1778476 - Crash in [@ mozilla::PresShell::ElementStateChanged]

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect, P3)

Description

[Sylvestre Ledru [:Sylvestre]]

I was on my bank website https://clients.boursorama.com/connexion/saisie-mot-de-passe
and it crashed when I changed tab

Crash report: https://crash-stats.mozilla.org/report/index/f4e20574-9b04-4547-9c9a-478f50220707

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!mInStyleRefresh)

Top 10 frames of crashing thread:

0 libxul.so mozilla::PresShell::ElementStateChanged layout/base/PresShell.cpp:4453
1 libxul.so mozilla::dom::HTMLInputElement::OnValueChanged dom/html/HTMLInputElement.cpp:6723
2 libxul.so mozilla::TextControlState::SetValue dom/html/TextControlState.cpp:2743
3 libxul.so mozilla::TextControlState::UnbindFromFrame dom/html/TextControlState.cpp:2506
4 libxul.so nsTextControlFrame::DestroyFrom layout/forms/nsTextControlFrame.cpp:148
5 libxul.so nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:480
6 libxul.so nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:480
7 libxul.so nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:480
8 libxul.so nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:480
9 libxul.so nsBlockFrame::DestroyFrom layout/generic/nsBlockFrame.cpp:480

Comment 1

[Sylvestre Ledru [:Sylvestre]]

According to crash stop, it started only recently (early June)

Comment 2

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Could this be regressed by https://bugzilla.mozilla.org/show_bug.cgi?id=1773070 ?

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Not really. This means that there's a state mismatch between the text control state and the input element. We've seen such things in the past, but it's hard to debug without a repro.

It's only a diagnostic assert so it doesn't affect release users but it'd be great to have a repro for this. Is this signature something fuzzers might have seen?

Comment 4

[Jason Kratzer [:jkratzer]]

No, unfortunately not.

Comment 5

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Move to S3 as it doesn't affect release users.
P3 - Would love to have a repro for this, but it's hard to take actions without that for now.

Comment 6

[Makoto Kato [:m_kato]]

bp-3143def0-f7d2-474d-ae43-0975d0221008 seems to be same reason since function name is changed by bug 1773070.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.