1884047 - Crash in [@ mozilla::dom::syncedcontext::Transaction<T>::Commit | mozilla::dom::BrowsingContext::SetExplicitActive]

Status: NEW

(Core :: DOM: Navigation, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/df9bba82-83e2-47a1-a867-4d0300240302

MOZ_CRASH Reason: CanSet failed for field(s): ExplicitActive

Top 10 frames of crashing thread:

0  libxul.so  MOZ_Crash  mfbt/Assertions.h:301
0  libxul.so  mozilla::dom::syncedcontext::Transaction<mozilla::dom::BrowsingContext>::Commit  docshell/base/SyncedContextInlines.h:103
1  libxul.so  mozilla::dom::BrowsingContext::SetExplicitActive  docshell/base/BrowsingContext.h:290
2  libxul.so  mozilla::dom::BrowsingContext::SetExplicitActive  docshell/base/BrowsingContext.h:290
2  libxul.so  mozilla::dom::CanonicalBrowsingContext::SetIsActiveInternal  docshell/base/CanonicalBrowsingContext.h:359
2  libxul.so  mozilla::dom::CanonicalBrowsingContext::SetIsActive  docshell/base/CanonicalBrowsingContext.h:355
2  libxul.so  mozilla::dom::CanonicalBrowsingContext_Binding::set_isActive  dom/bindings/BrowsingContextBinding.cpp:5348
3  libxul.so  mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>  dom/bindings/BindingUtils.cpp:3206
4  libxul.so  CallJSNative  js/src/vm/Interpreter.cpp:479
4  libxul.so  js::InternalCallOrConstruct  js/src/vm/Interpreter.cpp:573

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-02-14
• Process type: Parent
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - 4 out of 5 crashes happened on null or near null memory address

Comment 1

[Mayank Bansal]

Bug 1892593 has a STR that produces crash with the same signature.