Closed Bug 2029010 Opened 3 months ago Closed 2 months ago

[wpt-sync] Sync PR 58955 - Fix reentrancy crash when hint popover closing mutates auto ancestor

Categories

(Core :: DOM: Core & HTML, task, P4)

Product:
Core
Component:
DOM: Core & HTML
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
151 Branch
Tracking Flags:
Tracking Status
firefox151 --- fixed

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 58955 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/58955
Details from upstream follow.

Mason Freed <masonf@chromium.org> wrote:

Fix reentrancy crash when hint popover closing mutates auto ancestor

When a popover=auto or a popover=hint (without an ancestor in the hint
stack) is shown, the entire hint stack must be closed before the auto
stack is closed. During the hide process for the hint stack,
beforetoggle events are fired which can mutate the DOM.

Previously, the auto_ancestor was computed before the hint stack
was closed in the popover=auto path. If a beforetoggle event handler
mutated the newly discovered auto_ancestor (e.g. by changing its
popover type to manual or removing it), the subsequent call to
HideAllPopoversUntil(auto_ancestor) would CHECK-fail because the
expected endpoint in the stack was no longer valid.

This patch fixes the crash and refactors the stack management logic by
safely computing the auto_ancestor after
CloseEntirePopoverStack(hint_stack) has executed and after uniform
reentrancy/validity checks have been applied to both popover=auto and
popover=hint paths. By consolidating this logic, it also removes
unnecessary branching and duplication.

Fixed: 496629066
Change-Id: Ia38283f58d957ce02d355a096c66713d6b6cb16a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7709272
Reviewed-by: David Baron \<dbaron@chromium.org>
Auto-Submit: Mason Freed \<masonf@chromium.org>
Commit-Queue: Mason Freed \<masonf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1609360}

Component: web-platform-tests → DOM: Core & HTML
Product: Testing → Core

CI Results

Ran 11 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 107 tests

Status Summary

Firefox

OK : 78
PASS : 4[GitHub] 11[Gecko-linux2204-64-wayland-debug, Gecko-linux2204-64-wayland-opt] 3827[Gecko-windows11-32-24h2-debug, Gecko-windows11-32-24h2-opt] 3844[Gecko-windows11-64-24h2-debug, Gecko-windows11-64-24h2-opt] 3845[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt]
FAIL : 20[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-32-24h2-debug, Gecko-windows11-32-24h2-opt] 21[Gecko-windows11-64-24h2-debug, Gecko-windows11-64-24h2-opt]

Chrome

PASS : 1
CRASH: 3

Safari

PASS : 4

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

Pushed by wptsync@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/f7a372103e1a https://hg.mozilla.org/integration/autoland/rev/f0a3a5830afb [wpt PR 58955] - Fix reentrancy crash when hint popover closing mutates auto ancestor, a=testonly

https://hg.mozilla.org/mozilla-central/rev/f0a3a5830afb

Status: NEW → RESOLVED
Closed: 2 months ago
status-firefox151: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 151 Branch
You need to log in before you can comment on or make changes to this bug.