Bug 2424230

Description of problem:
I accessed https://codereview.qt-project.org/settings/#nameInput:~:text=Full%20name, cleared `//*[@id="nameInput"]`, then selected `//*[@id="displayNameInput"]`.

As demonstrated by:

- https://share.firefox.dev/3YaWDKa

- https://share.firefox.dev/4j9AwNJ

- https://share.firefox.dev/3MK49JD

…this causes the tab to ANR, so I invoked the performance profiler. As demonstrated by:

- https://crash-stats.mozilla.org/report/index/982441cf-c6e3-488d-8fcb-3d0620251221

- https://crash-stats.mozilla.org/report/index/32d26bd6-cb32-48ca-8bd4-d6e400251221

…this caused Firefox to SEGV.

Version-Release number of selected component:
firefox-146.0-3.fc43

Additional info:
reporter:       libreport-2.17.15
type:           CCpp
reason:         firefox killed by SIGSEGV
journald_cursor: s=c1f108f1ef4e48808a377c0a73f168fc;i=ff8719;b=5501e35729ce41878e5f237069022819;m=9df0ee10d;t=6467e430d9ac0;x=dfb706b72d3881b4
executable:     /usr/lib64/firefox/firefox
cmdline:        $'/usr/lib64/firefox/firefox -contentproc -isForBrowser -prefsHandle 0:38004 -prefMapHandle 1:293178 -jsInitHandle 2:223356 -parentBuildID 20251211125526 -sandboxReporter 3 -chrootClient 4 -ipcHandle 5 -initialChannelId {7558ad19-4cfa-4a8c-8230-7f9602dc29dd} -parentPid 301940 -crashReporter 6 -crashHelper 7 -greomni /usr/lib64/firefox/omni.ja -appomni /usr/lib64/firefox/browser/omni.ja -appDir /usr/lib64/firefox/browser 18 tab'
cgroup:         0::/user.slice/user-1000.slice/user/app.slice/app-org.mozilla.firefox
rootdir:        /proc/302798/fdinfo
uid:            1000
mountinfo:      
kernel:         6.17.12-300.fc43.x86_64
package:        firefox-146.0-3.fc43
runlevel:       /bin/sh: line 1: runlevel: command not found
backtrace_rating: 4
crash_function: JS::Value::toPrivate

Truncated backtrace:
Thread no. 0 (18 frames)
 #0 JS::Value::toPrivate at /usr/src/debug/firefox-146.0-3.fc43.x86_64/objdir/dist/include/js/Value.h:1004
 #1 JSFunction::nativeJitInfoOrInterpretedScript at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/JSFunction.h:521
 #2 JSFunction::baseScript at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/JSFunction.h:554
 #3 JSFunction::nonLazyScript at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/JSFunction.h:542
 #4 ScriptFromCalleeToken at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/jit/ScriptFromCalleeToken.h:24
 #5 js::jit::JSJitProfilingFrameIterator::frameScript at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/jit/JSJitFrameIter-inl.h:41
 #6 js::jit::JSJitProfilingFrameIterator::tryInitWithPC at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/jit/JSJitFrameIter.cpp:499
 #7 js::jit::JSJitProfilingFrameIterator::JSJitProfilingFrameIterator at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/jit/JSJitFrameIter.cpp:444
 #8 JS::ProfilingFrameIterator::iteratorConstruct at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/Stack.cpp:571
 #9 JS::ProfilingFrameIterator::ProfilingFrameIterator at /usr/src/debug/firefox-146.0-3.fc43.x86_64/js/src/vm/Stack.cpp:489
 #10 ExtractJsFrames at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:2291
 #11 DoSharedSample at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:3042
 #12 DoPeriodicSample at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:3119
 #13 operator() at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:4901
 #14 SuspendAndSampleAndResumeThread<SamplerThread::Run()::<lambda(const Registers&, const mozilla::TimeStamp&)> > at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform-linux-android.cpp:466
 #15 SamplerThread::Run at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform.cpp:4898
 #16 ThreadEntry at /usr/src/debug/firefox-146.0-3.fc43.x86_64/tools/profiler/core/platform-linux-android.cpp:505
 #17 set_alt_signal_stack_and_start at /usr/src/debug/firefox-146.0-3.fc43.x86_64/mozglue/interposers/pthread_create_interposer.cpp:81


Potential duplicate: bug 2312360

​