Closed Bug 1157195 Opened 5 years ago Closed 4 years ago

crash in mozilla::EventStateManager::FillInEventFromGestureDown(mozilla::WidgetMouseEvent*)

Categories

(Core :: User events and focus handling, defect, critical)

Unspecified
All
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla42
Tracking Status
e10s ? ---
firefox40 --- affected
firefox41 --- verified
firefox42 --- verified

People

(Reporter: jimm, Assigned: smaug)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This has been around in the content process for a while, it just never bubbled to the top because we had a lot of worse offenders above it.

https://crash-stats.mozilla.com/report/list?product=Firefox&range_value=3&range_unit=days&date=2015-04-22&signature=mozilla%3A%3AEventStateManager%3A%3AFillInEventFromGestureDown%28mozilla%3A%3AWidgetMouseEvent*%29&version=Firefox%3A40.0a1#tab-sigsummary

https://crash-stats.mozilla.com/report/index/ca62b095-5cc0-44e5-9173-5fc372150419

0 	xul.dll 	mozilla::EventStateManager::FillInEventFromGestureDown(mozilla::WidgetMouseEvent*) 	dom/events/EventStateManager.cpp
1 	xul.dll 	mozilla::EventStateManager::GenerateDragGesture(nsPresContext*, mozilla::WidgetMouseEvent*) 	dom/events/EventStateManager.cpp
2 	xul.dll 	mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*) 	dom/events/EventStateManager.cpp
3 	xul.dll 	PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) 	layout/base/nsPresShell.cpp
4 	xul.dll 	PresShell::HandlePositionedEvent(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*) 	layout/base/nsPresShell.cpp
5 	xul.dll 	PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*, nsIContent**) 	layout/base/nsPresShell.cpp
6 	xul.dll 	PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*, nsIContent**) 	layout/base/nsPresShell.cpp
7 	xul.dll 	nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) 	view/nsViewManager.cpp
8 	xul.dll 	nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) 	view/nsView.cpp
¡Hola Jim!

Am I seeing this bug or a different one?

¡Gracias!
Alex

Report ID 	Date Submitted
bp-ba4556fd-f76a-408f-81b2-d37122150611
	11/06/2015	05:54 p.m.

Crashing Thread
Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::EventStateManager::FillInEventFromGestureDown(mozilla::WidgetMouseEvent*) 	dom/events/EventStateManager.cpp
1 	xul.dll 	mozilla::EventStateManager::GenerateDragGesture(nsPresContext*, mozilla::WidgetMouseEvent*) 	dom/events/EventStateManager.cpp
2 	xul.dll 	mozilla::EventStateManager::PreHandleEvent(nsPresContext*, mozilla::WidgetEvent*, nsIFrame*, nsIContent*, nsEventStatus*) 	dom/events/EventStateManager.cpp
3 	xul.dll 	PresShell::HandleEventInternal(mozilla::WidgetEvent*, nsEventStatus*) 	layout/base/nsPresShell.cpp
4 	xul.dll 	PresShell::HandlePositionedEvent(nsIFrame*, mozilla::WidgetGUIEvent*, nsEventStatus*) 	layout/base/nsPresShell.cpp
5 	xul.dll 	PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*, nsIContent**) 	layout/base/nsPresShell.cpp
6 	xul.dll 	PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, nsEventStatus*, nsIContent**) 	layout/base/nsPresShell.cpp
7 	xul.dll 	nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*) 	view/nsViewManager.cpp
8 	xul.dll 	nsView::HandleEvent(mozilla::WidgetGUIEvent*, bool) 	view/nsView.cpp
9 	xul.dll 	mozilla::widget::PuppetWidget::DispatchEvent(mozilla::WidgetGUIEvent*, nsEventStatus&) 	widget/PuppetWidget.cpp
10 	xul.dll 	mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent(mozilla::WidgetGUIEvent&) 	gfx/layers/apz/util/APZCCallbackHelper.cpp
11 	xul.dll 	mozilla::dom::TabChild::RecvRealMouseButtonEvent(mozilla::WidgetMouseEvent const&) 	dom/ipc/TabChild.cpp
12 	xul.dll 	mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PBrowserChild.cpp
13 	xul.dll 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	obj-firefox/ipc/ipdl/PContentChild.cpp
14 	xul.dll 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
15 	xul.dll 	RunnableMethod<SoftwareDisplay, void ( SoftwareDisplay::*)(void), Tuple0>::Run() 	ipc/chromium/src/base/task.h
16 	xul.dll 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
17 	xul.dll 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
18 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
19 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
20 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
21 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
22 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
23 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
24 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
25 	xul.dll 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
26 	xul.dll 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
27 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
28 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
29 	xul.dll 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
30 	plugin-container.exe 	content_process_main(int, char** const) 	ipc/contentproc/plugin-container.cpp
31 	plugin-container.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
32 	plugin-container.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
33 	kernel32.dll 	BaseThreadInitThunk 	
34 	ntdll.dll 	RtlUserThreadStart 	
35 	kernel32.dll 	BasepReportFault 	
36 	kernel32.dll 	BasepReportFault
Flags: needinfo?(jmathies)
Yep, that's it, do you have steps to reproduce this?
Flags: needinfo?(jmathies)
#9 top aurora crasher
tracking-e10s: --- → ?
Hmm, nsIFrame::GetNearestWidget(); returns null? Doesn't make much sense to me, but we can try a null pointer check.
Attached patch wipSplinter Review
Sort of a debugging patch to see if this actually helps with the issue. If yes, the real bug is somewhere else.
Assignee: nobody → bugs
Attachment #8630194 - Flags: review?(masayuki)
Comment on attachment 8630194 [details] [diff] [review]
wip

As a wallpaper, it's okay.

Although, I'm not familiar with the process of destructing views nor widgets, it sounds like that dispatcher dispatches the events when it shouldn't do that.

E.g., PuppetWidget doesn't check if it's already destroyed:
http://hg.mozilla.org/mozilla-central/annotate/bfd82015df48/widget/PuppetWidget.cpp#l317
Attachment #8630194 - Flags: review?(masayuki) → review+
yeah, and I'd like to check with the patch whether it fixes the issue, or if the issue is somewhere else. AFAIK, we don't have STR for this bug.
https://hg.mozilla.org/mozilla-central/rev/18911ac13934
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla42
Smaug, would it be ok if we uplifted this to aurora?
Flags: needinfo?(bugs)
Comment on attachment 8630194 [details] [diff] [review]
wip

yes

Approval Request Comment
[Feature/regressing bug #]:
[User impact if declined]: null pointer crashes
[Describe test coverage new/current, TreeHerder]: landed to m-c some time ago
[Risks and why]: Should be safe null pointer check
[String/UUID change made/needed]: NA
Flags: needinfo?(bugs)
Attachment #8630194 - Flags: approval-mozilla-aurora?
Comment on attachment 8630194 [details] [diff] [review]
wip

it is low risk, it fixes a crash, let's take it.
Attachment #8630194 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Component: Event Handling → User events and focus handling
You need to log in before you can comment on or make changes to this bug.