1536290 - Crash when closing last tab with Ctrl+W

Status: NEW

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Beth Rennie [:beth] (she/her)]

In a debug build of nightly I sometimes get the following assertion failure and crash:

Assertion failure: leaf, at /home/barret/Workspace/src/hg.mozilla.org/mozilla-central/dom/events/EventStateManager.cpp:5390
#01: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x6b3ca55]
#02: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x77a0501]
#03: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5d72e93]
#04: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5d5475e]
#05: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5d514e5]
#06: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5ffc81f]
#07: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x68fb20b]
#08: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x89798f5]
#09: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x8968e0f]
#10: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x895f4cc]
#11: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x895593d]
#12: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x8968d76]
#13: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x9262d29]
#14: ??? (???:???)

Program /home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/firefox (pid = 5951) received signal 11.
Stack:
#01: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x97c4357]
#02: ???[/lib/x86_64-linux-gnu/libpthread.so.0 +0x12dd0]
#03: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x6b3c85a]
#04: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x6b3ca55]
#05: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x77a0501]
#06: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5d72e93]
#07: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5d5475e]
#08: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5d514e5]
#09: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x5ffc81f]
#10: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x68fb20b]
#11: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x89798f5]
#12: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x8968e0f]
#13: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x895f4cc]
#14: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x895593d]
#15: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x8968d76]
#16: ???[/home/barret/Workspace/src/hg.mozilla.org/mozilla-central/obj-x86_64-pc-linux-gnu/dist/bin/libxul.so +0x9262d29]
#17: ??? (???:???)

I cannot make it reliably reproduce, unfortunately. It has only happen when I close my last two open tabs with Ctrl+W.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

There isn't really much data here. I wonder why the stack traces don't have proper symbols.

Brennie, can you perhaps give any more information here?

Comment 2

[Beth Rennie [:beth] (she/her)]

I have no other details unfortunately.

Comment 3

[Luca Greco [:rpl] [:luca] [:lgreco]]

it seems we got the same (or a similar) crash recently triggered in mochitest-browser (currently it seems to be only happening on macos64 debug):

• Bug 1576887

The crash logged in the mochitest-browser has a stack trace with proper symbols, and so it may be useful to track down the underlying reason:

Assertion failure: leaf, at /builds/worker/workspace/build/src/dom/events/EventStateManager.cpp:5486
#01: mozilla::EventStateManager::NativeAnonymousContentRemoved(nsIContent*) [dom/events/EventStateManager.cpp:5517]
#02: nsIFrame::DestroyAnonymousContent(nsPresContext*, already_AddRefed<nsIContent>&&) [layout/generic/nsFrame.cpp:259]
#03: nsIFrame::AutoPostDestroyData::~AutoPostDestroyData() [mfbt/AlreadyAddRefed.h:128]
#04: nsFrameManager::Destroy() [layout/base/nsFrameManager.cpp:54]
#05: mozilla::PresShell::Destroy() [layout/base/PresShell.cpp:1362]
#06: nsDocumentViewer::DestroyPresShell() [layout/base/nsDocumentViewer.cpp:4153]
#07: nsDocumentViewer::Destroy() [layout/base/nsDocumentViewer.cpp:1878]
#08: nsDocShell::Destroy() [docshell/base/nsDocShell.cpp:4926]
#09: nsXULWindow::Destroy() [xpfe/appshell/nsXULWindow.cpp:502]
#10: nsWebShellWindow::Destroy() [xpfe/appshell/nsWebShellWindow.cpp:734]
#11: nsGlobalWindowOuter::ReallyCloseWindow() [dom/base/nsGlobalWindowOuter.cpp:6418]
#12: nsCloseEvent::Run() [dom/base/nsGlobalWindowOuter.cpp:0]
#13: nsThread::ProcessNextEvent(bool, bool*) [xpcom/threads/nsThread.cpp:1214]
#14: NS_ProcessNextEvent(nsIThread*, bool) [xpcom/threads/nsThreadUtils.cpp:486]
#15: mozilla::net::nsHttpConnectionMgr::Shutdown() [netwerk/protocol/http/nsHttpConnectionMgr.cpp:241]
#16: mozilla::net::nsHttpHandler::Observe(nsISupports*, char const*, char16_t const*) [netwerk/protocol/http/nsHttpHandler.cpp:2162]
#17: non-virtual thunk to mozilla::net::nsHttpHandler::Observe(nsISupports*, char const*, char16_t const*) [netwerk/protocol/http/nsHttpHandler.cpp:0]
#18: nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) [xpcom/ds/nsObserverList.cpp:65]
#19: nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) [xpcom/ds/nsObserverService.cpp:294]
#20: nsXREDirProvider::DoShutdown() [toolkit/xre/nsXREDirProvider.cpp:1084]
#21: ScopedXPCOMStartup::~ScopedXPCOMStartup() [toolkit/xre/nsAppRunner.cpp:1241]
#22: XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) [toolkit/xre/nsAppRunner.cpp:4738]
#23: XRE_main(int, char**, mozilla::BootstrapConfig const&) [toolkit/xre/nsAppRunner.cpp:4792]
#24: main [browser/app/nsBrowserApp.cpp:295]

The assertion failure is actually triggered when the mochitest-browser session is shutting down (https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=263835213&repo=mozilla-central&lineNumber=27103) and so I'm not yet sure which is the test case (or the test cases) that are actually triggering it.

Emilio, does the stacktrace linked above help to shed a light on what could be triggering this assertion failure?

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Not really. What this means is that there's some anonymous content with the HOVER or ACTIVE bits, while the event state manager no longer thinks there is a hover or active node at all.

That is wrong, obviously. If there's a way to reproduce somewhat consistently I'm happy to take a look.