1869325 - Startup Crash in [@ nsContentList::PopulateSelf] via mozilla::dom::Document::DoNotifyPossibleTitleChange | mozilla::dom::Document::GetTitle

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Wayne Mery (:wsmwk)]

We have several startup crashes going through mozilla::dom::Document::DoNotifyPossibleTitleChange | mozilla::dom::Document::GetTitle

• nsContentList::PopulateSelf Crash report: https://crash-stats.mozilla.org/report/index/518f07fb-a72a-4d64-816b-2109d0231206

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  nsContentList::PopulateSelf  dom/base/nsContentList.cpp:885
1  xul.dll  nsContentList::Item  dom/base/nsContentList.cpp:488
2  xul.dll  mozilla::dom::Document::GetTitleElement  dom/base/Document.cpp:9138
3  xul.dll  mozilla::dom::Document::GetTitle  dom/base/Document.cpp:9156
4  xul.dll  mozilla::dom::Document::DoNotifyPossibleTitleChange  dom/base/Document.cpp:9254
5  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply<nsMemoryReporterManager, nsresult  const  xpcom/threads/nsThreadUtils.h:1164
5  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/type_traits:1524
5  xul.dll  std::_Apply_impl  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:974
5  xul.dll  std::apply  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:979
5  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply  xpcom/threads/nsThreadUtils.h:1162

• nsTPromiseFlatString<T>::nsTPromiseFlatString Crash report: https://crash-stats.mozilla.org/report/index/d5568efb-43de-4c23-9a69-c1b1c0231205

Reason: EXCEPTION_PRIV_INSTRUCTION

Top 10 frames of crashing thread:

0  xul.dll  nsTPromiseFlatString<char16_t>::nsTPromiseFlatString  xpcom/string/nsTPromiseFlatString.h:100
0  xul.dll  TPromiseFlatString  xpcom/string/nsTPromiseFlatString.h:119
0  xul.dll  mozilla::places::History::SetURITitle  toolkit/components/places/History.cpp:2101
1  xul.dll  nsDocShell::UpdateGlobalHistoryTitle  docshell/base/nsDocShell.cpp:13445
1  xul.dll  nsDocShell::SetTitle  docshell/base/nsDocShell.cpp:5025
2  xul.dll  mozilla::dom::Document::DoNotifyPossibleTitleChange  dom/base/Document.cpp:9263
3  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply<nsMemoryReporterManager, nsresult  const  xpcom/threads/nsThreadUtils.h:1164
3  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/type_traits:1524
3  xul.dll  std::_Apply_impl  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:974
3  xul.dll  std::apply  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:979

• operator!= Crash report: https://crash-stats.mozilla.org/report/index/20ca938b-48a7-4e0b-847a-60fba0231102

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  RefPtr<nsRunnableMethod<mozilla::dom::Document, void, 0, 0> >::get const  mfbt/RefPtr.h:325
0  xul.dll  operator!=  mfbt/RefPtr.h:576
0  xul.dll  nsRevocableEventPtr<nsRunnableMethod<mozilla::dom::Document, void, 0, 0> >::IsPending  xpcom/threads/nsThreadUtils.h:1640
0  xul.dll  mozilla::dom::Document::DoNotifyPossibleTitleChange  dom/base/Document.cpp:9246
1  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply<nsMemoryReporterManager, nsresult  const  xpcom/threads/nsThreadUtils.h:1164
1  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/type_traits:1524
1  xul.dll  std::_Apply_impl  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:974
1  xul.dll  std::apply  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/tuple:979
1  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply  xpcom/threads/nsThreadUtils.h:1162
1  xul.dll  mozilla::detail::RunnableMethodImpl<nsMemoryReporterManager*, nsresult   xpcom/threads/nsThreadUtils.h:1213

• mozilla::RustCell<T>::RustCell Crash report: https://crash-stats.mozilla.org/report/index/41853395-d13b-4575-8056-2f0d10231121

Reason: EXCEPTION_ILLEGAL_INSTRUCTION

Top 10 frames of crashing thread:

0  xul.dll  mozilla::RustCell<unsigned int>::RustCell  layout/style/RustCell.h:28
0  xul.dll  nsWrapperCache::nsWrapperCache  dom/base/nsWrapperCache.h:93
0  xul.dll  nsINodeList::nsINodeList  dom/base/nsINodeList.h:28
0  xul.dll  nsBaseContentList::nsBaseContentList  dom/base/nsContentList.h:40
0  xul.dll  nsContentList::nsContentList  dom/base/nsContentList.cpp:390
1  xul.dll  mozilla::dom::Document::GetTitleElement  dom/base/Document.cpp:9133
2  xul.dll  mozilla::dom::Document::GetTitle  dom/base/Document.cpp:9156
3  xul.dll  mozilla::dom::Document::DoNotifyPossibleTitleChange  dom/base/Document.cpp:9254
4  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply<nsMemoryReporterManager, nsresult  const  xpcom/threads/nsThreadUtils.h:1164
4  xul.dll  std::invoke  /builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/type_traits:1524

Comment 1

[Magnus Melin [:mkmelin]]

This bug should be somewhere else.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sickish, maybe slower respose)]

There are 24 crashes at mozilla::dom::Document::DoNotifyPossibleTitleChange in this 6 months, but the last reported version is 115. 115 was moved to beta branch at start of June and I find this change which stops using nsContentList to get a <title>.

Emilio, do you think that the patch for bug 1838265 fixed this crash? If yes, could you request uplift the patch to ESR 115 branch?

Comment 3

[Emilio Cobos Álvarez (:emilio)]

At least the first one, yeah

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(sickish, maybe slower respose)]

Thank you!