1845198 - Crash in [@ mozilla::ContentCache::AssertIfInvalid]

Status: RESOLVED WORKSFORME

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/4d79bac7-7383-44ff-a395-085770230718

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(false) (Invalid ContentCache data)

Top 10 frames of crashing thread:

0  xul.dll  mozilla::ContentCache::AssertIfInvalid const  widget/ContentCache.cpp:110
1  xul.dll  mozilla::ContentCacheInChild::CacheCaret  widget/ContentCache.cpp:271
2  xul.dll  mozilla::ContentCacheInChild::SetSelection  widget/ContentCache.cpp:686
3  xul.dll  mozilla::widget::PuppetWidget::NotifyIMEOfSelectionChange  widget/PuppetWidget.cpp:837
4  xul.dll  mozilla::widget::TextEventDispatcher::NotifyIME  widget/TextEventDispatcher.cpp:456
5  xul.dll  nsBaseWidget::NotifyIME  widget/nsBaseWidget.cpp:1901
6  xul.dll  mozilla::IMEStateManager::NotifyIME  dom/events/IMEStateManager.cpp:2123
7  xul.dll  mozilla::IMEContentObserver::IMENotificationSender::SendSelectionChange  dom/events/IMEContentObserver.cpp:1924
8  xul.dll  mozilla::IMEContentObserver::IMENotificationSender::Run  dom/events/IMEContentObserver.cpp:1747
9  xul.dll  nsRefreshDriver::Tick  layout/base/nsRefreshDriver.cpp:2534

This crash was found by suhaib's experimental automatic crash filing work.

This looks like logging adding in bug 1841466. There are two crashes so far. This one has the comment "i literally was just editing text and highlighted in blue and clicked delete"

The other crash is bp-1904eeb8-ae8d-4e80-8c25-a833f0230718

Masayuki, you might be interested in this.

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sickish, maybe slower respose)]

Oh, yeah...

ContentCache={ mText={ Length()=0 }, mSelection={ mAnchor=33, mFocus=33 }, mCaret={ mOffset=33 }, mTextRectArray=Nothing, mCompositionStart=Nothing }

So, it seems that the instance has not received text change notifications, but starts to retrieve the latest selection. However, I fixed a lot of cases, so, I have no idea how to reproduce this, but I'll try to investigate.

Comment 2

[Mayank Bansal]

Bug 1870958 has a fuzz testcase

Comment 3

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sickish, maybe slower respose)]

(In reply to Mayank Bansal from comment #2)

Bug 1870958 has a fuzz testcase

Thank you, but the testcase is really tricky. Therefore, I'm not sure whether the cause(s) of crash reports are also fixed by the coming patch.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.