rr crashes during replay

I have an rr-recording that I keep getting crashes when I execute something like p aNode->IsContent().

[New Thread 1771423.1771536]
rr(_ZN2rr13dump_rr_stackEv+0x47)[0x55c94145c4b0]
rr(_ZN2rr9GdbServer15emergency_debugEPNS_4TaskE+0xf7)[0x55c94124e275]
rr(+0x41b7bf)[0x55c9412867bf]
rr(_ZN2rr21EmergencyDebugOstreamD1Ev+0x5f)[0x55c941286a51]
rr(+0x35eadd)[0x55c9411c9add]
rr(_ZN2rr18AutoRemoteSyscalls12send_fd_archINS_7X64ArchEEEiRKNS_8ScopedFdE+0x191)[0x55c9411cea0b]
rr(_ZN2rr18AutoRemoteSyscalls7send_fdERKNS_8ScopedFdE+0xab)[0x55c9411c78b9]
rr(_ZN2rr18AutoRemoteSyscalls27infallible_send_fd_if_aliveERKNS_8ScopedFdE+0x33)[0x55c9411c796f]
rr(_ZN2rr7Session18create_shared_mmapERNS_18AutoRemoteSyscallsEmNS_10remote_ptrIvEEPKciiSt10shared_ptrINS_21MonitoredSharedMemoryEE+0x5ef)[0x55c9413ebad9]
rr(_ZN2rr12AddressSpace13post_vm_cloneEPNS_4TaskE+0xff)[0x55c94119e38b]
rr(_ZN2rr4Task13post_vm_cloneENS0_11CloneReasonEiPS0_+0x48)[0x55c941419ae0]
rr(_ZN2rr4Task5cloneENS0_11CloneReasonEiNS_10remote_ptrIvEES3_NS2_IiEEiijPNS_7SessionESt10shared_ptrINS_7FdTableEES7_INS_11ThreadGroupEE+0xdef)[0x55c94141984d]
rr(_ZN2rr4Task8os_cloneENS0_11CloneReasonEPNS_7SessionERNS_18AutoRemoteSyscallsEijjSt10shared_ptrINS_7FdTableEES6_INS_11ThreadGroupEENS_10remote_ptrIvEENSB_IiEESC_SD_+0x203)[0x55c94141e197]
rr(_ZN2rr4Task12os_fork_intoEPNS_7SessionESt10shared_ptrINS_7FdTableEE+0x139)[0x55c941419c55]
rr(_ZN2rr7Session13copy_state_toERS0_RNS_5EmuFsES3_+0x342)[0x55c9413ece98]
rr(_ZN2rr13ReplaySession15clone_diversionEv+0x21a)[0x55c94138e5cc]
rr(_ZN2rr9GdbServer6divertERNS_13ReplaySessionE+0xff)[0x55c941249283]
rr(_ZN2rr9GdbServer25process_debugger_requestsENS0_11ReportStateE+0x1ab)[0x55c9412499c1]
rr(_ZN2rr9GdbServer14debug_one_stepERNS_10GdbRequestE+0x17f)[0x55c94124a887]
rr(_ZN2rr9GdbServer12serve_replayERKNS0_15ConnectionFlagsE+0x5aa)[0x55c94124d3a8]
rr(+0x51fe10)[0x55c94138ae10]
rr(_ZN2rr13ReplayCommand3runERSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS7_EE+0x41b)[0x55c94138b7e7]
rr(main+0x278)[0x55c941296798]
/usr/lib/libc.so.6(+0x23790)[0x7f70d16e6790]
/usr/lib/libc.so.6(__libc_start_main+0x8a)[0x7f70d16e684a]
rr(_start+0x25)[0x55c941192735]
=== End rr backtrace
Launch gdb with
  gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:34200' /home/sefeng/.local/share/rr/firefox-0/mmap_hardlink_4_firefox

I am happy to provide more info about this.

Begin with the supplied rr replay command and reproduce p aNode->IsContent() in GDB. Trace the failure through GdbServer::divert, ReplaySession::clone_diversion, Session::copy_state_to, and Task::clone; done is a reproducible diagnosis and resolution of the replay crash.