Crash in mozilla::dom::TextDirectiveCandidate::CreateNewCandidatesForGivenMatch(mozilla::dom::TextDirectiveCandidate const&, mozilla::dom::RangeContentCache&) const::{lambda(nsRange*, nsTString<char16_t> const&, nsRange*, nsTString<char16_t> const&, mozilla::dom::TextScanDirection, mozilla::Maybe<mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > >)#1}::operator()(nsRange*, nsTString<char16_t> const&, nsRange*, nsTString<char16_t> const&, mozilla::dom::TextScanDirection, mozilla::Maybe<mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > >) const [clone .isra.0]

Similar reports
Problem #756485
Component
firefox
Last affected version
0:140.0.4-1.fc41
Executable
/usr/lib64/firefox/firefox
Error name
SIGSEGV 11
First occurrence
2025-05-29
Last occurrence
2025-09-29
Unique reports
8
Quality
-62

Statistics

Operating system Unique / Total count
Fedora 42 8 / 21
Operating system Count
Fedora 42 21
Architecture Count
x86_64 21
Related packages Count
firefox 21
 0:139.0.4-1.fc42 13
 0:139.0-1.fc42 3
 0:140.0-1.fc42 2
 0:140.0.4-1.fc41 2
 0:138.0.4-1.fc42 1
liberation-sans-fonts 4
 1:2.1.5-13.fc42 2
 1:2.1.5-12.fc41 2
google-noto-sans-mono-vf-fonts 4
 0:20240701-2.fc41 2
 0:20250301-1.fc42 2
google-noto-color-emoji-fonts 4
 0:20241008-1.fc41 2
 0:20241008-2.fc42 2

Packages names with count less than the total count of reports are most probably not the cause of the problem.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.

History

Daily:

Weekly:

Monthly:

No reports in the last 20 days.


Backtrace

Frame # Function Binary Source or offset Line
1
mozilla::dom::TextDirectiveCandidate::CreateNewCandidatesForGivenMatch(mozilla::dom::TextDirectiveCandidate const&, mozilla::dom::RangeContentCache&) const::{lambda(nsRange*, nsTString<char16_t> const&, nsRange*, nsTString<char16_t> const&, mozilla::dom::TextScanDirection, mozilla::Maybe<mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > >)#1}::operator()(nsRange*, nsTString<char16_t> const&, nsRange*, nsTString<char16_t> const&, mozilla::dom::TextScanDirection, mozilla::Maybe<mozilla::RangeBoundaryBase<nsCOMPtr<nsINode>, nsCOMPtr<nsIContent> > >) const [clone .isra.0]
/usr/lib64/firefox/libxul.so 0x1126eca
Build id: daac599996733d190da69ea5130c1455e033e935 		-
2
mozilla::dom::TextDirectiveCreator::CreateTextDirectiveFromRange(mozilla::dom::Document&, nsRange*)
/usr/lib64/firefox/libxul.so 0x112bf62
Build id: daac599996733d190da69ea5130c1455e033e935 		-
3
mozilla::dom::FragmentDirective_Binding::createTextDirective_promiseWrapper(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x16adc3f
Build id: daac599996733d190da69ea5130c1455e033e935 		-
4
bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext*, unsigned int, JS::Value*)
/usr/lib64/firefox/libxul.so 0x34584f4
Build id: daac599996733d190da69ea5130c1455e033e935 		-
5
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x2d720d0
Build id: daac599996733d190da69ea5130c1455e033e935 		-
6
js::Interpret(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x2d617fa
Build id: daac599996733d190da69ea5130c1455e033e935 		-
7
js::RunScript(JSContext*, js::RunState&)
/usr/lib64/firefox/libxul.so 0x2d60f7e
Build id: daac599996733d190da69ea5130c1455e033e935 		-
8
js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)
/usr/lib64/firefox/libxul.so 0x2d721f3
Build id: daac599996733d190da69ea5130c1455e033e935 		-
9
JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)
/usr/lib64/firefox/libxul.so 0x2ec4053
Build id: daac599996733d190da69ea5130c1455e033e935 		-
10
mozilla::dom::MessageListener::ReceiveMessage(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::ReceiveMessageArgument const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)
/usr/lib64/firefox/libxul.so 0x2fca95e
Build id: daac599996733d190da69ea5130c1455e033e935 		-
11
mozilla::dom::JSActor::CallReceiveMessage(JSContext*, mozilla::dom::JSActorMessageMeta const&, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)
/usr/lib64/firefox/libxul.so 0x32288a0
Build id: daac599996733d190da69ea5130c1455e033e935 		-
12
mozilla::dom::JSActorManager::ReceiveRawMessage(mozilla::dom::JSActorMessageMeta const&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&, mozilla::Maybe<mozilla::dom::ipc::StructuredCloneData>&&)
/usr/lib64/firefox/libxul.so 0x32282fa
Build id: daac599996733d190da69ea5130c1455e033e935 		-
13
mozilla::dom::PWindowGlobalChild::OnMessageReceived(IPC::Message const&) [clone .cold]
/usr/lib64/firefox/libxul.so 0x2bfdb1
Build id: daac599996733d190da69ea5130c1455e033e935 		-
14
mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&)
/usr/lib64/firefox/libxul.so 0x2134ee5
Build id: daac599996733d190da69ea5130c1455e033e935 		-
15
mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >)
/usr/lib64/firefox/libxul.so 0x2eb8faf
Build id: daac599996733d190da69ea5130c1455e033e935 		-
16
mozilla::ipc::MessageChannel::MessageTask::Run()
/usr/lib64/firefox/libxul.so 0x2eb89db
Build id: daac599996733d190da69ea5130c1455e033e935 		-
17
mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
/usr/lib64/firefox/libxul.so 0x2ec74d0
Build id: daac599996733d190da69ea5130c1455e033e935 		-
18
mozilla::TaskController::ProcessPendingMTTask(bool)
/usr/lib64/firefox/libxul.so 0x2ec6d7b
Build id: daac599996733d190da69ea5130c1455e033e935 		-
19
mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::{lambda()#2}>::Run() [clone .lto_priv.0]
/usr/lib64/firefox/libxul.so 0x2ec6d39
Build id: daac599996733d190da69ea5130c1455e033e935 		-
20
nsThread::ProcessNextEvent(bool, bool*)
/usr/lib64/firefox/libxul.so 0x2c3821d
Build id: daac599996733d190da69ea5130c1455e033e935 		-
21
mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0x2fa1b67
Build id: daac599996733d190da69ea5130c1455e033e935 		-
22
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x32a2f23
Build id: daac599996733d190da69ea5130c1455e033e935 		-
23
nsBaseAppShell::Run()
/usr/lib64/firefox/libxul.so 0x354035d
Build id: daac599996733d190da69ea5130c1455e033e935 		-
24
nsAppShell::Run()
/usr/lib64/firefox/libxul.so 0x353fb05
Build id: daac599996733d190da69ea5130c1455e033e935 		-
25
mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
/usr/lib64/firefox/libxul.so 0xc12ebc
Build id: daac599996733d190da69ea5130c1455e033e935 		-
26
MessageLoop::Run()
/usr/lib64/firefox/libxul.so 0x32a2f23
Build id: daac599996733d190da69ea5130c1455e033e935 		-
27
XRE_InitChildProcess(int, char**, XREChildData const*)
/usr/lib64/firefox/libxul.so 0x27b5765
Build id: daac599996733d190da69ea5130c1455e033e935 		-
28
main
/usr/lib64/firefox/firefox 0x3e1f7
Build id: 0bf89a74f699ff3255d3677536b8ae9e150be7b4 		-
29
__libc_start_call_main
/lib64/libc.so.6 0x35f5
Build id: 2b3c02fe7e4d3811767175b6f323692a10a4e116 		-
30
__libc_start_main@@GLIBC_2.34
/lib64/libc.so.6 0x36a8
Build id: 2b3c02fe7e4d3811767175b6f323692a10a4e116 		-
31
_start
/usr/lib64/firefox/firefox 0x3b225
Build id: 0bf89a74f699ff3255d3677536b8ae9e150be7b4 		-