AddonTestUtils.init(this);
 AddonTestUtils.overrideCertDB();
 AddonTestUtils.createAppInfo(
@ -32,19 +28,22 @@ let { Management } = ChromeUtils.import(
 );

 // Crashes a <browser>'s remote process.
-// Based on BrowserTestUtils.crashFrame.
-function crashFrame(browser) {
+// Based on BrowserTestUtils.crashBrowser.
+function crashBrowser(browser) {
  if (!browser.isRemoteBrowser) {
    // The browser should be remote, or the test runner would be killed.
    throw new Error("<browser> must be remote");
  }

-  // Trigger crash by sending a message to BrowserTestUtils actor.
-  BrowserTestUtils.sendAsyncMessage(
-    browser.browsingContext,
-    "BrowserTestUtils:CrashFrame",
-    {}
-  );
+  let frameScript = () => {
+    const { ctypes } = ChromeUtils.import("resource://gre/modules/ctypes.jsm");
+    privateNoteIntentionalCrash(); /* eslint-disable-line no-undef */
+    let zero = new ctypes.intptr_t(8);
+    let badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
+    dump("Intentionally crashing extension process...\n");
+    badptr.contents; /* eslint-disable-line no-unused-expressions */
+  };
+  browser.messageManager.loadFrameScript(`data:,(${frameScript})();`, false);
 }

 // Verifies that a delayed background page is not loaded when an extension is
@ -164,7 +163,7 @@ add_task(async function test_unload_extension_during_background_page_startup() {

        // And force the extension process to crash.
        if (browser.isRemote) {
-          crashFrame(browser);
+          crashBrowser(browser);
        } else {
          // If extensions are not running in out-of-process mode, then the
          // non-remote process should not be killed (or the test runner dies).
--- a/toolkit/components/thumbnails/test/browser_thumbnails_bg_crash_during_capture.js
+++ b/toolkit/components/thumbnails/test/browser_thumbnails_bg_crash_during_capture.js
@ -47,7 +47,7 @@ function* runTests() {
  });

  info("Crashing the thumbnail content process.");
-  let crash = yield BrowserTestUtils.crashFrame(
+  let crash = yield BrowserTestUtils.crashBrowser(
    BackgroundPageThumbs._thumbBrowser,
    false
  );
--- a/toolkit/components/thumbnails/test/browser_thumbnails_bg_crash_while_idle.js
+++ b/toolkit/components/thumbnails/test/browser_thumbnails_bg_crash_while_idle.js
@ -10,7 +10,7 @@ function* runTests() {

  // Nothing is pending - crash the process.
  info("Crashing the thumbnail content process.");
-  let crash = yield BrowserTestUtils.crashFrame(
+  let crash = yield BrowserTestUtils.crashBrowser(
    BackgroundPageThumbs._thumbBrowser,
    false
  );
--- a/toolkit/content/tests/browser/browser_content_url_annotation.js
+++ b/toolkit/content/tests/browser/browser_content_url_annotation.js
@ -73,7 +73,7 @@ add_task(async function test_content_url_annotation() {
      await promise;

      // Crash the tab
-      let annotations = await BrowserTestUtils.crashFrame(browser);
+      let annotations = await BrowserTestUtils.crashBrowser(browser);

      ok("URL" in annotations, "annotated a URL");
      is(