2065645 - Missing Fluent variable $title for newtab-menu-content-tooltip causes debug build newtab content crashes on startup

Status: RESOLVED FIXED

(Firefox :: New Tab Page, defect)

Description

[Mike Conley (:mconley) (:⚙️)]

This is a debug-only crash that started recently and is easily reproducible by simply creating a debug build and launching the browser - the initial newtab will immediately crash.

Stack:

[37315] Hit MOZ_CRASH(Resolver error: Unknown variable: $title) at intl/l10n/rust/localization-ffi/src/lib.rs:622
#01: RustMozCrash[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x9ccc1fc]
#02: _RNvNtCsgvyH5POUrMV_14mozglue_static8oom_hook4hook[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x9ccbe6c]
#03: _RNvYNvCsgvyH5POUrMV_14mozglue_static10panic_hookINtNtNtCsl8K0bEFm1U0_4core3ops8function5FnMutTRNtNtCsg55jX0GwzBC_3std5panic13PanicHookInfoEE8call_mutB4_[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x9ccc19c]
#04: _RNvNtCsg55jX0GwzBC_3std9panicking15panic_with_hook[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xabe2d64]
#05: _RNCNvNtCsg55jX0GwzBC_3std9panicking13panic_handler0B5_[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xabd1f5c]
#06: _RINvNtNtNtCsg55jX0GwzBC_3std3sys7helpers14small_c_string24run_with_cstr_allocatingINtNtCsl8K0bEFm1U0_4core6option6OptionNtNtNtB8_3ffi6os_str8OsStringEEB8_[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xabc8e88]
#07: _RNvCsfLfy6EI15iL_7___rustc26___rust_alloc_error_handler[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xabd278c]
#08: _RNvNtNtCsl8K0bEFm1U0_4core3num7flt2dec17digits_to_dec_str[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xac02804]
#09: async_task::raw::RawTask$LT$F$C$T$C$S$GT$::run::h484f0a55df736eac[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x90daf5c]
#10: moz_task::dispatcher::RunnableFunction$LT$F$GT$::allocate::Run::h3ca867dd0ed24c3b[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xa4ce2f4]
#11: mozilla::RunnableTask::Run()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6323c]
#12: mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf57498]
#13: mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf5496c]
#14: mozilla::TaskController::ProcessPendingMTTask(bool)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf54df0]
#15: mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf6293c]
#16: nsThread::ProcessNextEvent(bool, bool*)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf7b02c]
#17: NS_ProcessNextEvent(nsIThread*, bool)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0xf81308]
#18: mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x10b2840]
#19: MessageLoop::RunInternal()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1021e48]
#20: MessageLoop::Run()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1021d40]
#21: nsBaseAppShell::Run()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x60c65c8]
#22: nsAppShell::Run()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x6149920]
#23: XRE_RunAppShell()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7353fe8]
#24: mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x10b3274]
#25: MessageLoop::RunInternal()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1021e48]
#26: MessageLoop::Run()[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1021d40]
#27: XRE_InitChildProcess(int, char**, XREChildData const*)[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7352c98]
#28: main[/Users/mikeconley/src/firefox/obj-artifact-debug/dist/NightlyDebug.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container +0x6cc]

And above, the more important part:

Fluent error, the argument "$title" was not provided a value.
This error happened while formatting the following messages:
  "newtab-menu-content-tooltip"

Mozregression points at bug 2051742.

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 2051742

Comment 2

[Hackbot [:hackbot]]

Localized this to the section context menu.

Root cause

Bug 2051742's section-menu migration (bb56d358e4b2) replaced the trigger's plain title={title || source} attribute with Fluent:

browser/extensions/newtab/content-src/components/DiscoveryStreamComponents/SectionContextMenu/SectionContextMenu.jsx

data-l10n-id="newtab-menu-content-tooltip"
data-l10n-args={JSON.stringify({ title: title || source })}

newtab-menu-content-tooltip requires $title (browser/locales/en-US/browser/newtab/newtab.ftl). With the old plain attribute an empty value was harmless — React just dropped the attribute. Now JSON.stringify({ title: undefined }) serialises to "{}", so the argument is simply absent and the resolver hits the MOZ_CRASH in the stack above.

Two things make that the normal case on the first paint rather than an edge case:

1. source is destructured as a prop but no caller passes it — CardSections.jsx passes type, not source. So the fallback is always undefined.
2. While spocs are still loading, CardSections deliberately blanks the section titles to render the placeholder state (CardSections.jsx, title: ""). "" || undefined → undefined.

That is exactly the initial newtab, which is why it crashes immediately and every time.

Proposed fix

In SectionContextMenu.jsx, don't use the $title message when there is no title. newtab-menu-section-tooltip ("Open menu", no variables) already exists for precisely this and is what the widget menus use:

const menuLabel = title || source;
...
data-l10n-id={menuLabel ? "newtab-menu-content-tooltip" : "newtab-menu-section-tooltip"}
data-l10n-args={menuLabel ? JSON.stringify({ title: menuLabel }) : null}

Worth doing in the same patch: either drop the unused source prop or have CardSections pass one, so the fallback isn't dead code. The other four newtab-menu-content-tooltip call sites migrated in bug 2051742 (TopSite.jsx, DSLinkMenu.jsx, AdBannerContextMenu.jsx, Card.jsx) build their args the same unguarded way and carry the same latent hazard, though none of them renders with an empty title on the placeholder path (placeholder top sites and placeholder DSCards return before the menu is rendered). Guarding them the same way would be cheap insurance.

Tests

browser/extensions/newtab/test/jest/content-src/components/DiscoveryStreamComponents/SectionContextMenu.test.jsx is the natural home — note its first case already renders with source="" and no title, i.e. the crashing configuration, and passes because jest doesn't run Fluent. A regression check should assert on the rendered data-l10n-id/data-l10n-args pair instead: no newtab-menu-content-tooltip without a title in its args. CardSections.test.jsx covers the spocsLoading blanking that triggers it.

I have not built or run this — the above is from reading the regressor diff and the current sources.

---

Suggested severity: S2
Debug-only, so no release-user impact beyond an unlocalized aria-label, but it is an unconditional content-process crash on the very first newtab, which blocks every developer and debug CI job with no workaround.

---

If you'd like to provide feedback on this comment, please use the 👍 or 👎 reaction.
If you want to categorize your feedback you can add one of the following tags: ai-triage-wrong-file, ai-triage-wrong-cause, ai-triage-hallucination, ai-triage-out-of-scope.

Comment 3

[Jack Brown]

This makes sense to me, it's a pretty small fix on the aria label. It's just that label text, so there's nothing that changes visually. There's no new string needed either, the variant we need already exists.

Essentially, we're just using a similar string for the aria-label that doesn't need a title. So when we don't have a title, we have the aria label say "Open menu" instead of "Open context menu for title."

Comment 4

[Jack Brown]

Attachment: Bug 2065645 - Don't format newtab-menu-content-tooltip without a $title. r?#home-newtab-reviewers-rotation

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ec8ddf36d503
https://hg.mozilla.org/integration/autoland/rev/2ee801abaf0b
Don't format newtab-menu-content-tooltip without a $title. r=ini

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/2ee801abaf0b