1993143 - Crash in [@ nsIContent::nsContentSlots::GetExtendedContentSlots]

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[BugBot [:suhaib / :marco]]

Crash report: https://crash-stats.mozilla.org/report/index/30830633-d316-46e9-bde1-e597b0251006

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  nsIContent::nsContentSlots::GetExtendedContentSlots const  dom/base/nsIContent.h:692
0  libxul.so  nsIContent::GetExistingExtendedContentSlots const  dom/base/nsIContent.h:722
0  libxul.so  mozilla::dom::FragmentOrElement::GetExistingExtendedDOMSlots const  dom/base/FragmentOrElement.h:385
0  libxul.so  mozilla::dom::Element::GetShadowRoot const  dom/base/Element.h:1509
0  libxul.so  nsIContent::GetShadowRoot const  dom/base/nsIContentInlines.h:56
0  libxul.so  GetFlattenedTreeParentNode<  dom/base/nsIContentInlines.h:92
0  libxul.so  nsINode::GetFlattenedTreeParentNodeForStyle const  dom/base/nsIContentInlines.h:144
0  libxul.so  nsINode::GetFlattenedTreeParentElementForStyle const  dom/base/ElementInlines.h:46
0  libxul.so  mozilla::dom::PropagateBits  dom/base/Element.cpp:5046
0  libxul.so  mozilla::dom::NoteDirtyElement  dom/base/Element.cpp:5162

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2025-08-14
• Process type: Multiple distinct types
• Is startup crash: No
• Has user comments: Yes
• Is null crash: Yes - 1 out of 4 crashes happened on null or near null memory address