1656404 - Assertion failure: !mIsBeingDestroyed, at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11617

Status: NEW

(Core :: Disability Access APIs, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 56082fc4acfa (built with --enable-debug). Testcase requires the GNOME_ACCESSIBILITY=1 env variable to be set.

Assertion failure: !mIsBeingDestroyed, at /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:11617

rax = 0x00007f97021caef2   rdx = 0x0000000000000000
rcx = 0x00005578c8e3de58   rbx = 0x00007f96f719e000
rsi = 0x00007f970df2e8b0   rdi = 0x00007f970df2d680
rbp = 0x00007ffc738a78b0   rsp = 0x00007ffc738a7870
r8 = 0x00007f970df2e8b0    r9 = 0x00007f970ee80780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f970d995d90   r13 = 0x0000000000000000
r14 = 0x00007ffc738a7920   r15 = 0x00007ffc738a7918
rip = 0x00007f96fdfeeb96
OS|Linux|0.0.0 Linux 5.3.0-62-generic #56~18.04.1-Ubuntu SMP Wed Jun 24 16:17:03 UTC 2020 x86_64
CPU|amd64|family 6 model 158 stepping 10|12
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|nsDocShell::EnsureEditorData()|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|11617|0x29
0|1|libxul.so|nsDocShell::GetEditingSession(nsIEditingSession**)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|12640|0x5
0|2|libxul.so|mozilla::a11y::DocAccessible::GetEditor() const|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|309|0x25
0|3|libxul.so|mozilla::a11y::DocAccessible::NativeState() const|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|241|0x13
0|4|libxul.so|mozilla::a11y::RootAccessible::NativeState() const|hg:hg.mozilla.org/mozilla-central:accessible/generic/RootAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|106|0x5
0|5|libxul.so|mozilla::a11y::Accessible::State()|hg:hg.mozilla.org/mozilla-central:accessible/generic/Accessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1142|0x9
0|6|libxul.so|mozilla::a11y::AccTextChangeEvent::AccTextChangeEvent(mozilla::a11y::Accessible*, int, nsTSubstring<char16_t> const&, bool, mozilla::a11y::EIsFromUserInput)|hg:hg.mozilla.org/mozilla-central:accessible/base/AccEvent.cpp:56082fc4acfacba40993e47ef8302993c59e264e|96|0x12
0|7|libxul.so|mozilla::a11y::NotificationController::QueueMutationEvent(mozilla::a11y::AccTreeMutationEvent*)|hg:hg.mozilla.org/mozilla-central:accessible/base/NotificationController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|266|0xf
0|8|libxul.so|mozilla::a11y::TreeMutation::BeforeRemoval(mozilla::a11y::Accessible*, bool)|hg:hg.mozilla.org/mozilla-central:accessible/base/EventTree.cpp:56082fc4acfacba40993e47ef8302993c59e264e|86|0x16
0|9|libxul.so|mozilla::a11y::DocAccessible::ContentRemoved(mozilla::a11y::Accessible*)|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2125|0xd
0|10|libxul.so|mozilla::a11y::DocAccessible::ContentRemoved(nsIContent*)|hg:hg.mozilla.org/mozilla-central:accessible/generic/DocAccessible.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2154|0x8
0|11|libxul.so|nsAccessibilityService::ContentRemoved(mozilla::PresShell*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:accessible/base/nsAccessibilityService.cpp:56082fc4acfacba40993e47ef8302993c59e264e|576|0xb
0|12|libxul.so|nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, nsCSSFrameConstructor::RemoveFlags)|hg:hg.mozilla.org/mozilla-central:layout/base/nsCSSFrameConstructor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|7469|0xf
0|13|libxul.so|mozilla::PresShell::ContentRemoved(nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:layout/base/PresShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4446|0x1f
0|14|libxul.so|mozilla::dom::MutationObservers::NotifyContentRemoved(nsINode*, nsIContent*, nsIContent*)|hg:hg.mozilla.org/mozilla-central:dom/base/MutationObservers.cpp:56082fc4acfacba40993e47ef8302993c59e264e|214|0xa3
0|15|libxul.so|nsINode::RemoveChildNode(nsIContent*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2077|0xe
0|16|libxul.so|nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:56082fc4acfacba40993e47ef8302993c59e264e|783|0x1c
0|17|libxul.so|mozilla::DeleteNodeTransaction::DoTransaction()|hg:hg.mozilla.org/mozilla-central:editor/libeditor/DeleteNodeTransaction.cpp:56082fc4acfacba40993e47ef8302993c59e264e|77|0x26
0|18|libxul.so|mozilla::TransactionItem::DoTransaction()|hg:hg.mozilla.org/mozilla-central:editor/txmgr/TransactionItem.cpp:56082fc4acfacba40993e47ef8302993c59e264e|81|0x11
0|19|libxul.so|mozilla::TransactionManager::BeginTransaction(nsITransaction*, nsISupports*)|hg:hg.mozilla.org/mozilla-central:editor/txmgr/TransactionManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|686|0xd
0|20|libxul.so|mozilla::TransactionManager::DoTransaction(nsITransaction*)|hg:hg.mozilla.org/mozilla-central:editor/txmgr/TransactionManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|71|0xd
0|21|libxul.so|mozilla::EditorBase::DoTransactionInternal(nsITransaction*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:56082fc4acfacba40993e47ef8302993c59e264e|852|0x13
0|22|libxul.so|mozilla::EditorBase::DeleteNodeWithTransaction(nsIContent&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/EditorBase.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1655|0xb
0|23|libxul.so|mozilla::HTMLEditor::MoveNodeWithTransaction(nsIContent&, mozilla::EditorDOMPointBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > const&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4823|0xb
0|24|libxul.so|mozilla::HTMLEditor::MoveNodeToEndWithTransaction(nsIContent&, nsINode&)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditor.h:56082fc4acfacba40993e47ef8302993c59e264e|2201|0xe
0|25|libxul.so|mozilla::HTMLEditor::RelativeFontChangeOnNode(int, nsIContent*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLStyleEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2440|0x13
0|26|libxul.so|mozilla::HTMLEditor::RelativeFontChange(mozilla::HTMLEditor::FontSize)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLStyleEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2221|0x11
0|27|libxul.so|mozilla::HTMLEditor::DecreaseFontSizeAsAction(nsIPrincipal*)|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLStyleEditor.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2108|0xd
0|28|libxul.so|mozilla::DecreaseFontSizeCommand::DoCommand(mozilla::Command, mozilla::TextEditor&, nsIPrincipal*) const|hg:hg.mozilla.org/mozilla-central:editor/libeditor/HTMLEditorCommands.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1131|0xb
0|29|libxul.so|mozilla::dom::Document::ExecCommand(nsTSubstring<char16_t> const&, bool, nsTSubstring<char16_t> const&, nsIPrincipal&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4910|0x33
0|30|libxul.so|mozilla::dom::Document_Binding::execCommand(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:21f75c0ef1bb5231f2ddbb4cdca693d90afb6ba04d99d2af21b5ce833a812424f4c2f5656e8f9f5e29b8856280e3d6b55ab24e3573e0c903b539e571067abf58/dom/bindings/DocumentBinding.cpp:|3469|0x34
0|31|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:56082fc4acfacba40993e47ef8302993c59e264e|3220|0x21
0|32|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|485|0x12
0|33|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|577|0x12
0|34|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|640|0x10
0|35|libxul.so|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|3333|0x15
0|36|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|457|0xb
0|37|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|612|0xd
0|38|libxul.so|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|640|0x10
0|39|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:56082fc4acfacba40993e47ef8302993c59e264e|657|0xb
0|40|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2837|0x23
0|41|libxul.so|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:5ceb4fd1d8dc61bfa9cb634c1ccbea88477929f8e3cd832f14dbaaa72fb11378c7536241ae3f9b1a6d2506d829d115fe64e0fdcf3301157cfcf64f24a4f984df/dom/bindings/EventHandlerBinding.cpp:|276|0xb
0|42|libxul.so|void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:5abc72777d30ad0ea7b8b3e1392cd7961bd73b8cd08e5ab209f3b42251def563ee9c9a7cea98a24d0fa9d867edfc0c0297c165b0d167458ac5a2af4b7a0caebe/dist/include/mozilla/dom/EventHandlerBinding.h:|367|0x28
0|43|libxul.so|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:56082fc4acfacba40993e47ef8302993c59e264e|201|0x2e
0|44|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1088|0xc
0|45|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1279|0x15
0|46|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:56082fc4acfacba40993e47ef8302993c59e264e|355|0xb
0|47|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:56082fc4acfacba40993e47ef8302993c59e264e|557|0x19
0|48|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1054|0x5
0|49|libxul.so|nsDocumentViewer::PageHide(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1412|0x2f
0|50|libxul.so|nsDocShell::FirePageHideNotificationInternal(bool, bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1010|0x1d
0|51|libxul.so|nsDocShell::Destroy()|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|4163|0xf
0|52|libxul.so|nsWebBrowser::SetDocShell(nsDocShell*)|hg:hg.mozilla.org/mozilla-central:toolkit/components/browser/nsWebBrowser.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1131|0x10
0|53|libxul.so|nsWebBrowser::InternalDestroy()|hg:hg.mozilla.org/mozilla-central:toolkit/components/browser/nsWebBrowser.cpp:56082fc4acfacba40993e47ef8302993c59e264e|174|0xa
0|54|libxul.so|{virtual override thunk({offset(-24)}, nsWebBrowser::Destroy())}|||0xd
0|55|libxul.so|mozilla::dom::BrowserChild::DestroyWindow()|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:56082fc4acfacba40993e47ef8302993c59e264e|894|0x17
0|56|libxul.so|mozilla::dom::BrowserChild::RecvDestroy()|hg:hg.mozilla.org/mozilla-central:dom/ipc/BrowserChild.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2342|0x8
0|57|libxul.so|mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:0737fcecc4282a40df0487e3cfc7ca0eccaaff3e238412e1f2c776bbb3d298d4a3755eac0386df40d4ccae91eb3b483577226feb38e095ceb3965ea5db46ed38/ipc/ipdl/PBrowserChild.cpp:|6175|0xc
0|58|libxul.so|mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:8072ec62bda373c6cdafe5e7bb0dcba8b7b61ba6569dcadde6047848782e0e2eed26fd145a00f603767be5a737638a453587bc464328da26d0553e7b789be93b/ipc/ipdl/PContentChild.cpp:|8454|0x15
0|59|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2150|0xd
0|60|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|2074|0x5
0|61|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1922|0xb
0|62|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1953|0xc
0|63|libxul.so|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|242|0x11
0|64|libxul.so|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|512|0x9
0|65|libxul.so|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|371|0x5
0|66|libxul.so|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:56082fc4acfacba40993e47ef8302993c59e264e|168|0x8
0|67|libxul.so|mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:56082fc4acfacba40993e47ef8302993c59e264e|577|0xf
0|68|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:56082fc4acfacba40993e47ef8302993c59e264e|1234|0xe
0|69|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:56082fc4acfacba40993e47ef8302993c59e264e|513|0xc
0|70|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:56082fc4acfacba40993e47ef8302993c59e264e|87|0x7
0|71|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|334|0x17
0|72|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|309|0x8
0|73|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:56082fc4acfacba40993e47ef8302993c59e264e|137|0xd
0|74|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:56082fc4acfacba40993e47ef8302993c59e264e|913|0xe
0|75|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:56082fc4acfacba40993e47ef8302993c59e264e|237|0x5
0|76|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|334|0x17
0|77|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:56082fc4acfacba40993e47ef8302993c59e264e|309|0x8
0|78|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:56082fc4acfacba40993e47ef8302993c59e264e|744|0x5
0|79|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:56082fc4acfacba40993e47ef8302993c59e264e|56|0x11
0|80|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:56082fc4acfacba40993e47ef8302993c59e264e|303|0x20
0|81|libc.so.6||||0x21b97
0|82|firefox-bin|mozilla::UniquePtr<mozilla::Bootstrap, mozilla::Bootstrap::BootstrapDelete>::~UniquePtr()|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:56082fc4acfacba40993e47ef8302993c59e264e|253|0x17

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200804091327-7cb90fa4f485.
Failed to bisect testcase (Start build crashes!):
> Start: e8b7c48d4e7ed1b63aeedff379b51e566ea499d9 (20191107015224)
> End: 11e97601cbca5bbe37c95f3272a80e30bbf7fc61 (20200731041113)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/An8RZM19Ilmrd_op14UH2A/index.html

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20201205093858-7ce95b6cde26) but not with tip (mozilla-central 20211203213802-92df9c655be5.)
The bug appears to have been fixed in the following build range:

Start: 6f0d89c7a869767fdf2a852dfb41b9b82e5cac62 (20211105141501)
End: 5d6a85b1788ecb66fef5ea788eba0817e07db9e2 (20211105143150)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6f0d89c7a869767fdf2a852dfb41b9b82e5cac62&tochange=5d6a85b1788ecb66fef5ea788eba0817e07db9e2
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Tyson Smith [:tsmith]]

Is this correct? Is bug 1706266 a fix for this issue?

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

The command which is the trigger of the test is disabled in the Nightly channel. Therefore, the testcase stopped working now. However, it seems that the crash can be triggered by other styling command. Perhaps, we should try to change decreaseFontSize to some other commands whether this is still reproducible or not.