1749696 - Crash in [@ mozilla::dom::AutoJSAPI::Init | nsQueryJSActor::operator() ]

Status: RESOLVED WORKSFORME

(Core :: DOM: Navigation, defect, P3)

Description

[fzczx123]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/bf4c1390-61f2-44de-830e-a73910220112

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0 XUL mozilla::dom::AutoJSAPI::Init dom/script/ScriptSettings.cpp:437
1 XUL nsQueryJSActor::operator const dom/ipc/jsactor/nsQueryActor.h:37
2 XUL nsCOMPtr_base::assign_from_helper xpcom/base/nsCOMPtr.cpp:109
3 XUL nsWindowRoot::GetControllerForCommand dom/base/nsWindowRoot.cpp:226
4 XUL mozilla::EventStateManager::DoContentCommandEvent dom/events/EventStateManager.cpp:5977
5 XUL mozilla::EventStateManager::PreHandleEvent dom/events/EventStateManager.cpp:920
6 XUL mozilla::PresShell::EventHandler::DispatchEvent layout/base/PresShell.cpp:8247
7 XUL mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo layout/base/PresShell.cpp:8216
8 XUL mozilla::PresShell::EventHandler::HandleEventWithFrameForPresShell layout/base/PresShell.cpp:8049
9 XUL mozilla::PresShell::HandleEvent layout/base/PresShell.cpp:6880

Comment 1

[fzczx123]

This bug can be triggered a lot more frequently if I navigate back and forth a lot via right clicking the "go back" or "go forward" button.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jwatt, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Hiroyuki Ikezoe (:hiro)]

This is also a Fission event handling issue. Moving into DOM:Events. CCing Edgar.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Not sure about component, but not DOM: Events. Something going wrong in controller actor handling.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 6

[Andrew McCreight [:mccr8]]

The recent failures look to be mostly on Fenix. Maybe it looks like ModuleLoaderBase is trying to call AutoJSAPI::Init with a null object?

Jon, any ideas? Maybe we're missing a null check somewhere?

Comment 7

[Andrew McCreight [:mccr8]]

Also this signature is really generic and should be added to the prefix list.

Comment 8

[Andrew McCreight [:mccr8]]

Never mind, I'll file a new bug, as this looks to be something different.

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

On macOS, we use:

• eContentCommandPasteTransferable for "Services" menu, vaildRequesterForSendType and readSelectionFromPasteboard
• eContentCommandDelete for inserting empty composition when there is non-collapsed selection
• eContentCommandLookUpDictionary for supporting dictionary search from 3-finter-tap

The others are not used in macOS except synthesizing it with nsIDOMWindowUtils.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

On Windows, we use eContentCommandCopy, eContentCommandCut, eContentCommandPaste, eContentCommandUndo, eContentCommandRedo when they are called via native message of Win32 API or user uses multimedia keyboard or mouse which has corresponding key/button.

Comment 11

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

On Android, only eContentCommandDelete is used for deleting text when it does not start composition, but wants to delete selected text.

Comment 12

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Olli, did you change severity from S3 to N/A accidentally?

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Hmm, I think so.

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.