1987777 - Firefox app crashes when pressing back button [@ mozilla::WeakPtr<T>::operator bool ]

Status: VERIFIED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

STR:

1. Open https://blog.mozilla.org/webrtc/unbundling-mediastreamtrackprocessor-and-videotrackgenerator/
2. Click the first link (labeled "worker-only") in the second paragraph
3. Click the back button

Expected result:

• Blog reappears

Actual result:

• bp-8782dcb3-a880-4c54-8802-6d6830250909

0 	XUL 	RefPtr<mozilla::detail::WeakReference>::get() const 	mfbt/RefPtr.h:314 	inlined
0 	XUL 	RefPtr<mozilla::detail::WeakReference>::operator->() const 	mfbt/RefPtr.h:344 	inlined
0 	XUL 	mozilla::WeakPtr<mozilla::dom::WindowGlobalChild, (mozilla::detail::WeakPtrDestructorBehavior)0>::operator bool() const 	mfbt/WeakPtr.h:302 	inlined
0 	XUL 	mozilla::dom::WindowContext::GetInnerWindow() const 	docshell/base/WindowContext.cpp:96 	inlined
0 	XUL 	mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0::operator()(mozilla::dom::BrowsingContext*) const 	docshell/base/BrowsingContext.cpp:3153 	inlined
0 	XUL 	std::__1::__invoke[abi:nn190102]<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0&, mozilla::dom*>(mozilla::dom*&&, mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0&) 	/builds/worker/fetches/MacOSX15.5.sdk/usr/include/c++/v1/__type_traits/invoke.h:149 	inlined
0 	XUL 	std::__1::__invoke_void_return_wrapper<void, true>::__call[abi:nn190102]<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0&, mozilla::dom*>(mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0&, mozilla::dom*) 	/builds/worker/fetches/MacOSX15.5.sdk/usr/include/c++/v1/__type_traits/invoke.h:224 	inlined
0 	XUL 	std::__1::__function::__alloc_func<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0, std::__1::allocator<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0>, void (mozilla::dom::BrowsingContext*)>::operator()[abi:nn190102](mozilla::dom::BrowsingContext*&&) 	/builds/worker/fetches/MacOSX15.5.sdk/usr/include/c++/v1/__functional/function.h:171 	inlined
0 	XUL 	std::__1::__function::__func<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0, std::__1::allocator<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0>, void (mozilla::dom::BrowsingContext*)>::operator()(mozilla::dom::BrowsingContext*&&) 	/builds/worker/fetches/MacOSX15.5.sdk/usr/include/c++/v1/__functional/function.h:313 	context
1 	XUL 	std::__1::__function::__value_func<void (mozilla::dom::BrowsingContext*)>::operator()[abi:nn190102](mozilla::dom::BrowsingContext*&&) const 	/builds/worker/fetches/MacOSX15.5.sdk/usr/include/c++/v1/__functional/function.h:430 	inlined
1 	XUL 	std::__1::function<void (mozilla::dom::BrowsingContext*)>::operator()(mozilla::dom::BrowsingContext*) const 	/builds/worker/fetches/MacOSX15.5.sdk/usr/include/c++/v1/__functional/function.h:989 	inlined
1 	XUL 	mozilla::dom::BrowsingContext::PreOrderWalkVoid(std::__1::function<void (mozilla::dom::BrowsingContext*)> const&) 	docshell/base/BrowsingContext.cpp:1296 	cfi
2 	XUL 	mozilla::dom::BrowsingContext::PreOrderWalkVoid(std::__1::function<void (mozilla::dom::BrowsingContext*)> const&) 	docshell/base/BrowsingContext.cpp:1302 	cfi
3 	XUL 	mozilla::dom::BrowsingContext::PreOrderWalkVoid(std::__1::function<void (mozilla::dom::BrowsingContext*)> const&) 	docshell/base/BrowsingContext.cpp:1302 	cfi
4 	XUL 	mozilla::dom::BrowsingContext::PreOrderWalk<mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0>(mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&)::$_0&&) 	docshell/base/BrowsingContext.h:592 	inlined
4 	XUL 	mozilla::dom::BrowsingContext::DidSet(std::__1::integral_constant<unsigned long, (unsigned long)59>, nsTString<char>&&) 	docshell/base/BrowsingContext.cpp:3149 	cfi
5 	XUL 	mozilla::dom::syncedcontext::Transaction<mozilla::dom::BrowsingContext>::Apply(mozilla::dom::BrowsingContext*, bool)::{lambda(auto:1)#1}::operator()<std::__1::integral_constant<unsigned long, (unsigned long)59> >(std::__1::integral_constant<unsigned long, (unsigned long)59>) const 	docshell/base/SyncedContextInlines.h:224

Regression range:

• https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=2cb7ca176216a4ef4d4444f2c360f5a0a92c8086&tochange=13bba316b2eb044041e1336599123fc5101a250a

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1980211

:Sasha, since you are the author of the regressor, bug 1980211, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I can see the crash as well. The problematic patch from bug 1980211 seems to be because it's also happening without Remote Agent being active:
https://hg-edge.mozilla.org/integration/autoland/rev/33dcf5c2e643b94e90a0a197c99112a080501a12

Comment 3

[Alexandra Borovova [:Sasha]]

Attachment: Bug 1987777 - Reapply language and timezone overrides only when they exist and add the checks for WindowContext to avoid the crash.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/79dc26709901
https://hg.mozilla.org/integration/autoland/rev/3b7697e19437
Reapply language and timezone overrides only when they exist and add the checks for WindowContext to avoid the crash. r=dom-core,smaug

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/3b7697e19437

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Verified fixed with Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0 ID:20250913092312. Thanks Sasha!