1140201 - crash in nsView::GetPresShell()

Status: RESOLVED DUPLICATE of bug 1139845

(Core :: Web Painting, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-c02ff0e9-9b90-4e98-a344-6add02150228.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	nsView::GetPresShell() 	view/nsViewManager.h
1 	libxul.so 	mozilla::layers::ChromeProcessController::NotifyAPZStateChange(mozilla::layers::ScrollableLayerGuid const&, mozilla::layers::GeckoContentController::APZStateChange, int) 	gfx/layers/apz/util/ChromeProcessController.cpp
2 	libxul.so 	RunnableMethod<mozilla::layers::ChromeProcessController, void (mozilla::layers::ChromeProcessController::*)(mozilla::layers::ScrollableLayerGuid const&, mozilla::layers::GeckoContentController::APZStateChange, int), Tuple3<mozilla::layers::ScrollableLayerGuid, mozilla::layers::GeckoContentController::APZStateChange, int> >::Run() 	ipc/chromium/src/base/tuple.h
3 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
4 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
5 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
6 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
7 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
8 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
9 	libxul.so 	mozilla::dom::ContentParent::Observe(nsISupports*, char const*, char16_t const*) 	dom/ipc/ContentParent.cpp
10 	libxul.so 	nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) 	xpcom/ds/nsObserverList.cpp
11 	libxul.so 	nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) 	xpcom/ds/nsObserverService.cpp
12 	libxul.so 	mozilla::dom::power::PowerManagerService::SyncProfile() 	dom/power/PowerManagerService.cpp
13 	libxul.so 	mozilla::dom::power::PowerManagerService::Reboot() 	dom/power/PowerManagerService.cpp
14 	libxul.so 	mozilla::dom::PowerManager::Reboot(mozilla::ErrorResult&) 	dom/power/PowerManager.cpp
15 	libxul.so 	mozilla::dom::MozPowerManagerBinding::reboot 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dom/bindings/MozPowerManagerBinding.cpp:63
16 	libxul.so 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
17 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
18 	libxul.so 	Interpret 	js/src/vm/Interpreter.cpp
19 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
20 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
21 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
22 	libxul.so 	JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
23 	libxul.so 	mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dom/bindings/EventListenerBinding.cpp:48
24 	libxul.so 	void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling, JSCompartment*) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/dom/EventListenerBinding.h:54
25 	libxul.so 	mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) 	dom/events/EventListenerManager.cpp
26 	libxul.so 	mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) 	dom/events/EventListenerManager.cpp
27 	libxul.so 	mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/EventListenerManager.h:330
28 	libxul.so 	mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) 	dom/events/EventDispatcher.cpp
29 	libxul.so 	mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) 	dom/events/EventDispatcher.cpp
30 	libxul.so 	nsAnimationManager::DoDispatchEvents() 	layout/style/nsAnimationManager.cpp
31 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
32 	libxul.so 	nsRefreshDriver::DoTick() 	layout/base/nsRefreshDriver.cpp
33 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
34 	libxul.so 	nsRefreshDriver::DoTick() 	layout/base/nsRefreshDriver.cpp
35 	libxul.so 	nsRefreshDriver::FinishedWaitingForTransaction() 	layout/base/nsRefreshDriver.cpp
36 	libxul.so 	mozilla::layers::ClientLayerManager::DidComposite(unsigned long long) 	gfx/layers/client/ClientLayerManager.cpp
37 	libxul.so 	mozilla::layers::CompositorChild::RecvDidComposite(unsigned long long const&, unsigned long long const&) 	gfx/layers/ipc/CompositorChild.cpp
38 	libxul.so 	mozilla::layers::PCompositorChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/ipc/ipdl/PCompositorChild.cpp:820
39 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
40 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
41 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
42 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
43 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/ipc/MessageChannel.h:437
44 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
45 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
46 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
47 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
48 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
49 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
50 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
51 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
52 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
53 	libxul.so 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
54 	libxul.so 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
55 	libxul.so 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
56 	libxul.so 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
57 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp
58 	b2g 	do_main 	b2g/app/nsBrowserApp.cpp
59 	b2g 	b2g_main(int, char const**) 	b2g/app/nsBrowserApp.cpp
60 	b2g 	main 	b2g/app/B2GLoader.cpp
Ø 61 	libc.so 	libc.so@0xe4a3 	
62 	linker 	set_soinfo_pool_protection 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/bionic/linker/linker.cpp:291
63 		@0xbeda3b24

More reports : https://crash-stats.mozilla.com/report/list?product=B2G&signature=nsView%3A%3AGetPresShell%28%29#tab-reports

This has been occurring at least from 20150213010213; gecko 37, 38, and 39 are affected.

Comment 1

[Mats Palmgren (inactive)]

http://hg.mozilla.org/mozilla-central/annotate/600f44fd317c/gfx/layers/apz/util/ChromeProcessController.cpp#l115
'view' can be null here if the shell has been destroyed for example.  We need to
null-check 'view' and return null, and possible add null-checks in callers.

[Tracking Requested - why for this release]:
we should fix this crash before it hits the release channel

Comment 2

[Botond Ballo [:botond]]

This was just fixed in bug 1139845.

Comment 3

[Botond Ballo [:botond]]

(In reply to Botond Ballo [:botond] from comment #2)
> This was just fixed in bug 1139845.
> 
> *** This bug has been marked as a duplicate of bug 1139845 ***

Er, sorry, the fix there hasn't landed yet. The bug's a duplicate all the same.

Comment 4

[Lawrence Mandel [:lmandel] (use needinfo)]

Clearing tracking noms. We'll track bug 1139845 instead.