shutdown crash in APZCCallbackHelper::SendSetTargetAPZCNotification(nsIWidget*, nsIDocument*, mozilla::WidgetGUIEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long long, nsRefPtr<mozilla::layers::SetTargetAPZCCallback> const&)

RESOLVED FIXED in Firefox 40, Firefox OS v2.2

Status

()

--
critical
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: nhirata, Assigned: kats)

Tracking

(Depends on: 1 bug, {crash})

39 Branch
mozilla40
All
Gonk (Firefox OS)
crash
Points:
---

Firefox Tracking Flags

(blocking-b2g:2.2+, firefox38 wontfix, firefox39 wontfix, firefox40 fixed, b2g-v2.2 fixed, b2g-master fixed)

Details

(Whiteboard: [caf-crash 610][caf priority: p1][CR 820822][b2g-crash][gfx-noted], crash signature)

Attachments

(3 attachments)

This bug was filed from the Socorro interface and is 
report bp-5a1dbead-0c57-4be4-978a-98f0a2150327.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::layers::APZCCallbackHelper::SendSetTargetAPZCNotification(nsIWidget*, nsIDocument*, mozilla::WidgetGUIEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long long, nsRefPtr<mozilla::layers::SetTargetAPZCCallback> const&) 	/builds/slave/b2g_m-b37_22_flm-kk_ntly-00000/build/objdir-gecko/dist/include/nsIDocument.h:631
1 	libxul.so 	nsBaseWidget::DispatchEventForAPZ(mozilla::WidgetGUIEvent*, mozilla::layers::ScrollableLayerGuid const&, unsigned long long) 	widget/nsBaseWidget.cpp
2 	libxul.so 	nsWindow::DispatchTouchEventForAPZ(mozilla::MultiTouchInput const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long long) 	widget/gonk/nsWindow.cpp
3 	libxul.so 	DispatchTouchInputOnMainThread::Run() 	widget/gonk/nsWindow.cpp
4 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
5 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
6 	libxul.so 	mozilla::dom::indexedDB::::QuotaClient::ShutdownTransactionService 	dom/indexedDB/ActorsParent.cpp
7 	libxul.so 	mozilla::dom::quota::QuotaManager::Observe(nsISupports*, char const*, char16_t const*) 	dom/quota/QuotaManager.cpp
8 	libxul.so 	nsObserverList::NotifyObservers(nsISupports*, char const*, char16_t const*) 	xpcom/ds/nsObserverList.cpp
9 	libxul.so 	nsObserverService::NotifyObservers(nsISupports*, char const*, char16_t const*) 	xpcom/ds/nsObserverService.cpp
10 	libxul.so 	mozilla::dom::power::PowerManagerService::SyncProfile() 	dom/power/PowerManagerService.cpp
11 	libxul.so 	mozilla::dom::power::PowerManagerService::Reboot() 	dom/power/PowerManagerService.cpp
12 	libxul.so 	mozilla::dom::PowerManager::Reboot(mozilla::ErrorResult&) 	dom/power/PowerManager.cpp
13 	libxul.so 	mozilla::dom::MozPowerManagerBinding::reboot 	/builds/slave/b2g_m-b37_22_flm-kk_ntly-00000/build/objdir-gecko/dom/bindings/MozPowerManagerBinding.cpp:62
14 	libxul.so 	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) 	dom/bindings/BindingUtils.cpp
15 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/jscntxtinlines.h
16 	libxul.so 	Interpret 	js/src/vm/Interpreter.cpp
17 	libxul.so 	js::RunScript(JSContext*, js::RunState&) 	js/src/vm/Interpreter.cpp
18 	libxul.so 	js::Invoke(JSContext*, JS::CallArgs, js::MaybeConstruct) 	js/src/vm/Interpreter.cpp
19 	libxul.so 	js::Invoke(JSContext*, JS::Value const&, JS::Value const&, unsigned int, JS::Value const*, JS::MutableHandle<JS::Value>) 	js/src/vm/Interpreter.cpp
20 	libxul.so 	JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) 	js/src/jsapi.cpp
21 	libxul.so 	mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) 	/builds/slave/b2g_m-b37_22_flm-kk_ntly-00000/build/objdir-gecko/dom/bindings/EventListenerBinding.cpp:47
22 	libxul.so 	void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, mozilla::dom::CallbackObject::ExceptionHandling) 	/builds/slave/b2g_m-b37_22_flm-kk_ntly-00000/build/objdir-gecko/dist/include/mozilla/dom/EventListenerBinding.h:54
23 	libxul.so 	mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) 	dom/events/EventListenerManager.cpp
24 	libxul.so 	mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) 	dom/events/EventListenerManager.cpp
25 	libxul.so 	mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) 	/builds/slave/b2g_m-b37_22_flm-kk_ntly-00000/build/objdir-gecko/dist/include/mozilla/EventListenerManager.h:330
26 	libxul.so 	mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) 	dom/events/EventDispatcher.cpp
27 	libxul.so 	mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) 	dom/events/EventDispatcher.cpp
28 	libxul.so 	nsAnimationManager::DoDispatchEvents() 	layout/style/nsAnimationManager.cpp
29 	libxul.so 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
30 	libxul.so 	mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
31 	libxul.so 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp
32 	libxul.so 	nsRunnableMethodImpl<bool (mozilla::MediaCodecReader::*)(long long), long long, true>::Run() 	/builds/slave/b2g_m-b37_22_flm-kk_ntly-00000/build/objdir-gecko/dist/include/nsThreadUtils.h:361
33 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
34 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
35 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
36 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
37 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
38 	libxul.so 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
39 	libxul.so 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
40 	libxul.so 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
41 	libxul.so 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
42 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp
43 	b2g 	do_main 	b2g/app/nsBrowserApp.cpp
44 	b2g 	b2g_main(int, char const**) 	b2g/app/nsBrowserApp.cpp
45 	b2g 	main 	b2g/app/B2GLoader.cpp
46 	libc.so 	__libc_init 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/bionic/libc/bionic/libc_init_dynamic.cpp:112
47 	b2g 	b2g@0x941a 	
48 	linker 	set_soinfo_pool_protection 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/bionic/linker/linker.cpp:291
49 		@0xbead1d94

More Reports: 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozilla%3A%3Alayers%3A%3AAPZCCallbackHelper%3A%3ASendSetTargetAPZCNotification%28nsIWidget*%2C+nsIDocument*%2C+mozilla%3A%3AWidgetGUIEvent+const%26%2C+mozilla%3A%3Alayers%3A%3AScrollableLayerGuid+const%26%2C+unsigned+long+long%2C+nsRefPtr%3Cmozilla%3A%3Alayers%3A%3ASetTargetAPZCCallback%3E+const%26%29#tab-reports

Occurs in 37, 39.0a1; last crash 20150325002503
Whiteboard: [b2g-crash]
status-b2g-v2.2: --- → affected
status-b2g-master: --- → affected
Component: Graphics: Layers → Panning and Zooming
This looks like a shutdown crash
Depends on: 524410
Summary: crash in mozilla::layers::APZCCallbackHelper::SendSetTargetAPZCNotification(nsIWidget*, nsIDocument*, mozilla::WidgetGUIEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long long, nsRefPtr<mozilla::layers::SetTargetAPZCCallback> const&) → shutdown crash in APZCCallbackHelper::SendSetTargetAPZCNotification(nsIWidget*, nsIDocument*, mozilla::WidgetGUIEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long long, nsRefPtr<mozilla::layers::SetTargetAPZCCallback> const&)
Whiteboard: [b2g-crash] → [b2g-crash][gfx-noted]
It looks like APZCCallbackHelper::SendSetTargetAPZCNotification assumes its aDocument parameter is not null, but nsBaseWidget can pass in a null document. Perhaps this can happen during shutdown.
Created attachment 8586814 [details] [diff] [review]
Null check
Assignee: nobody → bugmail.mozilla
Attachment #8586814 - Flags: review?(botond)

Updated

4 years ago
Attachment #8586814 - Flags: review?(botond) → review+
https://hg.mozilla.org/mozilla-central/rev/600015044b60
Status: NEW → RESOLVED
Last Resolved: 4 years ago
status-firefox40: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla40

Updated

4 years ago
Duplicate of this bug: 1153404
This had a 2.2+ dupe, moving nomination here.
blocking-b2g: --- → 2.2?
Comment on attachment 8586814 [details] [diff] [review]
Null check

Seen on v2.2 stability testing
Attachment #8586814 - Flags: approval-mozilla-b2g37?

Updated

4 years ago
Whiteboard: [b2g-crash][gfx-noted] → [CR 820822][b2g-crash][gfx-noted]

Updated

4 years ago
Whiteboard: [CR 820822][b2g-crash][gfx-noted] → [caf priority: p1][CR 820822][b2g-crash][gfx-noted]

Updated

4 years ago
Whiteboard: [caf priority: p1][CR 820822][b2g-crash][gfx-noted] → [caf-crash 610][caf priority: p1][CR 820822][b2g-crash][gfx-noted]
Created attachment 8591175 [details]
EXTRA file attachment - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.127
Created attachment 8591176 [details]
decoded minidump - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.127

Updated

4 years ago
blocking-b2g: 2.2? → 2.2+

Updated

4 years ago
Attachment #8586814 - Flags: approval-mozilla-b2g37? → approval-mozilla-b2g37+
https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/98e34ab531a2
status-b2g-v2.2: affected → fixed
status-b2g-master: affected → fixed
status-firefox38: --- → wontfix
status-firefox39: --- → wontfix
You need to log in before you can comment on or make changes to this bug.