1751687 - Crash in [@ mozilla::PresShell::AccessibleCaretEnabled]

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

8 crashes from 3+ installations on macOS with Firefox 97+, 1 crash on Windows with Firefox 95.0.2

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/b9500bc1-1cbc-487b-86dd-82cdb0220122

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(IsAtomic<bool>::value || NS_IsMainThread()) (Non-atomic static pref 'layout.accessiblecaret.enabled' being accessed on background thread by getter)

Top 10 frames of crashing thread:

0 XUL mozilla::PresShell::AccessibleCaretEnabled layout/base/PresShell.cpp:763
1 XUL mozilla::PresShell::EventHandler::MaybeHandleEventWithAccessibleCaret layout/base/PresShell.cpp:7360
2 XUL mozilla::PresShell::EventHandler::HandleEvent layout/base/PresShell.cpp:6909
3 XUL mozilla::PresShell::HandleEvent layout/base/PresShell.cpp:6880
4 XUL nsViewManager::DispatchEvent view/nsViewManager.cpp:685
5 XUL nsView::HandleEvent view/nsView.cpp:1129
6 XUL nsChildView::DispatchEvent widget/cocoa/nsChildView.mm:1277
7 XUL nsBaseWidget::DispatchWindowEvent widget/nsBaseWidget.cpp:1152
8 XUL -[ChildView validRequestorForSendType:returnType:] widget/cocoa/nsChildView.mm:4520
9 AppKit +[NSServicesMenuHandler _requestorStartingWithChain:forProposedSendTypes:proposedReturnTypes:sendTypes:returnTypes:] 

Comment 1

[Emilio Cobos Álvarez (:emilio)]

We're dispatching events to the PresShell off the main thread, that looks terrible. Markus do you know how this can happen?

Comment 2

[Markus Stange [:mstange]]

Uhh, okay, our implementation of validRequestorForSendType clearly does not expect that it might be called on a non-main thread. The documentation is silent on this topic.

I'll write up a patch which bails out when it's called on a non-main thread.

Comment 3

[Markus Stange [:mstange]]

Attachment: Bug 1751687 - Return early from validRequestorForSendType if it's called on a non-main thread. r=spohl

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8cb99584605b
Return early from validRequestorForSendType if it's called on a non-main thread. r=spohl

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/8cb99584605b

Comment 6

[Markus Stange [:mstange]]

Comment on attachment 9260486 [details]
Bug 1751687 - Return early from validRequestorForSendType if it's called on a non-main thread. r=spohl

Beta/Release Uplift Approval Request

• User impact if declined: rare crashes at random times if the OS wants to update the services menu
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: no STR, we only saw this in crash reports
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): just early returns
• String changes made/needed: none

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9260486 [details]
Bug 1751687 - Return early from validRequestorForSendType if it's called on a non-main thread. r=spohl

Approved for 97.0b9.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/765b43dfa204