CP crashes the browser when you copy, then expand a Bard-containing Replicator set (Chrome/Edge ≥ 148)

[waldemar-p]

Bug description

In the CP, if you copy some text and then expand a collapsed Replicator set that has a Bard field in it, the whole browser tab dies — Edge shows Errorcode 5, Chrome shows "Aw, Snap!" — and you lose unsaved edits. It might be an upstream Chromium bug, not really Statamic's fault, but the CP triggers it every time (seemingly since Statamic 6), so it's worth flagging (and Statamic could probably guard against it until Chrome fixes it).

Environment

Statamic 6.21 until 6.23. Repros in Chrome & Edge 148–151 (tried Edge 146, 147, 148, 149, 151, Chrome for Testing 149), Windows + Linux. Worked fine before version 148.

What might be going on

It's a Chromium renderer crash — not a JS error, not out-of-memory. edge://crashes shows process renderer, code 0x80000003 (STATUS_BREAKPOINT); on Linux it comes out as a CFI (Control Flow Integrity) violation (SIGILL/ILL_ILLOPN). Chrome calls through a wrong-type function pointer — a type-confusion thing — and its CFI guard catches it and kills the tab on purpose. The trigger is the combo clipboard copy → spin up a ProseMirror editor. Since it's buried in Chrome's own compiled code, we couldn't reproduce it with a plain contenteditable, and there's nothing to fix on the Statamic side — only avoid. Already reported to Google via Chrome's Help → Report an issue. (Disclaimer: examination supported by AI)

Workaround we're running

A small CP script: after a copy, it grabs the next control click, blurs whatever's focused, and re-fires that click two frames later — so the Bard editor mounts a beat later instead of in the same click. It's just automating the "click somewhere else first, then expand" trick that avoids the crash, and it handles the back-to-back-expand case too.

\Statamic\Statamic::inlineScript(<<<'JS'
(function () {
    var copied = false, armed = null;
    document.addEventListener('copy', function () { copied = true; });
    document.addEventListener('pointerdown', function (e) {
        armed = null;
        if (!copied) return;
        var t = e.target;
        var btn = t.closest && t.closest('button, [role=button], a[href]');
        if (!btn) return;
        var a = document.activeElement;
        if (a && (a.isContentEditable || (a.matches && a.matches('input, textarea')))) {
            var field = a.closest && a.closest('.publish-field');
            if (a === t || a.contains(t) || (field && field.contains(t))) return; // editing this field
        }
        armed = btn;
        if (a && a.blur) a.blur();
    }, true);
    document.addEventListener('click', function (e) {
        if (e.__cmsReplay) return;
        var btn = armed; armed = null;
        if (!btn || !(e.target === btn || btn.contains(e.target))) return;
        e.preventDefault();
        e.stopImmediatePropagation();
        requestAnimationFrame(function () {
            requestAnimationFrame(function () {
                var ev = new MouseEvent('click', { bubbles: true, cancelable: true, view: window });
                ev.__cmsReplay = true;
                btn.dispatchEvent(ev);
            });
        });
    }, true);
})();
JS);

(Disclaimer: Script creation supported by AI)

Idea for a built-in guard

Same trick, but scoped: when a set gets expanded, blur the active element and defer the editor mount by a frame (requestAnimationFrame) so it never spins up in the same turn as the click. Cleaner than our blanket version.

Happy to share the full crash backtrace and edge://crashes IDs — can grab them again if useful.

How to reproduce

1. Entry with a Replicator whose sets contain a Bard field; collapse one of them.
2. Copy text from any field (Bard, or even a plain <input> — both work).
3. Expand the set with the Bard field → crash.

A few things we nailed down: the copy is required (no copy, no crash), only sets that actually mount a Bard/ProseMirror editor crash (input-only sets are fine), and only expanding does it (collapsing is safe).

Logs

No logs. Browser only problem.

Environment

Environment
Laravel Version: 13.15.0
PHP Version: 8.3.29
Composer Version: 2.9.5
Environment: local
Debug Mode: ENABLED
Maintenance Mode: OFF
Timezone: UTC
Locale: de

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: file
Database: mysql
Logs: stack / single
Mail: smtp
Queue: sync
Session: file

Storage
public/storage: NOT LINKED

Statamic
Addons: 2
License Key: Set
Sites: 2 (Deutsch, Schweizerdeutsch)
Stache Watcher: Disabled
Static Caching: Disabled
Version: 6.24.0 PRO

Statamic Addons
aerni/font-awesome: 4.0.1
teamnovu/graphql-breadcrumbs: 1.0.8

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

[duncanmcclean]

Happy to share the full crash backtrace and edge://crashes IDs — can grab them again if useful.

Yes, please.

[waldemar-p]

Happy to share the full crash backtrace and edge://crashes IDs — can grab them again if useful.

Yes, please.

I have to correct myself, that there is zero console log or other (for me visible) backtrace, but here is the edge://crashes content of that crash.

{
  "Local ID": "8582e1a5-14e5-4d5d-8a5d-e5829dfd2bc7",
  "Upload ID": "8582e1a5-14e5-4d5d-8a5d-e5829dfd2bc7",
  "Bucket ID": "e4ddc116fa6dbb4e0a09dc18c50533c0",
  "Cab ID": "",
  "Capture Time": "Monday, 6 July 2026 at 15:28:43",
  "Upload Time": "Monday, 6 July 2026 at 15:28:43",
  "State": "Reported",
  "P1": "msedge.exe",
  "P2": "149.0.4022.80",
  "P3": "msedge.dll",
  "P4": "149.0.4022.80",
  "P5": "80086729",
  "P6": "renderer",
  "P7": "0x80000003",
  "P8": "0"
}