757009 - ###!!! ASSERTION: ValueObserver not thread-safe: '_mOwningThread.GetThread() == PR_GetCurrentThread()', file modules/libpref/src/Preferences.cpp, line 166

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: General, defect)

Description

[Christian Holler (:decoder)]

The following HTML code triggers an assertion (and possible crash) on Fennec Native (mozilla-central, debug build, rev 95437bcc43dc):


<script>
allNodes = [];
allNodes[5] = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
allNodes[109] = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
allNodes[122] = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
(allNodes[109] || allNodes[5] || document.documentElement).appendChild(allNodes[122]);
(allNodes[5] || document.documentElement).appendChild(allNodes[109]);
(document.documentElement).appendChild(allNodes[5]);
allNodes[193] = (fuzzPriv.quitApplicationSoon(), (opener||top).allDocuments[0]).querySelectorAll("#a:nth-last-child(odd):-moz-table-border-nonzero:-moz-lwtheme-brighttext ~ div")[0];
</script>


The test requires the domfuzz addon to be installed (see URL for a build compatible with Fennec Native). Note that this assertion can randomly crash due to use-after-free and is therefore quite serious but very hard to reproduce reliably without the addon.

Comment 1

[BMO Automation]

We have completed our launch of our new Firefox on Android. The development of the new versions use GitHub for issue tracking. If the bug report still reproduces in a current version of [Firefox on Android nightly](https://play.google.com/store/apps/details?id=org.mozilla.fenix) an issue can be reported at the [Fenix GitHub project](https://github.com/mozilla-mobile/fenix/). If you want to discuss your report please use [Mozilla's chat](https://wiki.mozilla.org/Matrix#Connect_to_Matrix) server https://chat.mozilla.org and join the [#fenix](https://chat.mozilla.org/#/room/#fenix:mozilla.org) channel.