1652699 - Crash in [@ mozilla::dom::HTMLFormElement::BuildSubmission]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Alex Chronopoulos [:achronop]]

This bug is for crash report bp-b556378c-a648-487f-869f-3240f0200706.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::HTMLFormElement::BuildSubmission dom/html/HTMLFormElement.cpp:744
1 xul.dll mozilla::dom::HTMLFormElement::DoSubmit dom/html/HTMLFormElement.cpp:651
2 xul.dll mozilla::dom::HTMLFormElement::PostHandleEvent dom/html/HTMLFormElement.cpp:569
3 xul.dll static mozilla::EventTargetChainItem::HandleEventTargetChain dom/events/EventDispatcher.cpp:560
4 xul.dll static mozilla::EventTargetChainItem::HandleEventTargetChain dom/events/EventDispatcher.cpp:637
5 xul.dll static mozilla::EventDispatcher::Dispatch dom/events/EventDispatcher.cpp:1054
6 xul.dll static mozilla::EventDispatcher::DispatchDOMEvent dom/events/EventDispatcher.cpp
7 xul.dll mozilla::PresShell::HandleDOMEventWithTarget layout/base/PresShell.cpp:8786
8 xul.dll mozilla::dom::HTMLFormElement::MaybeSubmit dom/html/HTMLFormElement.cpp:274
9 xul.dll mozilla::dom::HTMLButtonElement::PostHandleEvent dom/html/HTMLButtonElement.cpp:263

Started in 20200704213451 and crashes almost every day since then.

Comment 1

[Emilio Cobos Álvarez [:emilio]]

The line info in the crash report points to the dialog submission code added in bug 1557303.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1557303

Comment 3

[Emilio Cobos Álvarez [:emilio]]

All urls are from https://forum.gamer.com.tw / https://home.gamer.com.tw. Maybe they use dialog in some obscure way?

Comment 4

[Sean Feng [:sefeng211]]

Attachment: Bug 1652699 - Fix a null pointer crash while doing dialog form submission r=smaug

It's possible that the dialog is closed while we are processing
the request, and we'd deferencing a null pointer for such case.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7e73e0ab27fe
Fix a null pointer crash while doing dialog form submission r=smaug

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/24594 for changes under testing/web-platform/tests

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/7e73e0ab27fe

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 9

[Ryan VanderMeulen (PTO, back July 27)]

Please nominate this for Beta and ESR78 approval when you get a chance.

Comment 10

[Sean Feng [:sefeng211]]

Attachment: beta uplift request

Approval Request Comment

[Feature/Bug causing the regression]: Bug 1557303
[User impact if declined]: Users may experience a crash when doing dialog form submission.
[Is this code covered by automated tests?]: Yes
[Has the fix been verified in Nightly?]: Yes
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: N/A
[Is the change risky?]: No
[Why is the change risky/not risky?]:

1. This feature is behind a pref and disabled by default, so only a very few numbers of users may experience this crash.
2. The fix is covered by a test, so it's not risky.
   [String changes made/needed]: N/A

The patch that is attached to this bug is the one that we want to uplift

Comment 11

[Sean Feng [:sefeng211]]

Attachment: esruplift.txt

[Approval Request Comment]

If this is not a sec:{high,crit} bug, please state case for ESR consideration:
When doing a dialog form submission, if the dialog is dismissed during the
submission, Firefox may crash.

User impact if declined: Users may experience a crash during dialog form submission.

Fix Landed on Version: Version 80, latest Nightly

Risk to taking this patch (and alternatives if risky): not risky.

The patch that is attached to this bug is the one that we want to uplift.

Comment 12

[Emilio Cobos Álvarez [:emilio]]

Why do we want to uplift this? <dialog> is not enabled anywhere else than nightly atm, right?

Comment 13

[Ryan VanderMeulen (PTO, back July 27)]

Sorry, I missed that this was disabled by default. Agreed that we can let this fix ride the trains. Sorry for the hassle, Sean!

Comment 14

[Sean Feng [:sefeng211]]

oh okay! I thought we want to uplift this because users can manually enable it, but I guess not uplifting this is fine since possibly only a very few users would do that...