1899505 - Crash in [@ mozilla::ScrollContainerFrame::ScrollbarActivityStarted]

Status: VERIFIED FIXED

(Core :: Layout: Scrolling and Overflow, defect)

Description

[Oana Botisan, Desktop QA]

Crash report: https://crash-stats.mozilla.org/report/index/df618686-06ec-4fbd-b9bd-bdeb20240529

Reason: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS

Top 10 frames:

0  XUL  RefPtr<mozilla::layout::ScrollbarActivity>::operator bool() const  mfbt/RefPtr.h:338
0  XUL  mozilla::ScrollContainerFrame::ScrollbarActivityStarted() const  layout/generic/ScrollContainerFrame.cpp:307
1  XUL  mozilla::EventStateManager::PostHandleEvent(nsPresContext*, mozilla::WidgetEv...  dom/events/EventStateManager.cpp:4100
2  XUL  mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager*, ...  layout/base/PresShell.cpp:8499
3  XUL  mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::Wi...  layout/base/PresShell.cpp:8416
4  XUL  mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame*, mozi...  layout/base/PresShell.cpp:7246
5  XUL  mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, ns...  layout/base/PresShell.cpp:6993
6  XUL  nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*)  view/nsViewManager.cpp:654
7  XUL  nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool)  view/nsView.cpp:1113
8  XUL  nsChildView::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&)  widget/cocoa/nsChildView.mm:1300

Found in

• Nightly 128.0a1

Affected versions
** Nightly 128.0a1

Tested platforms

• Affected platforms: macOS 12, macOS 14
• Unaffected platforms: Windows

Steps to reproduce

1. Open several sites in different tabs
2. While the New tab is in focus access Hamburger menu -> History
3. Scroll through the history

Expected result

• Nothing happens

Actual result

• Firefox crashes

Regression range

• If this is a regression I will try to find it as soon as possible.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

:TYLin, since you are the author of the regressor, bug 1896516, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Fixed by backout of bug 1896516.

Comment 3

[Ting-Yu Lin [:TYLin] (PST, UTC-8)]

The Steps to reproduce in comment 0 is really helpful. I can reproduce it constantly on macOS if I use trackpad to do horizontal scrolls in History in step 3.

Comment 4

[Monica Chiorean]

I was able to reproduce the issue on Mac 12.6 using FF build from description. Verified as fixed on Mac 12.6 using FF build 129.0a1 and 128.0b5.