1850213 - Assertion failure: mEvent->mCurrentTarget->IsRootWindow(), at dom/events/Event.cpp

Status: VERIFIED FIXED

(Core :: DOM: Events, defect)

Description

[Masatoshi Kimura [:emk]]

Steps to reproduce:

1. Launch a debug build.
2. Open https://gltf-viewer.donmccurdy.com/.
3. Drag a file onto the page from Explorer.

Actual result:
Assertion failure. Apparently I hit this assertion.

Expected result:
No assertions.

I don't know which is wrong, the code or the assertion.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

:sefeng, since you are the author of the regressor, bug 1848409, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Sean Feng [:sefeng211]]

Masatoshi, does the crash happen to you for any gltf file or a specific one? Is this reproducible consistently for you? I tried two gltf files that I downloaded and none of them triggered the crash.

Comment 3

[Masatoshi Kimura [:emk]]

This is reproducible consistently for me. The dragged file does not have to be a gltf file. It might be specific to Windows.

Comment 4

[Masatoshi Kimura [:emk]]

And do not drop a file. Drag a file and hold a mouse button for a little while (until the page crashes).

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1848409

Comment 6

[Andreas Farre [:farre]]

Sean, I have no idea what severity this is, can you set it?

Comment 7

[Pascal Chevrel:pascalc]

Could I get an evaluation of the severity of the bug for our users for 118? Thanks

Comment 8

[Vincent Hilla [:vhilla]]

I get the same failure when dragging a top site on the about:newtab page during a debug build.

Comment 9

[Edgar Chen [:edgar]]

I could also reproduce this consistently on Windows, my STR:

• load https://edgarchen.github.io/dragndropclipboard/
• drag a link to above page from either other window or other application, e.g. Chromium

call stack:

[Inline Frame] xul.dll!AnnotateMozCrashReason(const char * reason) Line 456 C++
xul.dll!mozilla::dom::Event::UpdateDefaultPreventedOnContentForDragEvent() Line 456 C++
xul.dll!mozilla::dom::Event_Binding::preventDefault(JSContext * cx, JS::Handle<JSObject > void_self, void * args, const JSJitMethodCallArgs &) Line 641 C++
xul.dll!mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext * cx, unsigned int argc, JS::Value * vp) Line 3329 C++
xul.dll!CallJSNative(JSContext * cx, bool()(JSContext *, unsigned int, JS::Value *) native, js::CallReason reason, const JS::CallArgs & args) Line 486 C++
xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct, js::CallReason reason) Line 580 C++
xul.dll!js::Interpret(JSContext * cx, js::RunState & state) Line 3396 C++
xul.dll!js::RunScript(JSContext * cx, js::RunState & state) Line 458 C++
xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct, js::CallReason reason) Line 612 C++
xul.dll!js::Call(JSContext * cx, JS::Handle<JS::Value> fval, JS::Handle<JS::Value> thisv, const js::AnyInvokeArgs & args, JS::MutableHandle<JS::Value> rval, js::CallReason reason) Line 679 C++
xul.dll!JS::Call(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> fval, const JS::HandleValueArray & args, JS::MutableHandle<JS::Value> rval) Line 119 C++
xul.dll!mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext & cx, JS::Handle<JS::Value> aThisVal, mozilla::dom::Event & event, mozilla::ErrorResult & aRv) Line 62 C++
xul.dll!mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>(mozilla::dom::EventTarget * const & thisVal, mozilla::dom::Event & event, mozilla::ErrorResult & aRv, const char * aExecutionReason, mozilla::dom::CallbackObject::ExceptionHandling aExceptionHandling, JS::Realm * aRealm) Line 65 C++
xul.dll!mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener * aListener, nsAtom * aTypeAtom, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, bool) Line 1343 C++
xul.dll!mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray * aListeners, nsAtom * aTypeAtom, mozilla::EventMessage aEventMessage, nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, bool aItemInShadowTree) Line 1662 C++
xul.dll!mozilla::EventListenerManager::HandleEventInternal(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus, bool aItemInShadowTree) Line 1559 C++
[Inline Frame] xul.dll!mozilla::EventListenerManager::HandleEvent(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus, bool aItemInShadowTree) Line 465 C++
xul.dll!mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor & aVisitor, mozilla::ELMCreationDetector & aCd) Line 366 C++
xul.dll!mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> & aChain, mozilla::EventChainPostVisitor & aVisitor, mozilla::EventDispatchingCallback * aCallback, mozilla::ELMCreationDetector & aCd) Line 614 C++
xul.dll!mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget * aTarget, nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * aDOMEvent, nsEventStatus * aEventStatus, mozilla::EventDispatchingCallback * aCallback, nsTArray<mozilla::dom::EventTarget *> * aTargets) Line 1222 C++
xul.dll!mozilla::PresShell::EventHandler::DispatchEventToDOM(mozilla::WidgetEvent * aEvent, nsEventStatus * aEventStatus, nsPresShellEventCB * aEventCB) Line 8728 C++
xul.dll!mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager * aEventStateManager, mozilla::WidgetEvent * aEvent, bool aTouchIsNew, nsEventStatus * aEventStatus, nsIContent * aOverrideClickTarget) Line 8322 C++
xul.dll!mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent * aEvent, nsEventStatus * aEventStatus, bool aIsHandlingNativeEvent, nsIContent * aOverrideClickTarget) Line 8255 C++
xul.dll!mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame * aFrameForPresShell, mozilla::WidgetGUIEvent * aGUIEvent, nsEventStatus * aEventStatus, bool aDontRetargetEvents) Line 7171 C++
xul.dll!mozilla::PresShell::EventHandler::HandleEvent(nsIFrame * aFrameForPresShell, mozilla::WidgetGUIEvent * aGUIEvent, bool aDontRetargetEvents, nsEventStatus * aEventStatus) Line 6969 C++
xul.dll!mozilla::PresShell::HandleEvent(nsIFrame * aFrameForPresShell, mozilla::WidgetGUIEvent * aGUIEvent, bool aDontRetargetEvents, nsEventStatus * aEventStatus) Line 6912 C++
xul.dll!nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent * aEvent, nsView * aView, nsEventStatus * aStatus) Line 652 C++
xul.dll!nsView::HandleEvent(mozilla::WidgetGUIEvent * aEvent, bool aUseAttachedEvents) Line 1150 C++
xul.dll!mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent * aEvent, nsEventStatus & aStatus) Line 347 C++
xul.dll!mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent & aEvent) Line 508 C++
[Inline Frame] xul.dll!mozilla::dom::BrowserChild::DispatchWidgetEventViaAPZ(mozilla::WidgetGUIEvent & aEvent) Line 1699 C++
xul.dll!mozilla::dom::BrowserChild::RecvRealDragEvent(const mozilla::WidgetDragEvent & aEvent, const unsigned int & aDragAction, const unsigned int & aDropEffect, nsIPrincipal * aPrincipal, nsIContentSecurityPolicy * aCsp) Line 1937 C++
xul.dll!mozilla::dom::PBrowserChild::OnMessageReceived(const IPC::Message & msg__) Line 6691 C++
xul.dll!mozilla::dom::PContentChild::OnMessageReceived(const IPC::Message & msg__) Line 8704 C++
xul.dll!mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy * aProxy, const IPC::Message & aMsg) Line 1800 C++
xul.dll!mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy * aProxy, mozilla::UniquePtr<IPC::Message,mozilla::DefaultDelete<IPC::Message> > aMsg) Line 1725 C++
xul.dll!mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy * aProxy, mozilla::ipc::MessageChannel::MessageTask & aTask) Line 1525 C++
xul.dll!mozilla::ipc::MessageChannel::MessageTask::Run() Line 1632 C++
xul.dll!mozilla::RunnableTask::Run() Line 560 C++
xul.dll!mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(const mozilla::detail::BaseAutoLock<mozilla::Mutex &> & aProofOfLock) Line 886 C++
xul.dll!mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(const mozilla::detail::BaseAutoLock<mozilla::Mutex &> & aProofOfLock) Line 709 C++
xul.dll!mozilla::TaskController::ProcessPendingMTTask(bool aMayWait) Line 495 C++
[Inline Frame] xul.dll!mozilla::TaskController::TaskController::<lambda_5>::operator()() Line 218 C++
xul.dll!mozilla::detail::RunnableFunction<`lambda at C:\Workspace\mercurial\mozilla-central\xpcom\threads\TaskController.cpp:218:7'>::Run() Line 549 C++
xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 1203 C++
xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 480 C++
xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 85 C++
xul.dll!MessageLoop::RunHandler() Line 364 C++
xul.dll!MessageLoop::Run() Line 346 C++
xul.dll!nsBaseAppShell::Run() Line 150 C++
xul.dll!nsAppShell::Run() Line 639 C++
xul.dll!XRE_RunAppShell() Line 721 C++
xul.dll!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate * aDelegate) Line 235 C++
xul.dll!MessageLoop::RunHandler() Line 364 C++
xul.dll!MessageLoop::Run() Line 346 C++
xul.dll!XRE_InitChildProcess(int aArgc, char * * aArgv, const XREChildData * aChildData) Line 660 C++
[Inline Frame] firefox.exe!content_process_main(mozilla::Bootstrap * bootstrap, int argc, char * * argv) Line 57 C++
firefox.exe!NS_internal_main(int argc, char * * argv, char * * envp) Line 375 C++
firefox.exe!wmain(int argc, wchar_t * * argv) Line 151 C++

Comment 11

[Makoto Kato [:m_kato]]

When calling event.preventDefault on drag event handler, this assertion is hit.

Comment 12

[Makoto Kato [:m_kato]]

Attachment: testcase

Comment 13

[Makoto Kato [:m_kato]]

Attachment: Bug 1850213 - Initialize mInHTMLEditorEventListener. r=masayuki

mInHTMLEditorEventListener isn't initialized during IPC, so this variable is
randomly between multi-process.

Also, I try to write a test for it, but drag and drop tests doesn't seem to
support multi-process.

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1d2ed0b29473
Initialize mInHTMLEditorEventListener. r=masayuki

Comment 15

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/1d2ed0b29473

Comment 16

[Daniel Bodea [:danibodea]]

I have reproduced this issue in Windows 10 with debug build Nightly v122.0a1 (2023-12-15). The tab crashes when performing the steps from comment 0 or comment 12.

The tab crash no longer occurs when performing the said steps on debug build Nightly v123.0a1 (2023-12-19), however, a message is shown "No .gltf or .glb asset found.". When the "OK" button is clicked to dismiss the message, the browser enters a "Not Responding" state for about 5-10 seconds then the loaded tab is closed and it recovers to working normally. On a second try, the loaded website enters an infinite loading sequence, but the browser does not freeze. The test case in comment 12 passes with flying colors: after dropping the blue box into the red rectangle, the message changes to "done" and no crash is observed.

This being said, I believe that the original issue might have been fixed, but the whole situation changed and another issue might have been uncovered. Masatoshi Kimura, do you also think it would be safe to close this report? Should we log the remaining behavior separately? What do you suggest?

Comment 17

[Masatoshi Kimura [:emk]]

(In reply to Daniel Bodea [:danibodea] from comment #16)

When the "OK" button is clicked to dismiss the message, the browser enters a "Not Responding" state for about 5-10 seconds then the loaded tab is closed and it recovers to working normally.

I could not reproduce this.

The tab crash no longer occurs when performing the said steps on debug build Nightly v123.0a1 (2023-12-19), however, a message is shown "No .gltf or .glb asset found.".
On a second try, the loaded website enters an infinite loading sequence, but the browser does not freeze. The test case in comment 12 passes with flying colors: after dropping the blue box into the red rectangle, the message changes to "done" and no crash is observed.

What file did you drop? If it is neither .glb nor .gltf, it is expected.

Comment 19

[Daniel Bodea [:danibodea]]

As a response, neither of the said files were dropped. This being considered, I will close this report as verified. Thank you for your response!