Closed Bug 1816074 Opened 2 years ago Closed 2 years ago

Crash in [@ nsINode::IsInNamespace]

Categories

(Firefox :: Menus, defect, P1)

Desktop
Linux
defect

Tracking

()

VERIFIED FIXED
112 Branch
Tracking Status
firefox-esr102 --- unaffected
firefox110 + wontfix
firefox111 + verified
firefox112 --- verified

People

(Reporter: csasca, Assigned: emilio)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(2 files)

Attached video folder f10 crash.webm

Crash report: https://crash-stats.mozilla.org/report/index/5c14a758-c6b0-416f-9b4c-019130230210

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  RefPtr<mozilla::dom::NodeInfo>::get const  mfbt/RefPtr.h:286
0  libxul.so  RefPtr<mozilla::dom::NodeInfo>::operator-> const  mfbt/RefPtr.h:316
0  libxul.so  nsINode::IsInNamespace const  dom/base/nsINode.h:774
0  libxul.so  nsIContent::IsXULElement const  dom/base/nsIContent.h:200
0  libxul.so  nsIContent::IsAnyOfXULElements<nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*, nsStaticAtom*> const  dom/base/nsIContent.h:208
0  libxul.so  mozilla::dom::XULButtonElement::FromNode<nsIContent>  dom/xul/XULButtonElement.h:78
1  libxul.so  mozilla::dom::XULButtonElement::FromNode<nsIContent>  dom/xul/XULButtonElement.h:78
1  libxul.so  nsXULPopupManager::MayShowMenu  layout/xul/nsXULPopupManager.cpp:714
2  libxul.so  mozilla::dom::XULButtonElement::OpenMenuPopup  dom/xul/XULButtonElement.cpp:184
3  libxul.so  nsMenuBarListener::KeyPress  layout/xul/nsMenuBarListener.cpp:290

Platforms

  • Affected: Ubuntu 22.04
  • Unaffected: Windows and macOS

Steps to Reproduce

  1. Launch Firefox
  2. Right click on the bookmarks toolbar and select add folder
  3. Press F10 on the keyboard

Notes

  • The crash can be seen in the added attachment
  • Happens on Firefox 111.0a1 and 110.0
  • Feel free to change the component to the right one if this isn't the correct one.
  • On Windows the menu bar is shown as expected.
User Story: (updated)
Regressed by: 1805414
Component: Bookmarks & History → Menus

Tracking as this is a recent regression but it doesn't seem like a P1/S1 to me as we have very few crashes.

Flags: needinfo?(emilio)

We might not have an active item if all items are disabled.

Add the null-check just to be safe too.

Assignee: nobody → emilio
Status: NEW → ASSIGNED
Flags: needinfo?(emilio)
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/761952daa28c Prevent activating menubar without a selectable menu item. r=smaug

Set release status flags based on info from the regressing bug 1805414

Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 112 Branch

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox111 to wontfix.

For more information, please visit auto_nag documentation.

Flags: needinfo?(emilio)

Comment on attachment 9317349 [details]
Bug 1816074 - Prevent activating menubar without a selectable menu item. r=smaug,peterv

Beta/Release Uplift Approval Request

  • User impact if declined: crashes
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: Yes
  • If yes, steps to reproduce: comment 0
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Very simple fix + null-check
  • String changes made/needed: none
  • Is Android affected?: No
Flags: needinfo?(emilio)
Attachment #9317349 - Flags: approval-mozilla-beta?
Flags: qe-verify+

Comment on attachment 9317349 [details]
Bug 1816074 - Prevent activating menubar without a selectable menu item. r=smaug,peterv

Approved for 111.0b2

Attachment #9317349 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [qa-triaged]
Severity: S1 → S2
Priority: P1 → --
Priority: -- → P1

Verified as fixed on Ubuntu 20.04 x64 and on Ubuntu 22.04 x64.

Changing the status of this bug to verified since status-firefox110 is wontfix.

Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: