1863179 - Crash in [@ nsMenuGroupOwnerX::RegisterForContentChanges]

Status: NEW

(Core :: Widget: Cocoa, defect, P3)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/50303815-00a3-472d-8d77-81a990231031

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames of crashing thread:

0  XUL  PLDHashTable::EntryStore::IsAllocated const  xpcom/ds/PLDHashTable.h:327
0  XUL  PLDHashTable::Search const  xpcom/ds/PLDHashTable.cpp:495
1  XUL  nsTHashtable<nsBaseHashtableET<nsPtrHashKey<nsIContent>, nsChangeObserver*> >::GetEntry const  xpcom/ds/nsTHashtable.h:289
1  XUL  nsTHashtable<nsBaseHashtableET<nsPtrHashKey<nsIContent>, nsChangeObserver*> >::Contains const  xpcom/ds/nsTHashtable.h:297
1  XUL  nsMenuGroupOwnerX::RegisterForContentChanges  widget/cocoa/nsMenuGroupOwnerX.mm:142
2  XUL  nsMenuItemX::nsMenuItemX  widget/cocoa/nsMenuItemX.mm:44
2  XUL  nsMenuItemX::nsMenuItemX  widget/cocoa/nsMenuItemX.mm:35
2  XUL  mozilla::MakeRefPtr<nsMenuItemX, nsMenuX*, nsTAutoStringN<char16_t,   mfbt/RefPtr.h:642
2  XUL  nsMenuX::CreateMenuItem  widget/cocoa/nsMenuX.mm:900
3  XUL  nsMenuX::CreateMenuChild  widget/cocoa/nsMenuX.mm:866

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2023-09-25
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1845407.

[1] https://hg.mozilla.org/mozilla-central/rev?node=275d06a26aff

:eeejay, since you are the author of the potential regressor, could you please take a look?