1904098 - Crash in [@ mozilla::dom::ClipboardItem::ItemEntry::RejectPendingPromises]

Status: NEW

(Core :: DOM: Copy & Paste and Drag & Drop, defect, P2)

Description

[Ryan VanderMeulen [:RyanVM]]

Crash report: https://crash-stats.mozilla.org/report/index/4f3a0d73-bbee-4f89-aa39-c2eed0240621

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(!mIsLoadingData && !mTransferable) (Should not be in the process of loading data)

Top 10 frames:

0  xul.dll  mozilla::dom::ClipboardItem::ItemEntry::RejectPendingPromises(nsresult)  dom/events/ClipboardItem.cpp:227
1  xul.dll  mozilla::dom::ClipboardItem::ItemEntry::~ItemEntry()  dom/events/ClipboardItem.h:72
2  xul.dll  mozilla::dom::ClipboardItem::ItemEntry::DeleteCycleCollectable()  dom/events/ClipboardItem.cpp:30
2  xul.dll  mozilla::dom::ClipboardItem::ItemEntry::cycleCollection::DeleteCycleCollectab...  dom/events/ClipboardItem.h:37
3  xul.dll  SnowWhiteKiller::MaybeKillObject(SnowWhiteKiller::SnowWhiteObject&)  xpcom/base/nsCycleCollector.cpp:2512
3  xul.dll  SnowWhiteKiller::Visit(nsPurpleBuffer&, nsPurpleBufferEntry*)  xpcom/base/nsCycleCollector.cpp:2537
3  xul.dll  nsPurpleBuffer::VisitEntries<SnowWhiteKiller>(SnowWhiteKiller&)  xpcom/base/nsCycleCollector.cpp:977
4  xul.dll  nsCycleCollector::FreeSnowWhiteWithBudget(js::SliceBudget&)  xpcom/base/nsCycleCollector.cpp:2705
4  xul.dll  nsCycleCollector_doDeferredDeletionWithBudget(js::SliceBudget&)  xpcom/base/nsCycleCollector.cpp:3995
4  xul.dll  AsyncFreeSnowWhite::Run()  js/xpconnect/src/XPCJSRuntime.cpp:158

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 content process crashes on beta

:hsinyi, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 2

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Looking at the crash reports, 20 out of 22 crashes on 128.0b5 were actually coming from a single build. So it seems not a "valid" top-crash to me, S3 still rounds right, but I'd delegate to Edgar to make a call.

Comment 3

[Edgar Chen [:edgar]]

The MOZ_DIAGNOSTIC_ASSERT is to catch a problem if the clipboard item somehow resolves or rejects the promise while the data is still loading from the clipboard source.

I checked recent 5 crash reports,

• https://crash-stats.mozilla.org/report/index/75a3d686-9a6d-42c6-be9b-05c510240625
• https://crash-stats.mozilla.org/report/index/3a9eec8d-7d77-44a4-97f9-a4ca00240625
• https://crash-stats.mozilla.org/report/index/0afbafc3-807c-4765-b29a-4fd3c0240625
• https://crash-stats.mozilla.org/report/index/8ed26b18-1523-45f4-92f9-b8f480240625
• https://crash-stats.mozilla.org/report/index/d82eee20-b580-4a8d-a09c-25bc00240625

All the crashes happen when the clipboard item is cycle collected during loading the clipboard data. I think it is expected to reject the pending promise in such case, so it is kind of a false alarm. But yes, we should not assert in this case.

Comment 4

[Edgar Chen [:edgar]]

Attachment: Bug 1904098 - Reset the loading state when `ItemEntry` is being destroyed; r?#dom-core,nika

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.