Open Bug 1656404 Opened 4 years ago Updated 1 year ago

Assertion failure: !mIsBeingDestroyed, at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11617

Categories

(Core :: Disability Access APIs, defect)

defect

Tracking

()

Tracking Status
firefox81 --- wontfix
firefox86 --- wontfix
firefox87 --- affected
firefox88 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 56082fc4acfa (built with --enable-debug). Testcase requires the GNOME_ACCESSIBILITY=1 env variable to be set.

Assertion failure: !mIsBeingDestroyed, at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11617

rax = 0x00007f97021caef2   rdx = 0x0000000000000000
rcx = 0x00005578c8e3de58   rbx = 0x00007f96f719e000
rsi = 0x00007f970df2e8b0   rdi = 0x00007f970df2d680
rbp = 0x00007ffc738a78b0   rsp = 0x00007ffc738a7870
r8 = 0x00007f970df2e8b0    r9 = 0x00007f970ee80780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f970d995d90   r13 = 0x0000000000000000
r14 = 0x00007ffc738a7920   r15 = 0x00007ffc738a7918
rip = 0x00007f96fdfeeb96
OS|Linux|0.0.0 Linux 5.3.0-62-generic #56~18.04.1-Ubuntu SMP Wed Jun 24 16:17:03 UTC 2020 x86_64
CPU|amd64|family 6 model 158 stepping 10|12
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsDocShell::EnsureEditorData()|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|11617|0x29
0|1|libxul.so|nsDocShell::GetEditingSession(nsIEditingSession**)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|12640|0x5
0|2|libxul.so|mozilla::a11y::DocAccessible::GetEditor() const|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|309|0x25
0|3|libxul.so|mozilla::a11y::DocAccessible::NativeState() const|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|241|0x13
0|4|libxul.so|mozilla::a11y::RootAccessible::NativeState() const|hg:hg.mozilla.org/mozilla-central:accessible/generic/RootAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|106|0x5
0|5|libxul.so|mozilla::a11y::Accessible::State()|hg:hg.mozilla.org/mozilla-central:accessible/generic/Accessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1142|0x9
0|6|libxul.so|mozilla::a11y::AccTextChangeEvent::AccTextChangeEvent(mozilla::a11y::Accessible*, int, nsTSubstring<char16_t> const&, bool, mozilla::a11y::EIsFromUserInput)|hg:hg.mozilla.org/mozilla-central:accessible/base/AccEvent.cpp:56082fc4acfacba40993e47ef8302993c59e264e|96|0x12
0|7|libxul.so|mozilla::a11y::NotificationController::QueueMutationEvent(mozilla::a11y::AccTreeMutationEvent*)|hg:hg.mozilla.org/mozilla-central:accessible/base/NotificationController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|266|0xf
0|8|libxul.so|mozilla::a11y::TreeMutation::BeforeRemoval(mozilla::a11y::Accessible*, bool)|hg:hg.mozilla.org/mozilla-central:accessible/base/EventTree.cpp:56082fc4acfacba40993e47ef8302993c59e264e|86|0x16
0|9|libxul.so|mozilla::a11y::DocAccessible::ContentRemoved(mozilla::a11y::Accessible*)|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2125|0xd
0|10|libxul.so|mozilla::a11y::DocAccessible::ContentRemoved(nsIContent*)|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2154|0x8
0|11|libxul.so|nsAccessibilityService::ContentRemoved(mozilla::PresShell*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:accessible/base/nsAccessibilityService.cpp:56082fc4acfacba40993e47ef8302993c59e264e|576|0xb
0|12|libxul.so|nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|7469|0xf
0|13|libxul.so|mozilla::PresShell::ContentRemoved(nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4446|0x1f
0|14|libxul.so|mozilla::dom::MutationObservers::NotifyContentRemoved(nsINode*, nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:56082fc4acfacba40993e47ef8302993c59e264e|214|0xa3
0|15|libxul.so|nsINode::RemoveChildNode(nsIContent*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2077|0xe
0|16|libxul.so|nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:56082fc4acfacba40993e47ef8302993c59e264e|783|0x1c
0|17|libxul.so|mozilla::DeleteNodeTransaction::DoTransaction()|hg:hg.mozilla.org/mozilla-central:editor/libeditor/DeleteNodeTransaction.cpp:56082fc4acfacba40993e47ef8302993c59e264e|77|0x26
0|18|libxul.so|mozilla::TransactionItem::DoTransaction()|hg:hg.mozilla.org/mozilla-central:editor/txmgr/TransactionItem.cpp:56082fc4acfacba40993e47ef8302993c59e264e|81|0x11
0|19|libxul.so|mozilla::TransactionManager::BeginTransaction(nsITransaction*, nsISupports*)|hg:hg.mozilla.org/mozilla-central:editor/txmgr/TransactionManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|686|0xd
0|20|libxul.so|mozilla::TransactionManager::DoTransaction(nsITransaction*)|hg:hg.mozilla.org/mozilla-central:editor/txmgr/TransactionManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|71|0xd
0|21|libxul.so|mozilla::EditorBase::DoTransactionInternal(nsITransaction*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:56082fc4acfacba40993e47ef8302993c59e264e|852|0x13
0|22|libxul.so|mozilla::EditorBase::DeleteNodeWithTransaction(nsIContent&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1655|0xb
0|23|libxul.so|mozilla::HTMLEditor::MoveNodeWithTransaction(nsIContent&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4823|0xb
0|24|libxul.so|mozilla::HTMLEditor::MoveNodeToEndWithTransaction(nsIContent&, nsINode&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditor.h:56082fc4acfacba40993e47ef8302993c59e264e|2201|0xe
0|25|libxul.so|mozilla::HTMLEditor::RelativeFontChangeOnNode(int, nsIContent*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLStyleEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2440|0x13
0|26|libxul.so|mozilla::HTMLEditor::RelativeFontChange(mozilla::HTMLEditor::FontSize)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLStyleEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2221|0x11
0|27|libxul.so|mozilla::HTMLEditor::DecreaseFontSizeAsAction(nsIPrincipal*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLStyleEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2108|0xd
0|28|libxul.so|mozilla::DecreaseFontSizeCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditorCommands.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1131|0xb
0|29|libxul.so|mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4910|0x33
0|30|libxul.so|mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:21f75c0ef1bb5231f2ddbb4cdca693d90afb6ba04d99d2af21b5ce833a812424f4c2f5656e8f9f5e29b8856280e3d6b55ab24e3573e0c903b539e571067abf58/dom/bindings/DocumentBinding.cpp:|3469|0x34
0|31|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:56082fc4acfacba40993e47ef8302993c59e264e|3220|0x21
0|32|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|485|0x12
0|33|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|577|0x12
0|34|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|640|0x10
0|35|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|3333|0x15
0|36|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|457|0xb
0|37|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|612|0xd
0|38|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|640|0x10
0|39|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|657|0xb
0|40|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2837|0x23
0|41|libxul.so|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:5ceb4fd1d8dc61bfa9cb634c1ccbea88477929f8e3cd832f14dbaaa72fb11378c7536241ae3f9b1a6d2506d829d115fe64e0fdcf3301157cfcf64f24a4f984df/dom/bindings/EventHandlerBinding.cpp:|276|0xb
0|42|libxul.so|void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:5abc72777d30ad0ea7b8b3e1392cd7961bd73b8cd08e5ab209f3b42251def563ee9c9a7cea98a24d0fa9d867edfc0c0297c165b0d167458ac5a2af4b7a0caebe/dist/include/mozilla/dom/EventHandlerBinding.h:|367|0x28
0|43|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:56082fc4acfacba40993e47ef8302993c59e264e|201|0x2e
0|44|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1088|0xc
0|45|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1279|0x15
0|46|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:56082fc4acfacba40993e47ef8302993c59e264e|355|0xb
0|47|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:56082fc4acfacba40993e47ef8302993c59e264e|557|0x19
0|48|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1054|0x5
0|49|libxul.so|nsDocumentViewer::PageHide(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1412|0x2f
0|50|libxul.so|nsDocShell::FirePageHideNotificationInternal(bool, bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1010|0x1d
0|51|libxul.so|nsDocShell::Destroy()|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4163|0xf
0|52|libxul.so|nsWebBrowser::SetDocShell(nsDocShell*)|hg:hg.mozilla.org/mozilla-central:toolkit/components/browser/nsWebBrowser.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1131|0x10
0|53|libxul.so|nsWebBrowser::InternalDestroy()|hg:hg.mozilla.org/mozilla-central:toolkit/components/browser/nsWebBrowser.cpp:56082fc4acfacba40993e47ef8302993c59e264e|174|0xa
0|54|libxul.so|{virtual override thunk({offset(-24)}, nsWebBrowser::Destroy())}|||0xd
0|55|libxul.so|mozilla::dom::BrowserChild::DestroyWindow()|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:56082fc4acfacba40993e47ef8302993c59e264e|894|0x17
0|56|libxul.so|mozilla::dom::BrowserChild::RecvDestroy()|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2342|0x8
0|57|libxul.so|mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:0737fcecc4282a40df0487e3cfc7ca0eccaaff3e238412e1f2c776bbb3d298d4a3755eac0386df40d4ccae91eb3b483577226feb38e095ceb3965ea5db46ed38/ipc/ipdl/PBrowserChild.cpp:|6175|0xc
0|58|libxul.so|mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:8072ec62bda373c6cdafe5e7bb0dcba8b7b61ba6569dcadde6047848782e0e2eed26fd145a00f603767be5a737638a453587bc464328da26d0553e7b789be93b/ipc/ipdl/PContentChild.cpp:|8454|0x15
0|59|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2150|0xd
0|60|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2074|0x5
0|61|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1922|0xb
0|62|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1953|0xc
0|63|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|242|0x11
0|64|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|512|0x9
0|65|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|371|0x5
0|66|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|168|0x8
0|67|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:56082fc4acfacba40993e47ef8302993c59e264e|577|0xf
0|68|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1234|0xe
0|69|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:56082fc4acfacba40993e47ef8302993c59e264e|513|0xc
0|70|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:56082fc4acfacba40993e47ef8302993c59e264e|87|0x7
0|71|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|334|0x17
0|72|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|309|0x8
0|73|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|137|0xd
0|74|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:56082fc4acfacba40993e47ef8302993c59e264e|913|0xe
0|75|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:56082fc4acfacba40993e47ef8302993c59e264e|237|0x5
0|76|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|334|0x17
0|77|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|309|0x8
0|78|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:56082fc4acfacba40993e47ef8302993c59e264e|744|0x5
0|79|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:56082fc4acfacba40993e47ef8302993c59e264e|56|0x11
0|80|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:56082fc4acfacba40993e47ef8302993c59e264e|303|0x20
0|81|libc.so.6||||0x21b97
0|82|firefox-bin|mozilla::UniquePtr<mozilla::Bootstrap, mozilla::Bootstrap::BootstrapDelete>::~UniquePtr()|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:56082fc4acfacba40993e47ef8302993c59e264e|253|0x17
Flags: in-testsuite?
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200804091327-7cb90fa4f485.
Failed to bisect testcase (Start build crashes!):
> Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
> End: 11e97601cbca5bbe37c95f3272a80e30bbf7fc61 (20200731041113)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201205093858-7ce95b6cde26) but not with tip (mozilla-central 20211203213802-92df9c655be5.)
The bug appears to have been fixed in the following build range:

Start: 6f0d89c7a869767fdf2a852dfb41b9b82e5cac62 (20211105141501)
End: 5d6a85b1788ecb66fef5ea788eba0817e07db9e2 (20211105143150)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6f0d89c7a869767fdf2a852dfb41b9b82e5cac62&tochange=5d6a85b1788ecb66fef5ea788eba0817e07db9e2
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

Is this correct? Is bug 1706266 a fix for this issue?

Flags: needinfo?(masayuki)

The command which is the trigger of the test is disabled in the Nightly channel. Therefore, the testcase stopped working now. However, it seems that the crash can be triggered by other styling command. Perhaps, we should try to change decreaseFontSize to some other commands whether this is still reproducible or not.

Flags: needinfo?(masayuki)
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.