964718 - MOZ_CRASH(WidgetQueryContentEvent doesn't support Duplicate()) at ../../dist/include/mozilla/TextEvents.h:333

Status: VERIFIED FIXED

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Panos Astithas (he/him) [:past] (please ni?)]

Attachment: Crash log

I got this crash in a debug build of fx-team tip, when I tried to close an about:config tab where I had been typing in the filter box. Top of the stack:

0  mozilla::WidgetQueryContentEvent::Duplicate() const + 58 (TextEvents.h:333)
1  nsDOMEvent::DuplicatePrivateData() + 69 (nsDOMEvent.cpp:562)
2  nsEventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, nsDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) + 4771 (nsEventDispatcher.cpp:620)
3  PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) + 4661 (nsCOMPtr.h:515)
4  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 1707 (nsPresShell.cpp:6705)
5  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 949 (nsPresShell.cpp:6297)
6  nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) + 464 (nsCOMPtr.h:515)
7  nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) + 265 (nsAutoPtr.h:900)
8  nsChildView::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) + 778 (nsChildView.mm:1698)
9  nsChildView::DispatchWindowEvent(mozilla::WidgetGUIEvent&) + 21 (nsChildView.mm:1707)
10 nsChildView::GetEditorView() + 292 (nsChildView.mm:2013)

Comment 1

[Panos Astithas (he/him) [:past] (please ni?)]

This is now very easy to reproduce on OS X:

1. Go to  http://htmlpad.org/debugger/ and open the debugger (Cmd-Opt-S).
2. Expand the panes (click the icon in the toolbar  next to the debugger options gear icon) and select the events tab.
3. Click on the keyup checkbox to break on that event.
4. Try to click inside the text input field in the page:


Hit MOZ_CRASH(WidgetQueryContentEvent doesn't support Duplicate()) at ../../dist/include/mozilla/TextEvents.h:341

0  mozilla::WidgetQueryContentEvent::Duplicate() const + 46 (TextEvents.h:341)
1  mozilla::dom::Event::DuplicatePrivateData() + 137 (Event.cpp:561)
2  mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsCOMArray<mozilla::dom::EventTarget>*) + 5129 (EventDispatcher.cpp:621)
3  PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) + 4173 (nsPresShell.cpp:7251)
4  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 8238 (nsPresShell.cpp:6868)
5  PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*) + 1052 (nsPresShell.cpp:6460)
6  nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) + 641 (nsViewManager.cpp:783)
7  nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) + 319 (nsView.cpp:1085)
8  nsChildView::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) + 1239 (nsChildView.mm:1675)
9  nsChildView::DispatchWindowEvent(mozilla::WidgetGUIEvent&) + 54 (nsChildView.mm:1684)
10 nsChildView::GetEditorView() + 136 (nsChildView.mm:1994)
11 mozilla::widget::TextInputHandlerBase::GetWindowLevel() + 236 (TextInputHandler.mm:4349)

Comment 2

[Panos Astithas (he/him) [:past] (please ni?)]

Attachment: Crash log

Here is a more up to date crash log.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

On which versions does this happen?

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Sounds odd. And it means that such internal only event causes DOM event dispatching, i.e., it wastes the resource.

Comment 5

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

I'm not sure who hold the DOM events after dispatching the anonymous DOM event, though...

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

I assume this can happen if devtools use "all events" listener, which can be added using
nsIEventListenerService.

Comment 7

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Oh, I've never known that...

Comment 8

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Attachment: Patch

Comment 9

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Attachment: Patch

Sorry for the spam. Fixes strange comments.

Comment 10

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b33c9dbfa7ca

Comment 11

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/b33c9dbfa7ca

Comment 12

[Panos Astithas (he/him) [:past] (please ni?)]

Bug 996372 looks like the same crash in Firefox 30. Can we uplift the fix there?

Comment 13

[Panos Astithas (he/him) [:past] (please ni?)]

Beta is also affected:
https://crash-stats.mozilla.com/report/index/60da3601-adf6-4344-9c67-e41bd2140415

Comment 14

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Comment on attachment 8397797 [details] [diff] [review]
Patch

[Approval Request Comment]
User impact if declined: Use may meet this crash at using devtools and it's listening events.
Testing completed (on m-c, etc.): landed 3/27.
Risk to taking this patch (and alternatives if risky): Nothing. This patch just supports duplicating internal event class for DOM event created from the original internal event and held by JS or something. Or, just stops dispatching anonymous DOM event if it's not necessary.
String or IDL/UUID changes made by this patch: Nothing.

Comment 15

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Comment on attachment 8397797 [details] [diff] [review]
Patch

[Approval Request Comment]
See the previous comment.

Comment 16

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8397797 [details] [diff] [review]
Patch

Approved. Next time, please don't hesitate to submit uplift requests sooner ;)

Comment 17

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(still sick)]

Thanks.

https://hg.mozilla.org/releases/mozilla-aurora/rev/16dc0eb1056a
https://hg.mozilla.org/releases/mozilla-beta/rev/aaf5030cbf98

Comment 18

[Ada [:adalucinet]]

Reproduced with STR from comment 1: 
1. with Nightly 2014-03-26 debug build on Mac OS X 10.9.3 I get:
Hit MOZ_CRASH(WidgetQueryContentEvent doesn't support Duplicate()) at ../../dist/include/mozilla/TextEvents.h:341

2. with Nightly 2014-03-26 on Mac OS X 10.9.3 - the build is constantly crashing:
Reports:
bp-a2661595-4d7c-44d8-a3a4-8abb32140624
bp-1a6d8cd0-8ad8-4556-9dac-6c3c42140624

Verified as fixed with Firefox 31 beta 4 (Build ID: 20140623175014) on Mac OS X 10.9.3 [1], Windows 7 x64 [2] and Ubuntu 14.04 x32 [3] - no crashes encountered. Also, with Firefox 31 Beta debug build (build ID: 20140623135543) I cannot reproduce the initial crash.

[1] Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Firefox/31.0
[2] Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
[3] Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Firefox/31.0