1897626 - Crash in [@ mozilla::detail::WeakReference::get]

Status: RESOLVED DUPLICATE of bug 1897322

(Core :: Layout, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/c41be11f-22ba-42bc-ade6-552930240516

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::detail::WeakReference::get const  mfbt/WeakPtr.h:185
0  xul.dll  mozilla::WeakPtr<nsDocShell, 0>::get const  mfbt/WeakPtr.h:303
0  xul.dll  mozilla::WeakPtr<nsDocShell, 0>::operator nsDocShell* const  mfbt/WeakPtr.h:304
0  xul.dll  mozilla::dom::Document::GetDocShell const  dom/base/Document.cpp:16564
0  xul.dll  nsPresContext::GetDocShell const  layout/base/nsPresContext.cpp:1652
0  xul.dll  mozilla::PresShell::DoFlushPendingNotifications  layout/base/PresShell.cpp:4283
1  xul.dll  mozilla::PresShell::FlushPendingNotifications  layout/base/PresShell.h:1464
1  xul.dll  nsRefreshDriver::FlushLayoutOnPendingDocsAndFixUpFocus  layout/base/nsRefreshDriver.cpp:2240
2  xul.dll  nsRefreshDriver::Tick  layout/base/nsRefreshDriver.cpp:2742
3  xul.dll  mozilla::RefreshDriverTimer::TickDriver  layout/base/nsRefreshDriver.cpp:367

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-05-16
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

By analyzing the backtrace, the regression may have been introduced by a patch [1] to fix Bug 1896593.

[1] https://hg.mozilla.org/mozilla-central/rev?node=e88bed5f3358

:emilio, since you are the author of the potential regressor, could you please take a look?