1949062 - Crash in [@ mozilla::dom::NavigationHistoryEntry::Key]

Status: RESOLVED DUPLICATE of bug 1979080

(Core :: DOM: Navigation, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

52 crashes from 3-8 installs of Firefox 137.0a1 on Windows and Ubuntu

Crash report: https://crash-stats.mozilla.org/report/index/3d8c551c-5bcc-48ae-b16d-086a70250218

Reason:

EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  xul.dll  mozilla::UniquePtr<mozilla::dom::SessionHistoryInfo, mozilla::DefaultDelete<m...  mfbt/UniquePtr.h:287
0  xul.dll  mozilla::UniquePtr<mozilla::dom::SessionHistoryInfo, mozilla::DefaultDelete<m...  mfbt/UniquePtr.h:282
0  xul.dll  mozilla::dom::NavigationHistoryEntry::Key() const  dom/navigation/NavigationHistoryEntry.cpp:134
0  xul.dll  mozilla::dom::Navigation::UpdateEntriesForSameDocumentNavigation(mozilla::dom...  dom/navigation/Navigation.cpp:182
1  xul.dll  nsDocShell::UpdateURLAndHistory(mozilla::dom::Document*, nsIURI*, nsIStructur...  docshell/base/nsDocShell.cpp:11594
2  xul.dll  mozilla::dom::Document::Open(mozilla::dom::Optional<nsTSubstring<char16_t> > ...  dom/base/Document.cpp:10152
3  xul.dll  mozilla::dom::Document_Binding::open(JSContext*, JS::Handle<JSObject*>, void*...  dom/bindings/DocumentBinding.cpp:3724
4  xul.dll  mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::Nor...  dom/bindings/BindingUtils.cpp:3302
5  xul.dll  CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::...  js/src/vm/Interpreter.cpp:494
5  xul.dll  js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstru...  js/src/vm/Interpreter.cpp:590

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1890747

Comment 2

[Sebastian Zartner [:sebo]]

FWIW, the CSS-Tricks page is a live page where you can experience this issue (related to the cookie consent management widget).

Sebastian

Comment 3

[Adam Vandolder [:avandolder]]

This is likely related to the similar test crashes in bug 1950897.

Comment 4

[Andreas Farre [:farre]]

Also, since we're seeing this when nsDocShell::UpdateURLAndHistory calls Navigation::UpdateEntriesForSameDocumentNavigation we can be sure that someone has turned on dom.navigation.webidl.enabled, because you can't get a Navigation object from Window without having that turned on.

Comment 5

[Dianna Smith [:diannaS]]

Marking disabled since dom.navigation.webidl.enabled is set to false by default

Comment 6

[BugBot [:suhaib / :marco]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 10 desktop browser crashes on nightly

:sefeng, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 7

[Sean Feng [:sefeng211]]

remain this as S3 given the feature is disabled at the moment.

Comment 8

[BugBot [:suhaib / :marco]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit BugBot documentation.

Comment 10

[BugBot [:suhaib / :marco]]

Copying crash signatures from duplicate bugs.

Comment 11

[Alice0775 White]

Tab crashes when open the page https://u6.getuploader.com/script/ .

bp-e72c1f6a-9798-48b4-b71d-9db700250906

Comment 12

[Sebastian Zartner [:sebo]]

Having tested this with mozregression using the URL in the previous comment, it looks like this crash already got fixed by the change in bug 1979080. I also checked other pages where this crash previously occurred and they don't crash anymore using current Nightly builds. So I close this now.

Sebastian