Closed Bug 1396323 Opened 7 years ago Closed 7 years ago

Intermittent browser_bug1025195_switchToTabHavingURI_aOpenParams.js | Test timed out | application crashed [@ mozilla::dom::DocGroup::ValidateAccess] (Assertion failure: IsSafeToRun(), at SchedulerGroup.h:74) when Gecko 57 merges to Beta on 2017-09-20


(Core :: Panning and Zooming, defect, P5)




Tracking Status
firefox-esr52 --- unaffected
firefox55 --- unaffected
firefox56 --- unaffected
firefox57 --- verified


(Reporter: intermittent-bug-filer, Assigned: rhunt)



(Keywords: assertion, crash, intermittent-failure, Whiteboard: [gfx-noted])


(1 file)

Filed by: rvandermeulen [at]

Bisection on Try has confirmed that this was caused by bug 1376525. Appears to only affect Linux, but always in the same test. Failure rate is ~50%.

The patch below should be enough to reproduce.
Flags: needinfo?(rhunt)
My guess is:

1. A script is long running with DocGroup for tab A active
2. A tab switch happens
3. JS interrupt runs, triggering new tab B to paint
4. Keyboard APZ creates a focus target for this paint
5. Focus target collects event targets that would be hit for a key event (using an eVoid event)
6. One of them is an <input> which lazily initializes [1]
7. The lazy initialization causes a DOM modification for tab B [2]

The assertion is because the DocGroup for tab A is active, while we are modifying B.

I don't think we need to lazy init <input> when we are dispatching eVoid events. Fixing that resolved this issue for me. I can't see any other GetEventTargetParent implementations that do similar, so I think that's all that needed.

Assignee: nobody → rhunt
Flags: needinfo?(rhunt)
Whiteboard: [gfx-noted]
Comment on attachment 8904716 [details]
Bug 1396323 - Don't initialize HTMLInputElement editor for eVoidEvent.

Looks good on Try!
Attachment #8904716 - Flags: feedback+
Comment on attachment 8904716 [details]
Bug 1396323 - Don't initialize HTMLInputElement editor for eVoidEvent.

::: dom/html/HTMLInputElement.cpp:3582
(Diff revision 1)
>        aVisitor.mEvent->mClass == eMutationEventClass) {
>      return false;
>    }
>    switch (aVisitor.mEvent->mMessage) {
> +  case eVoidEvent:

I think it'd be nice to include the description in the commit message as a code comment around here instead.
Attachment #8904716 - Flags: review?(ehsan) → review+
Pushed by
Don't initialize HTMLInputElement editor for eVoidEvent. r=ehsan
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
You need to log in before you can comment on or make changes to this bug.