Closed Bug 1533626 Opened 7 years ago Closed 7 years ago

Invalid write crashes the browser after removing a profile containing Zalgo text

Categories

(Toolkit :: Startup and Profile System, defect)

Product:
Toolkit
Component:
Startup and Profile System
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1522584

People

(Reporter: geeknik, Unassigned)

Details

(Keywords: csectype-nullptr, nightly-community, regression)

ASan Nightly Build ID 20190307215858, built from https://hg.mozilla.org/mozilla-central/rev/af29567ecdba5441117b3f01ac2559a3473c3d6a

ext4 filesystem, fedora 29, kernel 4.20.12-200.fc29.x86_64

STR:

  1. open about:profiles
  2. create a new profile using only this: R̶̘̱͐̆̔̇̀̃̉̿̆̀͠
    for example: /home/geeknik/.mozilla/firefox/gu30ncpl.R̶̘̱͐̆̔̇̀̃̉̿̆̀͠
  3. remove the profile (be sure to choose the option to delete files or it won't crash)
  4. crash!

Result:
==27847==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fa8295ee5d0 bp 0x7fa7ffffcce0 sp 0x7fa7ffffcce0 T652)
==27847==The signal is caused by a WRITE memory access.
==27847==Hint: address points to the zero page.
#0 0x7fa8295ee5cf in MOZ_Crash(char const*, int, char const*) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:314:3
#1 0x7fa8295ee55d in nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const /builds/worker/workspace/build/src/xpcom/base/nsISupportsImpl.cpp:40:5
#2 0x7fa8354e8b48 in AssertOwnership<33> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsISupportsImpl.h:59:5
#3 0x7fa8354e8b48 in nsToolkitProfile::Release() /builds/worker/workspace/build/src/toolkit/profile/nsToolkitProfileService.cpp:72
#4 0x7fa8354ea90a in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:45:40
#5 0x7fa8354ea90a in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:362
#6 0x7fa8354ea90a in assign_assuming_AddRef /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:64
#7 0x7fa8354ea90a in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:155
#8 0x7fa8354ea90a in nsToolkitProfileLock::Unlock() /builds/worker/workspace/build/src/toolkit/profile/nsToolkitProfileService.cpp:273
#9 0x7fa8354f9c57 in operator() /builds/worker/workspace/build/src/toolkit/profile/nsToolkitProfileService.cpp:149:17
#10 0x7fa8354f9c57 in mozilla::detail::RunnableFunction<nsToolkitProfile::RemoveInternal(bool, bool)::$_0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:562
#11 0x7fa82979cece in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:241:14
#12 0x7fa82979d92c in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp
#13 0x7fa829792ee1 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1179:14
#14 0x7fa829799461 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:482:10
#15 0x7fa82a723b5d in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:333:5
#16 0x7fa82a65a45f in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
#17 0x7fa82a65a45f in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
#18 0x7fa82a65a45f in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
#19 0x7fa82978ce90 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:454:11
#20 0x7fa83e4d6158 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:201:5
#21 0x7fa84170958d in start_thread (/lib64/libpthread.so.0+0x858d)
#22 0x7fa8412ef6a2 in __GI___clone (/lib64/libc.so.6+0xfd6a2)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Assertions.h:314:3 in MOZ_Crash(char const*, int, char const*)
Thread T652 (StreamT~ns #235) created by T0 here:
#0 0x560c1999527d in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3
#1 0x7fa83e4c7aab in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:433:14
#2 0x7fa83e4ada6e in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:518:12
#3 0x7fa82978f276 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:660:8
#4 0x7fa829798650 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:416:12
#5 0x7fa82979c289 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:135:57
#6 0x7fa82979bcc8 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:110:17
#7 0x7fa82979dae1 in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:287:5
#8 0x7fa829a6532c in mozilla::net::nsStreamTransportService::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/netwerk/base/nsStreamTransportService.cpp:216:16
#9 0x7fa8296fc134 in Dispatch /builds/worker/workspace/build/src/obj-firefox/dist/include/nsIEventTarget.h:37:14
#10 0x7fa8296fc134 in PostContinuationEvent_Locked /builds/worker/workspace/build/src/xpcom/io/nsStreamUtils.cpp:441
#11 0x7fa8296fc134 in PostContinuationEvent /builds/worker/workspace/build/src/xpcom/io/nsStreamUtils.cpp:433
#12 0x7fa8296fc134 in nsAStreamCopier::Start(nsIInputStream*, nsIOutputStream*, nsIEventTarget*, void ()(void, nsresult), void*, unsigned int, bool, bool, void ()(void, unsigned int)) /builds/worker/workspace/build/src/xpcom/io/nsStreamUtils.cpp:257
#13 0x7fa8296fbc1e in NS_AsyncCopy(nsIInputStream*, nsIOutputStream*, nsIEventTarget*, nsAsyncCopyMode, unsigned int, void ()(void, nsresult), void*, bool, bool, nsISupports**, void ()(void, unsigned int)) /builds/worker/workspace/build/src/xpcom/io/nsStreamUtils.cpp:581:16
#14 0x7fa829a63af2 in mozilla::net::nsInputStreamTransport::OpenInputStream(unsigned int, unsigned int, unsigned int, nsIInputStream**) /builds/worker/workspace/build/src/netwerk/base/nsStreamTransportService.cpp:95:8
#15 0x7fa829990955 in nsInputStreamPump::AsyncRead(nsIStreamListener*, nsISupports*) /builds/worker/workspace/build/src/netwerk/base/nsInputStreamPump.cpp:325:21
#16 0x7fa82b28fddb in nsJARChannel::ContinueOpenLocalFile(nsJARInputThunk*, bool) /builds/worker/workspace/build/src/modules/libjar/nsJARChannel.cpp:465:17
#17 0x7fa82b2ae15b in applyImpl<nsJARChannel, nsresult (nsJARChannel::)(nsJARInputThunk , bool), StoreRefPtrPassByPtr<nsJARInputThunk>, StoreCopyPassByConstLRef<bool> , 0, 1> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1122:12
#18 0x7fa82b2ae15b in apply<nsJARChannel, nsresult (nsJARChannel::)(nsJARInputThunk , bool)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1128
#19 0x7fa82b2ae15b in mozilla::detail::RunnableMethodImpl<RefPtr<nsJARChannel>, nsresult (nsJARChannel::)(nsJARInputThunk, bool), true, (mozilla::RunnableKind)0, RefPtr<nsJARInputThunk>, bool>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1174
#20 0x7fa829792ee1 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1179:14
#21 0x7fa829799461 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:482:10
#22 0x7fa834aa8540 in SpinEventLoopUntil<mozilla::ProcessFailureBehavior::ReportToCaller, (lambda at /builds/worker/workspace/build/src/xpfe/appshell/nsXULWindow.cpp:380:24)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:348:25
#23 0x7fa834aa8540 in nsXULWindow::ShowModal() /builds/worker/workspace/build/src/xpfe/appshell/nsXULWindow.cpp:380
#24 0x7fa8354799a5 in nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy*, char const*, char const*, char const*, bool, bool, bool, nsIArray*, bool, bool, nsDocShellLoadState*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:1220:18
#25 0x7fa8354746d1 in nsWindowWatcher::OpenWindow(mozIDOMWindowProxy*, char const*, char const*, char const*, nsISupports*, mozIDOMWindowProxy**) /builds/worker/workspace/build/src/toolkit/components/windowwatcher/nsWindowWatcher.cpp:290:10
#26 0x7fa8297be2a1 in NS_InvokeByIndex /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
#27 0x7fa82b243274 in Invoke /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1630:10
#28 0x7fa82b243274 in Call /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1178
#29 0x7fa82b243274 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1144
#30 0x7fa82b2492b3 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:941:10
#31 0x7fa8357a7aa7 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:440:13
#32 0x7fa8357a7aa7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:532
#33 0x7fa83578faaf in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:591:10
#34 0x7fa83578faaf in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3056
#35 0x7fa835773fbf in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:420:10
#36 0x7fa8357a8416 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:560:13
#37 0x7fa8357aa062 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:603:8
#38 0x7fa8363b7677 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2560:10
#39 0x7fa82b22cf01 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedJSClass.cpp:993:17
#40 0x7fa8297bf978 in PrepareAndDispatch /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:127:37
#41 0x7fa8297be84a in SharedStub (/home/geeknik/firefox/libxul.so+0x20ae84a)
#42 0x7fa8297be2a1 in NS_InvokeByIndex /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
#43 0x7fa82b243274 in Invoke /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1630:10
#44 0x7fa82b243274 in Call /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1178
#45 0x7fa82b243274 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1144
#46 0x7fa82b2492b3 in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:941:10
#47 0x7fa8357a7aa7 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:440:13
#48 0x7fa8357a7aa7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:532
#49 0x7fa83578faaf in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:591:10
#50 0x7fa83578faaf in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3056
#51 0x7fa835773fbf in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:420:10
#52 0x7fa8357a8416 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:560:13
#53 0x7fa8357aa062 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:603:8
#54 0x7fa835e9b850 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/SelfHosting.cpp:1908:10
#55 0x7fa83598fd1d in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/AsyncFunction.cpp:109:8
#56 0x7fa835933e91 in AsyncFunctionPromiseReactionJob /builds/worker/workspace/build/src/js/src/builtin/Promise.cpp:1491:10
#57 0x7fa835933e91 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Promise.cpp:1612
#58 0x7fa8357a7aa7 in CallJSNative /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:440:13
#59 0x7fa8357a7aa7 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:532
#60 0x7fa8357aa062 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:603:8
#61 0x7fa8363b9129 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2623:10
#62 0x7fa82d8d7fc6 in mozilla::dom::PromiseJobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/PromiseBinding.cpp:26:8
#63 0x7fa8295b6733 in Call /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/PromiseBinding.h:91:12
#64 0x7fa8295b6733 in Call /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/dom/PromiseBinding.h:104
#65 0x7fa8295b6733 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:235
#66 0x7fa8295913d1 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:595:17
#67 0x7fa82f9aaa15 in LeaveMicroTask /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/CycleCollectedJSContext.h:201:7
#68 0x7fa82f9aaa15 in ~nsAutoMicroTask /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/CycleCollectedJSContext.h:298
#69 0x7fa82f9aaa15 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1044
#70 0x7fa82f9ac7b1 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/workspace/build/src/dom/events/EventListenerManager.cpp:1237:17
#71 0x7fa82f992f3c in HandleEvent /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/EventListenerManager.h:350:5
#72 0x7fa82f992f3c in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:351
#73 0x7fa82f991745 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:553:16
#74 0x7fa82f996d94 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>) /builds/worker/workspace/build/src/dom/events/EventDispatcher.cpp:1048:11
#75 0x7fa831e8f17e in mozilla::PresShell::EventHandler::DispatchEventToDOM(mozilla::WidgetEvent, nsEventStatus*, nsPresShellEventCB*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:8081:7
#76 0x7fa831e80967 in mozilla::PresShell::EventHandler::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:7848:11
#77 0x7fa831e880c8 in mozilla::PresShell::EventHandler::HandleEventWithTarget(mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, bool, nsIContent**, nsIContent*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:7625:7
#78 0x7fa831eb74ac in mozilla::PresShell::HandleEventWithTarget(mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*, bool, nsIContent**, nsIContent*) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/PresShell.h:135:25
#79 0x7fa82f920ad8 in mozilla::EventStateManager::InitAndDispatchClickEvent(mozilla::WidgetMouseEvent*, nsEventStatus*, mozilla::EventMessage, nsIPresShell*, nsIContent*, AutoWeakFrame, bool, nsIContent*) /builds/worker/workspace/build/src/dom/events/EventStateManager.cpp:4826:19
#80 0x7fa82f9211bb in mozilla::EventStateManager::DispatchClickEvents(nsIPresShell*, mozilla::WidgetMouseEvent*, nsEventStatus*, nsIContent*, nsIContent*) /builds/worker/workspace/build/src/dom/events/EventStateManager.cpp:4926:17
#81 0x7fa82f9199e7 in mozilla::EventStateManager::PostHandleMouseUp(mozilla::WidgetMouseEvent*, nsEventStatus*, nsIContent*) /builds/worker/workspace/build/src/dom/events/EventStateManager.cpp:4869:17
#82 0x7fa82f916609 in mozilla::EventStateManager::PostHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsEventStatus*, nsIContent*) /builds/worker/workspace/build/src/dom/events/EventStateManager.cpp:3233:18
#83 0x7fa831e80d5e in mozilla::PresShell::EventHandler::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*, bool, nsIContent*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:7868:23
#84 0x7fa831e7e79f in mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*, bool) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:6705:30
#85 0x7fa831e7c648 in mozilla::PresShell::EventHandler::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:6514:12
#86 0x7fa831e7c1bd in mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) /builds/worker/workspace/build/src/layout/base/PresShell.cpp:6442:23
#87 0x7fa8317f4984 in nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) /builds/worker/workspace/build/src/view/nsViewManager.cpp:755:14
#88 0x7fa8317f4334 in nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) /builds/worker/workspace/build/src/view/nsView.cpp:1070:9
#89 0x7fa8318c9dad in nsWindow::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp:520:25
#90 0x7fa831814199 in nsBaseWidget::ProcessUntransformedAPZEvent(mozilla::WidgetInputEvent*, mozilla::layers::ScrollableLayerGuid const&, unsigned long, nsEventStatus) /builds/worker/workspace/build/src/widget/nsBaseWidget.cpp:970:3
#91 0x7fa8318153c9 in nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*) /builds/worker/workspace/build/src/widget/nsBaseWidget.cpp:1110:14
#92 0x7fa8318e2b0d in nsWindow::OnButtonReleaseEvent(_GdkEventButton*) /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp:2660:31
#93 0x7fa8318ed32c in button_release_event_cb(_GtkWidget*, _GdkEventButton*) /builds/worker/workspace/build/src/widget/gtk/nsWindow.cpp:5342:11
#94 0x7fa83d78a6ca (/lib64/libgtk-3.so.0+0x3e16ca)

==27847==ABORTING

Does the name actually matter? At first glance this looks to be the same as bug 1522584.

Upon further review it doesn't seem like the name matters after all. Removing (and deleting) any profile causes this crash.

Ok, I think this is just bug 1522584 then.

Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.