1749690 - Crash in [@ NS_CycleCollectorSuspect3 | mozilla::EventStateManager::AddRef]

Status: RESOLVED DUPLICATE of bug 1751687

(Core :: Widget: Cocoa, defect)

Description

[fzczx123]

Nondeterministic--happens few times a day, no particular pattern. I saw the bug both in Firefox 95 and 96 (all stable).

Tried "Refresh Firefox", and it didn't help.

It seems from the stack trace that it could be related to the GUI menu, although I'm not too sure. The bug is therefore left as to be triaged.

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/ddb4aacb-57c9-42c4-a52e-18d790220112

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL NS_CycleCollectorSuspect3 xpcom/base/nsCycleCollector.cpp:3758
1 XUL mozilla::EventStateManager::AddRef dom/events/EventStateManager.cpp:382
2 XUL mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo layout/base/PresShell.cpp:8175
3 XUL mozilla::PresShell::EventHandler::HandleEventWithFrameForPresShell layout/base/PresShell.cpp:8049
4 XUL mozilla::PresShell::HandleEvent layout/base/PresShell.cpp:6880
5 XUL nsViewManager::DispatchEvent view/nsViewManager.cpp:685
6 XUL nsView::HandleEvent view/nsView.cpp:1129
7 XUL -[ChildView validRequestorForSendType:returnType:] widget/cocoa/nsChildView.mm:4671
8 AppKit +[NSServicesMenuHandler _requestorStartingWithChain:forProposedSendTypes:proposedReturnTypes:sendTypes:returnTypes:] 
9 None @0x267a8001a85283cc 

Comment 1

[fzczx123]

This might be better filed as a Core bug but I'm not quite sure.

Comment 2

[fzczx123]

Similar crash reports https://crash-stats.mozilla.org/signature/?product=Firefox&signature=NS_CycleCollectorSuspect3%20%7C%20mozilla%3A%3AEventStateManager%3A%3AAddRef&date=%3E%3D2022-01-05T12%3A37%3A00.000Z&date=%3C2022-01-12T12%3A37%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_columns=startup_crash&_sort=-date&page=1

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Layout' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 4

[fzczx123]

This bug can be triggered a lot more frequently if I navigate back and forth a lot via right clicking the "go back" or "go forward" button.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jwatt, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Hiroyuki Ikezoe (:hiro)]

Let's start with DOM:Event component. CCing Edgar who is the best person about Fission event handling (I think).

Comment 7

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to fzczx123 from comment #4)

This bug can be triggered a lot more frequently if I navigate back and forth a lot via right clicking the "go back" or "go forward" button.

Quick glancing over the crash stacks, I'm not sure if this is SHIP related. However, I'm flagging you here due to this plausible reproduce steps in case it rings any bell.

Comment 8

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Putting severity S3 due to the very low volume and not appearing in the release for more than a month.

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Isn't this esr91, mostly. That shouldn't have SHIP.
This looks more like some Mac specific timing issue. Do we have get some messages from Mac widget layer when Gecko has already been effectively closed? Or is not up and running yet?

Comment 10

[Andrew McCreight [:mccr8]]

This looks like a dupe of bug 1751687, which has been fixed in 97.