1888592 - Crash in [@ WeakFrame::operator nsIFrame*]

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/9010b96f-ee25-4dd1-959d-781dd0240325

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  WeakFrame::operator nsIFrame*  layout/generic/nsIFrame.h:5622
0  libxul.so  nsCaret::SchedulePaint  layout/base/nsCaret.cpp:395
1  libxul.so  mozilla::PresShell::SetCaret  layout/base/PresShell.cpp:2245
2  libxul.so  mozilla::PresShell::RestoreCaret  layout/base/PresShell.cpp:2250
2  libxul.so  mozilla::EditorEventListener::CleanupDragDropCaret  editor/libeditor/EditorEventListener.cpp:976
3  libxul.so  mozilla::EditorEventListener::UninstallFromEditor  editor/libeditor/EditorEventListener.cpp:229
3  libxul.so  mozilla::EditorEventListener::Disconnect  editor/libeditor/EditorEventListener.cpp:207
4  libxul.so  mozilla::EditorBase::RemoveEventListeners  editor/libeditor/EditorBase.cpp:515
4  libxul.so  mozilla::EditorBase::PreDestroyInternal  editor/libeditor/EditorBase.cpp:611
5  libxul.so  mozilla::HTMLEditor::PreDestroy  editor/libeditor/HTMLEditor.cpp:518

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-03-25
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1886506.

[1] https://hg.mozilla.org/mozilla-central/rev?node=73c915ed013b

:emilio, since you are the author of the potential regressor, could you please take a look?

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1888592 - Terminate mOriginalCaret properly, and fix null crash. r=masayuki,sefeng

We have callers that call RestoreCaret after pres shell shut down.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/649ab0049ed7
Terminate mOriginalCaret properly, and fix null crash. r=masayuki

Comment 3

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/649ab0049ed7