1660537 - Crash in [@ nsFrameLoader::GetWindowDimensions]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[u608768]

Crash report: https://crash-stats.mozilla.org/report/index/9792dd15-fd37-4897-94fb-f91a40200820

Top 10 frames of crashing thread:

0 xul.dll nsFrameLoader::GetWindowDimensions dom/base/nsFrameLoader.cpp:2321
1 xul.dll nsFrameLoader::UpdatePositionAndSize dom/base/nsFrameLoader.cpp:2360
2 xul.dll nsSubDocumentFrame::ReflowFinished layout/generic/nsSubDocumentFrame.cpp:757
3 xul.dll mozilla::PresShell::HandlePostedReflowCallbacks layout/base/PresShell.cpp:3977
4 xul.dll mozilla::PresShell::DidDoReflow layout/base/PresShell.cpp:9431
5 xul.dll mozilla::PresShell::ProcessReflowCommands layout/base/PresShell.cpp:9826
6 xul.dll mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4239
7 xul.dll mozilla::dom::Document::FlushPendingNotifications dom/base/Document.cpp:10088
8 xul.dll mozilla::dom::Document::FlushPendingNotifications dom/base/Document.cpp:10084
9 xul.dll nsIContent::GetPrimaryFrame dom/base/Element.cpp:234

Pretty low volume, we've been seeing a few of these since 20200630195452.

Comment 1

[Andrew McCreight (out of office until 8/21) [:mccr8]]

This looks like it might be a missing null check on mOwnerContent on this line:
Document* doc = mOwnerContent->GetComposedDoc();

Comment 2

[Andrew McCreight (out of office until 8/21) [:mccr8]]

Do you want to write a patch for the null check, Kashav? If not, I could do it. I'm not familiar with this code, but it looks like a number of the other accesses of this field null check it.

Comment 3

[u608768]

Sure, I can do it.

Comment 4

[u608768]

Attachment: Bug 1660537 - Null check mOwnerContent in GetWindowDimensions, r?smaug

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c1105c441dfa
Null check mOwnerContent in GetWindowDimensions, r=smaug

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/c1105c441dfa

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR78 approval when you get a chance.

Comment 8

[u608768]

Comment on attachment 9171464 [details]
Bug 1660537 - Null check mOwnerContent in GetWindowDimensions, r?smaug

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Fixes a long-standing crash.
• User impact if declined: Crashes (relatively low volume, so not a huge impact)
• Fix Landed on Version: 81
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Not risky. Adds a null pointer check that avoids the crash.
• String or UUID changes made by this patch:

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9171464 [details]
Bug 1660537 - Null check mOwnerContent in GetWindowDimensions, r?smaug

Approved for 78.3esr.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/aabdc823a2ed