1314032 - Crash in mozilla::dom::DOMIntersectionObserver::Update

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[nayinain]

This bug was filed from the Socorro interface and is 
report bp-b17928c2-4a65-44c9-902a-9489f2161031.
=============================================================
Steps to reproduce:

1. Run the following code in Web console (Shift-Ctrl-K).

window.open(URL.createObjectURL(new Blob([
'<meta charset="utf-8">\
<script>\
  let observer = new IntersectionObserver(([entry]) => {\
    document.body.textContent += entry.time\
  });\
  observer.observe(document.documentElement);\
</script>'
], {'type': 'text/html'})));

2. Allow pop-ups If needed.



Actual results:
Browser crash.

Comment 1

[Andrew McCreight [:mccr8]]

I just hit this in Nightly, too. Can you take a look at this, Tobias? Thanks.

Comment 2

[Andrew McCreight [:mccr8]]

This is currently 56% of all Windows crashes for the 10-31 Nightly. Please try to fix this or back out ASAP.

Comment 3

[Andrew McCreight [:mccr8]]

Err, I meant that for bug 1314059.

Comment 5

[Andrew McCreight [:mccr8]]

[Tracking Requested - why for this release]: high volume crash

Comment 7

[Tobias Schneider [:tobytailor]]

Looking into it

Comment 8

[Tobias Schneider [:tobytailor]]

Attachment: Add checks for cases rootFrame shouldn't be null

Comment 9

[Tobias Schneider [:tobytailor]]

Thanks for the fast review!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1e58a5a4ba4a
Add null checks to fix crash in mozilla::dom::DOMIntersectionObserver::Update. r=mstange

Comment 11

[Marcia Knous [:marcia]]

Tracking 52+ high volume crash that is new in nightly.

Comment 12

[Tobias Schneider [:tobytailor]]

Try run: https://treeherder.mozilla.org/#/jobs?repo=try&revision=97f86b077ca5&selectedJob=30186690

Comment 13

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/1e58a5a4ba4a

Comment 14

[Andrew McCreight [:mccr8]]

This is still a top crash on Nightly. For instance, this crash is from the November 6 Nightly:
  bp-e76cc856-efe5-4ac5-a9e0-367da2161106

Should a new bug get filed for these crashes, or does this need to be reopened?

Comment 15

[Kohei Yoshino [:kohei]]

Yeah, I'm encountering crashes and sending reports from Nightly while testing my app that I've just added some Intersection Observer API code [1]. The crash is intermittent; sometimes it happens in a few seconds after the app launched, but not always.

[1] https://github.com/bzdeck/bzdeck/commit/6dc07fc

Comment 16

[Tobias Schneider [:tobytailor]]

Andrew, please file a new one, since these crashes seem to happen in mozilla::dom::Element::UpdateIntersectionObservation which I'm pretty sure is unrelated to this bug.