Closed Fanolian closed 1 year ago
The crash happens since v1.40rc3. I have left a video in Firefox's bug report.
Yep, I'm seeing it.
I'll see if I can narrow down what's happening on my end.
I'll give you what I know so far.
If an element attached to the shadow DOM is removed before a CSS transition completes, it will crash the tab.
I've been using this test code in the console, after bringing up the animations tab.
(() => {
let s = document.createElement('shadow-test');
document.documentElement.appendChild(s);
s.attachShadow({mode:"open"});
let property = 'opacity';
let initial = '1';
let final = '0';
let div = document.createElement('div');
div.style = `${property}:${initial};transition:${property} 2s;`
s.shadowRoot.appendChild(div);
div.offsetWidth;
div.style[property] = final;
setTimeout(() => div.parentNode.removeChild(div), 1000);
})();
On further testing, it may only happen when transitioning the opacity. top
and left
seemed to have no effect.
My mistake. I needed to momentarily click over to the Inspector tab and back to console to trigger the bug. Indeed, it does crash with left
, top
, width
, opacity
, and no doubt others. In fact, I managed to crash Firefox completely by running the code while the tab in question was in the background, and I was typing here.
Looks like this is patched in FF 107+
I reported this in Bug 1783021 - Tab crashes caused by extension "ContextSearch web-ext"'s Quick Menu after Inspector's Animations View has been activated once. Here's a copy-and-paste of that bug report:
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0 Build ID: 20220803094413
Steps to reproduce
Actual result
The tab crashes with signature [@ mozilla::dom::MutationObservers::NotifyAnimationMutated].
Expected result
No crashes.
Additional notes
A crash can be triggered even if Animation View is not active, as long as it has been activated at least once after a page is loaded. I.E. (Step 1 is implied): a: step 2 > 3 > switch to Layout View / close Inspector > step 4 > 5 => Crash; b: step 2 > 3 > keep Animations View active > reload page > 4 > 5 => Crash; c: step 2 > 3 > switch to Layout View / close Inspector > reload page > 4 > 5 => NO Crashes; d: open a new tab (about:newtab) > step 3 > 2 > 4 > 5 => Crash.
This crash is a longstanding bug. I can reproduce it since 2020-05-13 build but only because ContextSearch's Quick Menu stopped working/cannot be invoked prior to that build.
ContextSearch's Quick Menu works most of the time besides this scenario.