Found in m-c: BuildID=20180306215445 SourceStamp=bccdc684210431c233622650a91454c09f6af9eb ==64476==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000019 (pc 0x7f445103a605 bp 0x7ffca0e758b0 sp 0x7ffca0e757e0 T0) ==64476==The signal is caused by a READ memory access. ==64476==Hint: address points to the zero page. #0 0x7f445103a604 in HasFlag src/obj-firefox/dist/include/nsWrapperCache.h:264:15 #1 0x7f445103a604 in IsInShadowTree src/obj-firefox/dist/include/nsINode.h:1337 #2 0x7f445103a604 in GetComposedDoc src/obj-firefox/dist/include/nsINode.h:602 #3 0x7f445103a604 in mozilla::HTMLEditor::FindSelectionRoot(nsINode*) src/editor/libeditor/HTMLEditor.cpp:384 #4 0x7f4450f64892 in mozilla::EditorEventListener::Focus(mozilla::InternalFocusEvent*) src/editor/libeditor/EditorEventListener.cpp:1113:53 #5 0x7f4450f6155e in mozilla::EditorEventListener::HandleEvent(nsIDOMEvent*) src/editor/libeditor/EditorEventListener.cpp:472:14 #6 0x7f444f14e2cc in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1107:51 #7 0x7f444f14fc34 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) src/dom/events/EventListenerManager.cpp:1276:20 #8 0x7f444f13929f in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:481:12 #9 0x7f444f13d353 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:915:9 #10 0x7f444c2b5f52 in FocusBlurEvent::Run() src/dom/base/nsFocusManager.cpp:2082:12 #11 0x7f444bd869d5 in AddScriptRunner src/dom/base/nsContentUtils.cpp:5854:13 #12 0x7f444bd869d5 in nsContentUtils::AddScriptRunner(nsIRunnable*) src/dom/base/nsContentUtils.cpp:5861 #13 0x7f444c216c65 in nsFocusManager::FireFocusOrBlurEvent(mozilla::EventMessage, nsIPresShell*, nsISupports*, bool, bool, mozilla::dom::EventTarget*) src/dom/base/nsFocusManager.cpp:2255:5 #14 0x7f444c214ed6 in nsFocusManager::SendFocusOrBlurEvent(mozilla::EventMessage, nsIPresShell*, nsIDocument*, nsISupports*, unsigned int, bool, bool, mozilla::dom::EventTarget*) src/dom/base/nsFocusManager.cpp:2220:3 #15 0x7f444c20cbac in nsFocusManager::Focus(nsPIDOMWindowOuter*, nsIContent*, unsigned int, bool, bool, bool, bool, nsIContent*) src/dom/base/nsFocusManager.cpp:2001:7 #16 0x7f444c20f0a8 in nsFocusManager::WindowRaised(mozIDOMWindowProxy*) src/dom/base/nsFocusManager.cpp:779:3 #17 0x7f4454d9c544 in Activate src/toolkit/components/browser/nsWebBrowser.cpp:1833:16 #18 0x7f4454d9c544 in non-virtual thunk to nsWebBrowser::Activate() src/toolkit/components/browser/nsWebBrowser.cpp #19 0x7f445063b6c0 in mozilla::dom::TabChild::RecvActivate() src/dom/ipc/TabChild.cpp:1488:12 #20 0x7f444a6ed7ca in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) src/obj-firefox/ipc/ipdl/PContentChild.cpp:7853:20 #21 0x7f4449f9821e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) src/ipc/glue/MessageChannel.cpp:2133:25 #22 0x7f4449f951a1 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) src/ipc/glue/MessageChannel.cpp:2063:17 #23 0x7f4449f9699c in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1909:5 #24 0x7f4449f96ff8 in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1942:15 #25 0x7f44490bd615 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1040:14 #26 0x7f44490d9b80 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:517:10 #27 0x7f4449fa0324 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:125:5 #28 0x7f4449ef0639 in RunInternal src/ipc/chromium/src/base/message_loop.cc:326:10 #29 0x7f4449ef0639 in RunHandler src/ipc/chromium/src/base/message_loop.cc:319 #30 0x7f4449ef0639 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299 #31 0x7f4450def7aa in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:157:27 #32 0x7f44552d9b9b in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:892:22 #33 0x7f4449ef0639 in RunInternal src/ipc/chromium/src/base/message_loop.cc:326:10 #34 0x7f4449ef0639 in RunHandler src/ipc/chromium/src/base/message_loop.cc:319 #35 0x7f4449ef0639 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:299 #36 0x7f44552d957a in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:718:34 #37 0x4f1875 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:50:30 #38 0x4f1875 in main src/browser/app/nsBrowserApp.cpp:280 #39 0x7f446856582f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291 #40 0x420f48 in _start (firefox+0x420f48)

I guess that this is recent regression by bug 1066965?

Comment on attachment 8960111 [details] [diff] [review] form control might not have non-chrome only content FindFirstNonChromeOnlyAccessContent can return nullptr on test case, so we should check it.

Comment on attachment 8960111 [details] [diff] [review] form control might not have non-chrome only content Thanks

Pushed by m_kato@ga2.so-net.ne.jp: https://hg.mozilla.org/integration/mozilla-inbound/rev/7c62a4dbbaf3 Form control might not have non-chrome only content. r=smaug

I guess we need this on beta too.

Comment on attachment 8960111 [details] [diff] [review] form control might not have non-chrome only content Approval Request Comment [Feature/Bug causing the regression]: Bug 1066965 [User impact if declined]: Firefox crashes by Javascript [Is this code covered by automated tests?]: Yes, I added crashtest [Has the fix been verified in Nightly?]: Yes. [Needs manual test from QE? If yes, steps to reproduce]: Unnecessary [List of other uplifts needed for the feature/fix]: N/A [Is the change risky?]: Low [Why is the change risky/not risky?]: Fix is nullptr check only for this situation. [String changes made/needed]: Nothing

Comment on attachment 8960111 [details] [diff] [review] form control might not have non-chrome only content low volume null deref regression, beta60+