1667209 - Crash in [@ mozilla::PresShell::DoFlushPendingNotifications] with MOZ_DIAGNOSTIC_ASSERT(!mDocument->GetPresShell())

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Sean Feng [:sefeng211]]

Crash report: https://crash-stats.mozilla.org/report/index/5fe7bc03-3ed9-42bc-871a-ca01d0200924

Top 10 frames of crashing thread:

0 XUL mozilla::PresShell::DoFlushPendingNotifications layout/base/PresShell.cpp:4114
1 XUL nsTypeAheadFind::FindItNow toolkit/components/typeaheadfind/nsTypeAheadFind.cpp:359
2 XUL nsTypeAheadFind::FindInternal toolkit/components/typeaheadfind/nsTypeAheadFind.cpp:1050
3 XUL nsTypeAheadFind::Find toolkit/components/typeaheadfind/nsTypeAheadFind.cpp:933
4 XUL NS_InvokeByIndex 
5 XUL XPCWrappedNative::CallMethod js/xpconnect/src/XPCWrappedNative.cpp:1142
6 XUL XPC_WN_CallMethod js/xpconnect/src/XPCWrappedNativeJSOps.cpp:947
7 XUL js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:600
8 XUL js::jit::DoCallFallback js/src/jit/BaselineIC.cpp:3027
9  @0x7f5145a9da7 

Crash reason is MOZ_DIAGNOSTIC_ASSERT(!mDocument->GetPresShell()) (Where did this shell come from?).

Comment 1

[Emily McDonough [:alaskanemily]]

Emilio, do you know what is happening here?

Comment 2

[Emilio Cobos Álvarez [:emilio]]

Attachment: Bug 1667209 - Make find code keep references to subdocuments, not pres shells. r=smaug

We don't have a repro for this.

Keeping a reference to a PresShell for an arbitrary amount of time is
error prone, because the pres shell could've been detached and even
though the code tried to handle it didn't seem to do it a 100% of the
time.

Also, calling PresShell::FlushPendingNotifications directly is not the
right thing to do anyways because it won't flush ancestor documents as
needed.

This patch fixes both issues by keeping a reference to the subdocument
we're searching rather than to the shell.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/82f55ce06659
Make find code keep references to subdocuments, not pres shells. r=smaug

Comment 4

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/82f55ce06659