Extension Imagus crashes Nightly when scrolling an Imgur album [@ mozilla::layers::AsyncPanZoomController::OnTouchEndOrCancel() ]

RESOLVED FIXED in Firefox 43

Status

()

Core
Panning and Zooming
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: Fanolian, Assigned: kats)

Tracking

({crash, regression, reproducible})

43 Branch
mozilla43
crash, regression, reproducible
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox43 fixed)

Details

(crash signature)

Attachments

(2 attachments, 2 obsolete attachments)

(Reporter)

Description

3 years ago
User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20150826030211

Steps to reproduce:

1. In a new profile, install Imagus 0.9.8.25 at https://addons.mozilla.org/en-US/firefox/addon/imagus/versions/ (Or 0.9.8.23 to bypass disabling xpinstall.signatures.required)
2. Find a link to any Imgur album, e.g. https://www.reddit.com/r/funny/comments/3iggvg/cars_and_their_faces/
3. Hover on the link so Imagus loads the first image of the album.
4. Try to scroll to the next image with scroll wheel.


Actual results:

Nightly 2015-08-26 build crashes. Here are some crash ids:
bp-83bd12e4-7163-454c-8a7b-447fd2150826
bp-bf7b360c-c124-4f5b-8d96-89f242150826
bp-99f34446-f48d-47cc-a364-231de2150826

Windows also shows an application error to plugin-container.exe:
The exception Breakpoint
A breakpoint has been reached.
(0x80000003) occurred in the application at location 0x73dcf58b.
(Reporter)

Comment 1

3 years ago
(Amendment)
Step 2:
Actual link to an Imgur album: http://imgur.com/a/xJWLR
Crash Signature: [@ mozilla::layers::AsyncPanZoomController::OnTouchEndOrCancel() ]
Keywords: crash, regression, regressionwindow-wanted, reproducible
Regression from bug 1194876 which I landed recently. CurrentTouchBlock() is likely returning null in this case since we're not inside a touch block when OnTouchEndOrCancel is called.
Assignee: nobody → bugmail.mozilla
Blocks: 1194876
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regressionwindow-wanted
Created attachment 8653098 [details] [diff] [review]
Patch
Attachment #8653098 - Flags: review?(botond)
Created attachment 8653100 [details] [diff] [review]
Gtest
Attachment #8653100 - Flags: review?(botond)
According to crash-stats there are ~380 reports so far, which is pretty bad. I'd like to direct-land this on central if possible to get it into the next nightly. Markus could also repro this crash and confirmed that my patch fixed it. Try push at https://treeherder.mozilla.org/#/jobs?repo=try&revision=8b2e745027ed
Comment on attachment 8653098 [details] [diff] [review]
Patch

Review of attachment 8653098 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ +3136,4 @@
>  void
>  AsyncPanZoomController::ResetInputState()
>  {
>    MultiTouchInput cancel(MultiTouchInput::MULTITOUCH_CANCEL, 0, TimeStamp::Now(), 0);

Now that we've realized ResetInputState() can be called for event types other than touch, it feels wrong to be sending a touch-cancel to GestureEventListener, too, but I guess the implementation doesn't do anything that would be problematic in case of a non-touch event, so I guess this is fine. Maybe worth a comment.
Attachment #8653098 - Flags: review?(botond) → review+
Comment on attachment 8653100 [details] [diff] [review]
Gtest

Review of attachment 8653100 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/tests/gtest/TestAsyncPanZoomController.cpp
@@ +2375,5 @@
> +    ScrollWheelInput::SCROLLMODE_INSTANT, ScrollWheelInput::SCROLLDELTA_PIXEL,
> +    origin, 0, 10);
> +  uint64_t blockId;
> +  manager->ReceiveInputEvent(swi, nullptr, &blockId);
> +  manager->ContentReceivedInputBlock(blockId, true);

true /* preventDefault */
Attachment #8653100 - Flags: review?(botond) → review+
Created attachment 8653125 [details] [diff] [review]
Patch v2

Updated with review comments
Attachment #8653098 - Attachment is obsolete: true
Attachment #8653125 - Flags: review+
Created attachment 8653126 [details] [diff] [review]
Gtest v2

Ditto
Attachment #8653100 - Attachment is obsolete: true
Attachment #8653126 - Flags: review+
https://hg.mozilla.org/mozilla-central/rev/8205877b3b30
https://hg.mozilla.org/mozilla-central/rev/c70338a96e33
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox43: --- → fixed
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
Thanks RyanVM for landing the patches - and thanks to Fanolian for reporting the issue as well! :)
Duplicate of this bug: 1199157
Thanks for landing this directly on m-c. This was something like 90% of crashes in the 08/26 nightly.
Blocks: 1205527
You need to log in before you can comment on or make changes to this bug.