2040092 - Crash in [@ mozilla::dom::syncedcontext::Transaction<T>::Commit | mozilla::dom::BrowsingContext::SetAnimationsPlayBackRateMultiplier]

Status: VERIFIED FIXED

(Core :: DOM: Content Processes, defect)

Description

[Alice0775 White]

Crash report: https://crash-stats.mozilla.org/report/index/e1bf4c49-e53c-4660-bd7d-0c23d0260516

MOZ_CRASH Reason:

CanSet failed for field(s): AnimationsPlayBackRateMultiplier

Top 10 frames:

0  xul.dll  MOZ_Crash(char const*, int, char const*)  mfbt/Assertions.h:402
0  xul.dll  mozilla::dom::syncedcontext::Transaction<mozilla::dom::BrowsingContext>::Comm...  docshell/base/SyncedContextInlines.h:101
1  xul.dll  mozilla::dom::BrowsingContext::SetAnimationsPlayBackRateMultiplier(double)  docshell/base/BrowsingContext.h:325
2  xul.dll  mozilla::dom::BrowsingContext::SetAnimationsPlayBackRateMultiplier(double, mo...  docshell/base/BrowsingContext.h:325
3  xul.dll  mozilla::dom::BrowsingContext_Binding::set_animationsPlayBackRateMultiplier(J...  dom/bindings/BrowsingContextBinding.cpp:2938
4  xul.dll  mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::Nor...  dom/bindings/BindingUtils.cpp:3161
5  xul.dll  CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::...  js/src/vm/Interpreter.cpp:488
5  xul.dll  js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstru...  js/src/vm/Interpreter.cpp:584
5  xul.dll  InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)  js/src/vm/Interpreter.cpp:651
5  xul.dll  js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInv...  js/src/vm/Interpreter.cpp:683

STR:

1. Open Bookmarks Sidebar (Ctrl+B)
2. Open Browser Toolbox (Ctrl+Shift+Alt+I)
3. Click on Select an iframe as the currently targeted document icon at the top-right of the Browser toolbox
4. Select browser/components/sidebar/sidebar-bookmarks.html or chrome://browser/content/places/bookmarksSidebar.xhtml from the drop-down list
5. Make the main browser window active
6. Exit the browser (Ctrl+Sift+Q)

Actual results:
The crash reporter pops up

Expected results:
No crash reporter

Comment 1

[Alice0775 White]

Attachment: about:support

Comment 2

[Alice0775 White]

Regression window:
https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=4dccdca587dff46f57dfcc52b3d4e4266848cdd2&tochange=d749d2a87c541f75aa223be133b9dc66b3ab0e7a

Suspect: Bug 1245562

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

:nchevobbe, since you are the author of the regressor, bug 1245562, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Nicolas Chevobbe [:nchevobbe]]

Ah yes, forgot about this, and Eden is better suited than me to look into the crash :)

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1245562

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The bug is marked as tracked for firefox151 (release) and tracked for firefox152 (beta). However, the bug still isn't assigned.

:slloyd, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 7

[Andrew McCreight [:mccr8]]

It sounds like Eden was going to take a look at this.

Comment 8

[Donal Meehan [:dmeehan]]

:edenchuang, are you still investigating?
I don't see any crash volume in release, but we could take a patch if you have one in time for a Fx151 dot release

Comment 9

[Eden Chuang[:edenchuang]]

Attachment: Bug 2040092 - Set animationsPlayBackRateMultiplier on the top browsing context from DevTools. r?#devtools-reviewers

animationsPlayBackRateMultiplier is a synced BrowsingContext field whose CanSet
requires IsTop(). When a root target actor (e.g. the Browser Toolbox) has an
iframe selected as the currently targeted document via the iframe picker,
this.browsingContext is no longer the top context, so setting the multiplier on
it crashed with "CanSet failed for field(s): AnimationsPlayBackRateMultiplier".

Set the field on this.browsingContext.top instead, which matches the field's
getter (which reads from Top()) and is a no-op for the regular tab toolbox where
the targeted context is already top.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c28bc7e5cab0
https://hg.mozilla.org/integration/autoland/rev/ad35339d8972
Set animationsPlayBackRateMultiplier on the top browsing context from DevTools. r=devtools-reviewers,nchevobbe

Comment 11

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/ad35339d8972

Comment 12

[Alex Finder]

(In reply to Pulsebot from comment #10)

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c28bc7e5cab0
https://hg.mozilla.org/integration/autoland/rev/ad35339d8972
Set animationsPlayBackRateMultiplier on the top browsing context from
DevTools. r=devtools-reviewers,nchevobbe

Perfherder has detected a mozperftest performance change from push ad35339d8972afd474e920c8127f617890ee8bbc.

No action is required from the author; this comment is provided for informational purposes only.

Improvement	Test	Platform	Options	Absolute values [old vs new]
19%	test_fetch.html Cold fetch	linux2404-64-shippable		4.96 ms -> 4.00 ms

Need Help or Information?

If you have any questions, please reach out to [e-mail]. Alternatively, you can find help on Slack by joining #perf-help, and on Matrix you can find help by joining #perftest.

Details of the alert can be found in the alert summary, including links to graphs and comparisons for each of the affected tests.

Comment 13

[Simona Badau, Desktop QA, PTO 22-30June]

Reproduced the crash using Firefox 152.0.5 on Windows 11 x64 by following the steps in the description.

Verified as fixed using Firefox 153.0b11 on Windows 11 x64 - the crash no longer occurs when following the same steps.