13176 - apprunner crashes when cursor is over OBJECT's alternate content

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[Braden]

Per the subject, using the 9/5 build, apprunner crashes when the cursor is positioned over the OBJECT's alternate content.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: simpler testcase

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Here's the top of a stack trace:

#0  0x29 in ?? ()
#1  0x41905167 in nsCSSFrameConstructor::FindPrimaryFrameFor (this=0x8256d90,
    aPresContext=0x8252c80, aFrameManager=0x82c8730, aContent=0x824c374,
    aFrame=0xbfffecbc) at nsCSSFrameConstructor.cpp:7609
#2  0x419e0d0d in StyleSetImpl::FindPrimaryFrameFor (this=0x8256d48,
    aPresContext=0x8252c80, aFrameManager=0x82c8730, aContent=0x824c374,
    aFrame=0xbfffecbc) at nsStyleSet.cpp:965
#3  0x417d80d6 in FrameManager::GetPrimaryFrameFor (this=0x82c8730,
    aContent=0x824c374, aResult=0xbfffecbc) at nsFrameManager.cpp:238
#4  0x417fc957 in PresShell::GetPrimaryFrameFor (this=0x8256dd8,
    aContent=0x824c374, aResult=0xbfffecbc) at nsPresShell.cpp:1800
#5  0x41902127 in nsCSSFrameConstructor::ContentStatesChanged (this=0x8256d90,
    aPresContext=0x8252c80, aContent1=0x824c374, aContent2=0x82d7a14)
    at nsCSSFrameConstructor.cpp:6612
#6  0x419e0b25 in StyleSetImpl::ContentStatesChanged (this=0x8256d48,
    aPresContext=0x8252c80, aContent1=0x824c374, aContent2=0x82d7a14)
    at nsStyleSet.cpp:897
#7  0x417fc215 in PresShell::ContentStatesChanged (this=0x8256dd8,
    aDocument=0x8213f70, aContent1=0x824c374, aContent2=0x82d7a14)
    at nsPresShell.cpp:1626
#8  0x419a79a7 in nsDocument::ContentStatesChanged (this=0x8213f70,
    aContent1=0x824c374, aContent2=0x82d7a14) at nsDocument.cpp:1556
#9  0x417be041 in nsEventStateManager::SetContentState (this=0x82ca320,

Troy?  I know you've looked at replaced content before...

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Since Braden reported this on 9/5 NT build and I confirmed on 9/4 Linux, I'm
marking All/All.

Comment 4

[troy]

Problem was that the map that's used to get from content object to frame had not
been reset, and it pointed to a frame that had been destroyed

Comment 5

[leger]

Resetting QA contact from leger.

Comment 6

[Chris Petersen]

With the Dec 01 build (1999120108), this problem has been fixed.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/776a00f6afff
[fenix] For https://github.com/mozilla-mobile/fenix/issues/13176: Remove race condition for shortcuts (https://github.com/mozilla-mobile/fenix/pull/13815)