1057256 - [Text selection] Fix Mnw failed on b2g emulator after enabling selection carets

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

After enabling selection carets, we got an error in Mnw test_touchcaret.py on b2g emulator. https://tbpl.mozilla.org/?tree=Try&rev=5635d88cfac6

The call stack catched locally is as follows. We should add null pointer check after getting caretFocusFrame.

Program received signal SIGSEGV, Segmentation fault.
nsIFrame::GetConstFrameSelection (this=0x0) at /home/tlin/Projects/gecko-dev/layout/generic/nsFrame.cpp:5750
5750	  return PresContext()->PresShell()->ConstFrameSelection();
(gdb) bt
#0  nsIFrame::GetConstFrameSelection (this=0x0) at /home/tlin/Projects/gecko-dev/layout/generic/nsFrame.cpp:5750
#1  0x415c64d6 in nsIFrame::GetFrameSelection (this=0x0)
    at /home/tlin/Projects/gecko-dev/layout/generic/nsFrame.cpp:5734
#2  0x4156d664 in mozilla::SelectionCarets::SetSelectionDragState (this=<value optimized out>, aState=false)
    at /home/tlin/Projects/gecko-dev/layout/base/SelectionCarets.cpp:714
#3  0x4156d80a in mozilla::SelectionCarets::SelectWord (this=0x44b46500)
    at /home/tlin/Projects/gecko-dev/layout/base/SelectionCarets.cpp:528
#4  0x4156d848 in mozilla::SelectionCarets::FireLongTap (aTimer=<value optimized out>, 
    aSelectionCarets=<value optimized out>) at /home/tlin/Projects/gecko-dev/layout/base/SelectionCarets.cpp:886
#5  0x40ab5294 in nsTimerImpl::Fire (this=0x45668e80)
    at /home/tlin/Projects/gecko-dev/xpcom/threads/nsTimerImpl.cpp:618
#6  0x40ab5342 in nsTimerEvent::Run (this=0x44dcf1b0)
    at /home/tlin/Projects/gecko-dev/xpcom/threads/nsTimerImpl.cpp:711
#7  0x40ab487c in nsThread::ProcessNextEvent (this=0x402025c0, aMayWait=false, aResult=0xbeca17bf)
    at /home/tlin/Projects/gecko-dev/xpcom/threads/nsThread.cpp:770
#8  0x40abf8e8 in NS_ProcessNextEvent (aThread=0x44b46500, aMayWait=false)
    at /home/tlin/Projects/gecko-dev/xpcom/glue/nsThreadUtils.cpp:265
#9  0x40c08b84 in mozilla::ipc::MessagePump::Run (this=0x40201e50, aDelegate=0x402550c0)
    at /home/tlin/Projects/gecko-dev/ipc/glue/MessagePump.cpp:99
#10 0x40bfbe0c in MessageLoop::RunInternal (this=0x1000000)
    at /home/tlin/Projects/gecko-dev/ipc/chromium/src/base/message_loop.cc:229
#11 0x40bfbe8a in MessageLoop::RunHandler (this=0x402550c0)
    at /home/tlin/Projects/gecko-dev/ipc/chromium/src/base/message_loop.cc:222
#12 MessageLoop::Run (this=0x402550c0) at /home/tlin/Projects/gecko-dev/ipc/chromium/src/base/message_loop.cc:196
#13 0x4132df74 in nsBaseAppShell::Run (this=0x43d47160)
    at /home/tlin/Projects/gecko-dev/widget/xpwidgets/nsBaseAppShell.cpp:164
#14 0x417b1668 in nsAppStartup::Run (this=0x43d56250)
    at /home/tlin/Projects/gecko-dev/toolkit/components/startup/nsAppStartup.cpp:278
#15 0x417c3a7c in XREMain::XRE_mainRun (this=0xbeca1a04)
    at /home/tlin/Projects/gecko-dev/toolkit/xre/nsAppRunner.cpp:4021
#16 0x417c61ec in XREMain::XRE_main (this=0xbeca1a04, argc=<value optimized out>, argv=<value optimized out>, 
    aAppData=0x235fc) at /home/tlin/Projects/gecko-dev/toolkit/xre/nsAppRunner.cpp:4092
#17 0x417c635c in XRE_main (argc=1, argv=0x40238178, aAppData=0x235fc, aFlags=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/toolkit/xre/nsAppRunner.cpp:4306
#18 0x0000a54a in do_main (argc=1, argv=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/b2g/app/nsBrowserApp.cpp:164
#19 b2g_main (argc=1, argv=<value optimized out>) at /home/tlin/Projects/gecko-dev/b2g/app/nsBrowserApp.cpp:290
#20 0x0000a2c4 in RunProcesses (argc=1, argv=0xbeca5c14)
    at /home/tlin/Projects/gecko-dev/b2g/app/B2GLoader.cpp:221
#21 main (argc=1, argv=0xbeca5c14) at /home/tlin/Projects/gecko-dev/b2g/app/B2GLoader.cpp:247

Comment 1

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

We should add null check in TouchCaret.cpp as well. focusFrame is nullptr here.

Program received signal SIGSEGV, Segmentation fault.
mozilla::TouchCaret::GetContentBoundary (this=0x465852e0)
    at /home/tlin/Projects/gecko-dev/layout/base/TouchCaret.cpp:176
176	  dom::Element* editingHost = focusFrame->GetContent()->GetEditingHost();
(gdb) bt
#0  mozilla::TouchCaret::GetContentBoundary (this=0x465852e0)
    at /home/tlin/Projects/gecko-dev/layout/base/TouchCaret.cpp:176
#1  0x4156d970 in mozilla::TouchCaret::HandleTouchMoveEvent (this=0x465852e0, aEvent=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/layout/base/TouchCaret.cpp:678
#2  0x4156dcee in mozilla::TouchCaret::HandleEvent (this=0x465852e0, aEvent=0xbead9dd8)
    at /home/tlin/Projects/gecko-dev/layout/base/TouchCaret.cpp:572
#3  0x415668bc in PresShell::HandleEvent (this=0x43db1bb0, aFrame=0x4580c2b8, aEvent=0xbead9dd8, 
    aDontRetargetEvents=<value optimized out>, aEventStatus=0xbead9d8c)
    at /home/tlin/Projects/gecko-dev/layout/base/nsPresShell.cpp:6850
#4  0x4132b898 in nsViewManager::DispatchEvent (this=<value optimized out>, aEvent=0xbead9dd8, 
    aView=<value optimized out>, aStatus=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/view/nsViewManager.cpp:775
#5  0x4132a574 in nsView::HandleEvent (this=<value optimized out>, aEvent=0xbead9dd8, 
    aUseAttachedEvents=<value optimized out>) at /home/tlin/Projects/gecko-dev/view/nsView.cpp:1097
#6  0x4134a7bc in nsWindow::DispatchEvent (this=<value optimized out>, aEvent=0x0, aStatus=@0xbead9e68)
    at /home/tlin/Projects/gecko-dev/widget/gonk/nsWindow.cpp:426
#7  0x40ef46d4 in nsDOMWindowUtils::SendTouchEventCommon (this=0x44a94c60, aType=<value optimized out>, 
    aIdentifiers=<value optimized out>, aXs=0x4022f578, aYs=0x4022f5c8, aRxs=0x4022f5d8, aRys=0x4022f5dc, 
    aRotationAngles=0x4022f600, aForces=0x4022f614, aCount=1, aModifiers=0, aIgnoreRootScrollFrame=false, 
    aToWindow=false, aPreventDefault=0x4027f9b8)
    at /home/tlin/Projects/gecko-dev/dom/base/nsDOMWindowUtils.cpp:1144
#8  0x40eeea56 in nsDOMWindowUtils::SendTouchEvent (this=0x4580a130, aType=..., aIdentifiers=0x0, 
    aXs=0x44d61690, aYs=0x4022f5c8, aRxs=0x4022f5d8, aRys=0x4022f5dc, aRotationAngles=0x4022f600, 
    aForces=0x4022f614, aCount=1, aModifiers=0, aIgnoreRootScrollFrame=<value optimized out>, 
    aPreventDefault=0x4027f9b8) at /home/tlin/Projects/gecko-dev/dom/base/nsDOMWindowUtils.cpp:1054
#9  0x40ab7d3c in NS_InvokeByIndex (that=0x44a94c60, methodIndex=<value optimized out>, 
    paramCount=<value optimized out>, params=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp:164
#10 0x40d148e0 in CallMethodHelper::Invoke (ccx=<value optimized out>, mode=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/js/xpconnect/src/XPCWrappedNative.cpp:2369
#11 CallMethodHelper::Call (ccx=<value optimized out>, mode=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/js/xpconnect/src/XPCWrappedNative.cpp:1730
#12 XPCWrappedNative::CallMethod (ccx=<value optimized out>, mode=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/js/xpconnect/src/XPCWrappedNative.cpp:1697
#13 0x40d14cc4 in XPC_WN_CallMethod (cx=0x40255440, argc=10, vp=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1288
#14 0x41c49ba8 in CallJSNative (cx=0x40255440, args=..., construct=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/js/src/jscntxtinlines.h:231
#15 js::Invoke (cx=0x40255440, args=..., construct=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/js/src/vm/Interpreter.cpp:464
#16 0x41c4691e in Interpret (cx=0x40255440, state=...)
    at /home/tlin/Projects/gecko-dev/js/src/vm/Interpreter.cpp:2546
#17 0x41c48cea in js::RunScript (cx=0x40255440, state=...)
    at /home/tlin/Projects/gecko-dev/js/src/vm/Interpreter.cpp:411
#18 0x41c49b88 in js::Invoke (cx=0x40255440, args=..., construct=1154881168)
    at /home/tlin/Projects/gecko-dev/js/src/vm/Interpreter.cpp:483
#19 0x41c4a1dc in js::Invoke (cx=0x40255440, thisv=..., fval=..., argc=3199054824, argv=0xbeadb3e8, rval=...)
    at /home/tlin/Projects/gecko-dev/js/src/vm/Interpreter.cpp:520
#20 0x41bc20d0 in JS_CallFunctionValue (cx=0x40255440, obj=<value optimized out>, fval=..., 
    args=<value optimized out>, rval=...) at /home/tlin/Projects/gecko-dev/js/src/jsapi.cpp:4983
#21 0x40d0c074 in nsXPCWrappedJSClass::CallMethod (this=0x43eeb5e0, wrapper=<value optimized out>, 
    methodIndex=<value optimized out>, info_=0x43c30850, nativeParams=0xbeadb670)
    at /home/tlin/Projects/gecko-dev/js/xpconnect/src/XPCWrappedJSClass.cpp:1258
#22 0x40d0648a in nsXPCWrappedJS::CallMethod (this=0x43cdedc0, methodIndex=3, info=0x43c30850, 
    params=<value optimized out>) at /home/tlin/Projects/gecko-dev/js/xpconnect/src/XPCWrappedJS.cpp:519
#23 0x40ab8624 in PrepareAndDispatch (self=0x43d5c2e0, methodIndex=<value optimized out>, args=0xbeadb72c)
    at /home/tlin/Projects/gecko-dev/xpcom/reflect/xptcall/md/unix/xptcstubs_arm.cpp:93
#24 0x40ab7d8c in SharedStub () from /home/tlin/Projects/b2g-emulator/objdir-gecko/dist/bin/libxul.so
#25 0x40ab58d8 in nsTimerImpl::Fire (this=0x460a8f10)
    at /home/tlin/Projects/gecko-dev/xpcom/threads/nsTimerImpl.cpp:621
#26 0x40ab597a in nsTimerEvent::Run (this=0x44e78170)
    at /home/tlin/Projects/gecko-dev/xpcom/threads/nsTimerImpl.cpp:711
#27 0x40ab4eb0 in nsThread::ProcessNextEvent (this=0x402025c0, aMayWait=false, aResult=0xbeadb7bf)
    at /home/tlin/Projects/gecko-dev/xpcom/threads/nsThread.cpp:770
#28 0x40abff48 in NS_ProcessNextEvent (aThread=0xbeadb670, aMayWait=false)
    at /home/tlin/Projects/gecko-dev/xpcom/glue/nsThreadUtils.cpp:265
#29 0x40c09098 in mozilla::ipc::MessagePump::Run (this=0x40201e50, aDelegate=0x402550c0)
    at /home/tlin/Projects/gecko-dev/ipc/glue/MessagePump.cpp:99
#30 0x40bfc2fc in MessageLoop::RunInternal (this=0x1000000)
    at /home/tlin/Projects/gecko-dev/ipc/chromium/src/base/message_loop.cc:229
#31 0x40bfc37a in MessageLoop::RunHandler (this=0x402550c0)
    at /home/tlin/Projects/gecko-dev/ipc/chromium/src/base/message_loop.cc:222
#32 MessageLoop::Run (this=0x402550c0) at /home/tlin/Projects/gecko-dev/ipc/chromium/src/base/message_loop.cc:196
#33 0x4132ed44 in nsBaseAppShell::Run (this=0x43d47100)
    at /home/tlin/Projects/gecko-dev/widget/xpwidgets/nsBaseAppShell.cpp:164
#34 0x417b2588 in nsAppStartup::Run (this=0x43d4b220)
    at /home/tlin/Projects/gecko-dev/toolkit/components/startup/nsAppStartup.cpp:278
#35 0x417c49ac in XREMain::XRE_mainRun (this=0xbeadba04)
    at /home/tlin/Projects/gecko-dev/toolkit/xre/nsAppRunner.cpp:4024
#36 0x417c7134 in XREMain::XRE_main (this=0xbeadba04, argc=<value optimized out>, argv=<value optimized out>, 
    aAppData=0x235fc) at /home/tlin/Projects/gecko-dev/toolkit/xre/nsAppRunner.cpp:4095
#37 0x417c72a4 in XRE_main (argc=1, argv=0x40238178, aAppData=0x235fc, aFlags=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/toolkit/xre/nsAppRunner.cpp:4309
#38 0x0000a54a in do_main (argc=1, argv=<value optimized out>)
    at /home/tlin/Projects/gecko-dev/b2g/app/nsBrowserApp.cpp:164
#39 b2g_main (argc=1, argv=<value optimized out>) at /home/tlin/Projects/gecko-dev/b2g/app/nsBrowserApp.cpp:290
#40 0x0000a2c4 in RunProcesses (argc=1, argv=0xbeadfc14)
    at /home/tlin/Projects/gecko-dev/b2g/app/B2GLoader.cpp:221
#41 main (argc=1, argv=0xbeadfc14) at /home/tlin/Projects/gecko-dev/b2g/app/B2GLoader.cpp:247

Comment 2

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Part 1 - Remove NS_ENSURE_TRUE in SelectionCarets.cpp.

Remove NS_ENSURE_TRUE and NS_ENSURE_TRUE_VOID since they are deprecated,
and we do not need to print log in plain null pointer check.

Comment 3

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Part 2 - Add null pointer check for touch and selection carets.

TouchCaret::IsDisplayable() contains more null pointer check. It covers
what's original there in TouchCaret::HandleEvent().

Comment 4

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Part 1 - Remove NS_ENSURE_TRUE in SelectionCarets.cpp. (v2)

Rebase.

Comment 5

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Part 2 - Add null pointer check for touch and selection carets. (v2)

Rebase.

Comment 6

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Attachment: Part 3 - Make touch caret handle events before selection carets. (v1)

Comment 7

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Try result (with selection carets enabled):
https://tbpl.mozilla.org/?tree=Try&rev=c6e5db1e8bba

Try result (only touch caret enabled):
https://tbpl.mozilla.org/?tree=Try&rev=a2fd0024f2d9

Comment 8

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Those patches need to be check in after bug 1057256. Thanks.

Comment 9

[Ting-Yu Lin [:TYLin] (PST, UTC-7)]

Those patch need to be check in after bug 1056457. Thanks.

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/53719d03f70a
https://hg.mozilla.org/integration/mozilla-inbound/rev/da880002e2af
https://hg.mozilla.org/integration/mozilla-inbound/rev/6d59613b92df

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/53719d03f70a
https://hg.mozilla.org/mozilla-central/rev/da880002e2af
https://hg.mozilla.org/mozilla-central/rev/6d59613b92df