MOZ_CRASH(WidgetQueryContentEvent doesn't support Duplicate()) at ../../dist/include/mozilla/TextEvents.h:333

VERIFIED FIXED in Firefox 29

Status

()

defect
VERIFIED FIXED
6 years ago
3 months ago

People

(Reporter: past, Assigned: masayuki)

Tracking

({crash, verifyme})

Trunk
mozilla31
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox29 fixed, firefox30 fixed, firefox31 verified)

Details

Attachments

(2 attachments, 2 obsolete attachments)

Posted file Crash log (obsolete) —
I got this crash in a debug build of fx-team tip, when I tried to close an about:config tab where I had been typing in the filter box. Top of the stack:

0  mozilla::WidgetQueryContentEvent::Duplicate() const + 58 (TextEvents.h:333)
1  nsDOMEvent::DuplicatePrivateData() + 69 (nsDOMEvent.cpp:562)
2  nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) + 4771 (nsEventDispatcher.cpp:620)
3  PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) + 4661 (nsCOMPtr.h:515)
4  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 1707 (nsPresShell.cpp:6705)
5  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 949 (nsPresShell.cpp:6297)
6  nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) + 464 (nsCOMPtr.h:515)
7  nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) + 265 (nsAutoPtr.h:900)
8  nsChildView::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) + 778 (nsChildView.mm:1698)
9  nsChildView::DispatchWindowEvent(mozilla::WidgetGUIEvent&) + 21 (nsChildView.mm:1707)
10 nsChildView::GetEditorView() + 292 (nsChildView.mm:2013)
This is now very easy to reproduce on OS X:

1. Go to  http://htmlpad.org/debugger/ and open the debugger (Cmd-Opt-S).
2. Expand the panes (click the icon in the toolbar  next to the debugger options gear icon) and select the events tab.
3. Click on the keyup checkbox to break on that event.
4. Try to click inside the text input field in the page:


Hit MOZ_CRASH(WidgetQueryContentEvent doesn't support Duplicate()) at ../../dist/include/mozilla/TextEvents.h:341

0  mozilla::WidgetQueryContentEvent::Duplicate() const + 46 (TextEvents.h:341)
1  mozilla::dom::Event::DuplicatePrivateData() + 137 (Event.cpp:561)
2  mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) + 5129 (EventDispatcher.cpp:621)
3  PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) + 4173 (nsPresShell.cpp:7251)
4  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 8238 (nsPresShell.cpp:6868)
5  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 1052 (nsPresShell.cpp:6460)
6  nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) + 641 (nsViewManager.cpp:783)
7  nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) + 319 (nsView.cpp:1085)
8  nsChildView::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) + 1239 (nsChildView.mm:1675)
9  nsChildView::DispatchWindowEvent(mozilla::WidgetGUIEvent&) + 54 (nsChildView.mm:1684)
10 nsChildView::GetEditorView() + 136 (nsChildView.mm:1994)
11 mozilla::widget::TextInputHandlerBase::GetWindowLevel() + 236 (TextInputHandler.mm:4349)
Component: Widget → DOM: Events
Keywords: crash
Posted file Crash log
Here is a more up to date crash log.
Attachment #8366576 - Attachment is obsolete: true
On which versions does this happen?
Component: DOM: Events → Event Handling
Sounds odd. And it means that such internal only event causes DOM event dispatching, i.e., it wastes the resource.
I'm not sure who hold the DOM events after dispatching the anonymous DOM event, though...
Assignee: nobody → masayuki
Status: NEW → ASSIGNED
I assume this can happen if devtools use "all events" listener, which can be added using
nsIEventListenerService.
Oh, I've never known that...
Posted patch PatchSplinter Review
Sorry for the spam. Fixes strange comments.
Attachment #8397794 - Attachment is obsolete: true
Attachment #8397794 - Flags: review?(bugs)
Attachment #8397797 - Flags: review?(bugs)
Attachment #8397797 - Flags: review?(bugs) → review+
https://hg.mozilla.org/mozilla-central/rev/b33c9dbfa7ca
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31
Depends on: 996372
Bug 996372 looks like the same crash in Firefox 30. Can we uplift the fix there?
Comment on attachment 8397797 [details] [diff] [review]
Patch

[Approval Request Comment]
User impact if declined: Use may meet this crash at using devtools and it's listening events.
Testing completed (on m-c, etc.): landed 3/27.
Risk to taking this patch (and alternatives if risky): Nothing. This patch just supports duplicating internal event class for DOM event created from the original internal event and held by JS or something. Or, just stops dispatching anonymous DOM event if it's not necessary.
String or IDL/UUID changes made by this patch: Nothing.
Attachment #8397797 - Flags: approval-mozilla-aurora?
Comment on attachment 8397797 [details] [diff] [review]
Patch

[Approval Request Comment]
See the previous comment.
Attachment #8397797 - Flags: approval-mozilla-beta?
OS: Mac OS X → All
Hardware: x86 → All
Version: unspecified → Trunk
Comment on attachment 8397797 [details] [diff] [review]
Patch

Approved. Next time, please don't hesitate to submit uplift requests sooner ;)
Attachment #8397797 - Flags: approval-mozilla-beta?
Attachment #8397797 - Flags: approval-mozilla-beta+
Attachment #8397797 - Flags: approval-mozilla-aurora?
Attachment #8397797 - Flags: approval-mozilla-aurora+
Blocks: 996372
No longer depends on: 996372
Reproduced with STR from comment 1: 
1. with Nightly 2014-03-26 debug build on Mac OS X 10.9.3 I get:
Hit MOZ_CRASH(WidgetQueryContentEvent doesn't support Duplicate()) at ../../dist/include/mozilla/TextEvents.h:341

2. with Nightly 2014-03-26 on Mac OS X 10.9.3 - the build is constantly crashing:
Reports:
bp-a2661595-4d7c-44d8-a3a4-8abb32140624
bp-1a6d8cd0-8ad8-4556-9dac-6c3c42140624

Verified as fixed with Firefox 31 beta 4 (Build ID: 20140623175014) on Mac OS X 10.9.3 [1], Windows 7 x64 [2] and Ubuntu 14.04 x32 [3] - no crashes encountered. Also, with Firefox 31 Beta debug build (build ID: 20140623135543) I cannot reproduce the initial crash.

[1] Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Firefox/31.0
[2] Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
[3] Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Firefox/31.0
Status: RESOLVED → VERIFIED
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.