1777496 - Crash in [@ mozilla::dom::HTMLLinkElement::TryDNSPrefetchOrPreconnectOrPrefetchOrPreloadOrPrerender]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

9 crashes from 6 installations of Firefox 104.0a1, crash stack points to bug 1774175 as regressing change.

Crash report: https://crash-stats.mozilla.org/report/index/6e8b96d6-02c4-4f60-b033-672ed0220630

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::HTMLLinkElement::TryDNSPrefetchOrPreconnectOrPrefetchOrPreloadOrPrerender dom/html/HTMLLinkElement.cpp:495
1 xul.dll mozilla::dom::HTMLLinkElement::BindToTree dom/html/HTMLLinkElement.cpp:89
2 xul.dll nsINode::InsertChildBefore dom/base/nsINode.cpp:1579
3 xul.dll static nsINode::CloneAndAdopt dom/base/nsINode.cpp:3211
4 xul.dll static nsINode::CloneAndAdopt dom/base/nsINode.cpp:3382
5 xul.dll static nsINode::CloneAndAdopt dom/base/nsINode.cpp:3382
6 xul.dll static nsINode::CloneAndAdopt dom/base/nsINode.cpp:3382
7 xul.dll mozilla::dom::Document::CreateStaticClone dom/base/Document.cpp:13240
8 xul.dll nsGlobalWindowOuter::Print dom/base/nsGlobalWindowOuter.cpp:5222
9 xul.dll nsGlobalWindowOuter::PrintOuter dom/base/nsGlobalWindowOuter.cpp:5071

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1774175

Comment 2

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

The crash is because ModuleLoader is null, so calling SetAcquiringImportMaps(false) will have SEGV Fault, I'll check why the ModuleLoader is null when trying to print the document.

Comment 3

[Yoshi Cheng-Hao Huang [:allstars.chh][:allstarschh][:yoshi]]

Attachment: Bug 1777496 - Check if ModuleLoader exists before calling SetAcquiringImportMaps.

For the print preview documents, they are cloned from the original document in
Document::CreateStaticClone1. But the cloned document isn't attched to any
nsIContentViewer yet so it won't have any global object. The document is
attached to the nsIContentViewer later when the cloning is done2.

Also, the script elements from the cloned document are also cloned from
the original document, so they won't be processed in the cloned document.

Therefore we simply bail out if the module loader isn't initialized yet.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/635806b9356c
Check if ModuleLoader exists before calling SetAcquiringImportMaps. r=smaug

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/635806b9356c