1729805 - Crash in [@ nsXULPopupManager::BeginShowingPopup]

Status: VERIFIED FIXED

(Core :: XUL, defect)

Description

[u608768]

Crash report: https://crash-stats.mozilla.org/report/index/db781e2b-ca56-47fc-ac07-44a5c0210907

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so nsXULPopupManager::BeginShowingPopup layout/xul/nsXULPopupManager.cpp:1550
1 libxul.so mozilla::detail::RunnableFunction<nsXULPopupManager::ShowMenu xpcom/threads/nsThreadUtils.h:531
2 libxul.so mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:805
3 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1148
4 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85
5 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:306
6 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
7 libxul.so nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:284
8 libxul.so XREMain::XRE_mainRun toolkit/xre/nsAppRunner.cpp:5291
9 libxul.so XREMain::XRE_main toolkit/xre/nsAppRunner.cpp:5476

A number of reports with this signature in the last few months.

Comment 1

[Maxx Crawford [:maxx]]

The Firefox Relay QA team came across this issue when testing out a new release of the Relay add-on. https://github.com/mozilla/fx-private-relay-add-on/issues/241

Comment 2

[:Gijs (he/him)]

From the relay ticket:

Steps to reproduce:

Navigate to Stage server and log in to Firefox Relay.
Create some aliases from dashboard and generate some from other websites (facebook, reddit).
Disable an alias.
Go back to Reddit page, refresh it and open the context menu.
Click Firefox Relay to see the submenus and look in each of them.
Enable the alias.
Repeat steps 4 and 5.
Delete aliases.
Repeat steps 4 and 5.

Actual result:
Firefox browser crashes.

Expected result:
Firefox browser doesn't crash.

Note:
Was not able to figure out some clear steps for this issue. It is not always reproducible but I was able to reproduce it a few times.
I played a lot with the aliases and looked in the context menu for facebook and reddit and at some point when I got to reddit and clicked Firefox Relay in the menu it crashed.

Neil, can you help look into this?

Comment 3

[Neil Deakin]

From the stack trace, I think this is what Emilio was fixing in https://phabricator.services.mozilla.com/D131082 but the work was abandoned. Maybe he can make an update?

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1729805 - Make async OpenMenu simpler/sound. r=mstange

There's only one caller of it and it's not sound: The runnable captures a
raw frame pointer etc. Instead, just do a dispatch to the main thread
and call OpenMenu there. This simplifies the following patch.

Comment 5

[Maxx Crawford [:maxx]]

Quick note - Relay's QA ran into this issue again this morning with a different yet related crash report: https://crash-stats.mozilla.org/report/index/e11729f0-e67c-4d8e-9ddc-5bdde0220125

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Hard to see how that stack is related. Could be if there's some corruption happening though, I guess. Patch is up for review, once it lands if you can test again and confirm that crash doesn't happen it'd be great.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/af391f569e58
Make async OpenMenu simpler/sound. r=NeilDeakin,mstange

Comment 8

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/af391f569e58

Comment 9

[Maxx Crawford [:maxx]]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #6)

Hard to see how that stack is related. Could be if there's some corruption happening though, I guess. Patch is up for review, once it lands if you can test again and confirm that crash doesn't happen it'd be great.

Will do! Thanks for working on this. My team and I appreciate it.

Comment 10

[:Gijs (he/him)]

(In reply to Maxx Crawford [:mcrawford :maxx :maxxcrawford] from comment #9)

(In reply to Emilio Cobos Álvarez (:emilio) from comment #6)

Hard to see how that stack is related. Could be if there's some corruption happening though, I guess. Patch is up for review, once it lands if you can test again and confirm that crash doesn't happen it'd be great.

Will do! Thanks for working on this. My team and I appreciate it.

Leaving needinfo to confirm the crashing with relay is fixed on today's (or late yesterday's) nightly. :-)

Comment 11

[Maxx Crawford [:maxx]]

Confirmed with the QA team that this is no longer reproducible on our end. Thanks, everyone!