1667902 - Crash in [@ mozilla::dom::Document::CloneDocHelper]

Status: RESOLVED DUPLICATE of bug 1665792

(Core :: DOM: Core & HTML, defect)

Description

[Wayne Mery (:wsmwk)]

+++ This bug was initially created as a clone of Bug #1662090 +++

After fixing Bug #1662090 we still have a topcrash, though this time it is EXCEPTION_ACCESS_VIOLATION_READ, not EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

bp-8ebf0c72-f0d7-436d-80a3-902730200928 82 beta1

Top 10 frames of crashing thread:

0 	xul.dll	mozilla::dom::Document::CloneDocHelper(mozilla::dom::Document*) const	dom/base/Document.cpp:11195
1 	xul.dll	nsHTMLDocument::Clone(mozilla::dom::NodeInfo*, nsINode**) const	dom/html/nsHTMLDocument.cpp:673
2 	xul.dll	static nsINode::CloneAndAdopt(nsINode*, bool, bool, nsNodeInfoManager*, JS::Handle<JSObject*>, nsINode*, mozilla::ErrorResult&)	dom/base/nsINode.cpp:3103
3 	xul.dll	nsINode::CloneNode(bool, mozilla::ErrorResult&)	dom/base/nsINode.cpp:2981
4 	xul.dll	mozilla::dom::Document::CreateStaticClone(nsIDocShell*, nsIContentViewer*, bool*)	dom/base/Document.cpp:12293
5 	xul.dll	nsGlobalWindowOuter::Print(nsIPrintSettings*, nsIWebProgressListener*, nsIDocShell*, nsGlobalWindowOuter::IsPreview, nsGlobalWindowOuter::BlockUntilDone, std::function<void (const mozilla::dom::PrintPreviewResultInfo&)>&&, mozilla::ErrorResult&)	dom/base/nsGlobalWindowOuter.cpp:5450
6 	xul.dll	nsFrameLoader::Print(unsigned long long, nsIPrintSettings*, mozilla::ErrorResult&)	dom/base/nsFrameLoader.cpp:3356
7 	xul.dll	mozilla::dom::FrameLoader_Binding::print_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&)	dom/bindings/FrameLoaderBinding.cpp:992
8 	xul.dll	mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*)	dom/bindings/BindingUtils.cpp:3229
9 	xul.dll	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)	js/src/vm/Interpreter.cpp:600
10 	xul.dll	Interpret(JSContext*, js::RunState&)	js/src/vm/Interpreter.cpp:3337
11 	xul.dll	js::RunScript(JSContext*, js::RunState&)	js/src/vm/Interpreter.cpp:469
12 	xul.dll	js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)	js/src/vm/Interpreter.cpp:637 

Comment 1

[Magnus Melin [:mkmelin]]

https://hg.mozilla.org/releases/mozilla-beta/file/tip/dom/html/nsHTMLDocument.cpp#l673 ->
https://hg.mozilla.org/releases/mozilla-beta/file/tip/dom/base/Document.cpp#l11195 which is

RefPtr<nsDOMNavigationTiming> timing = mTiming->CloneNavigationTime(nsDocShell::Cast(clone->GetDocShell()));

Probably mTiming is null.
I'd think the https://hg.mozilla.org/releases/mozilla-beta/file/tip/dom/base/Document.cpp#l11193 assertion should be turned into an error since it would always crash anyway going forwards there. But there is some bug there too in that mTiming doesn't get set as expected.