1250560 - crash in mozilla::AccessibleCaretEventHub::HandleTouchEvent

Status: RESOLVED FIXED

(Core :: DOM: Selection, defect)

Description

[James Willcox (:snorp) ([e-mail]) (he/him)]

This bug was filed from the Socorro interface and is 
report bp-639caf82-2994-4bd9-9531-b974c2160220.
=============================================================

Comment 1

[Ting-Yu Lin [:TYLin] (UTC-8)]

The crash stack looks strange.

Frame 0: AccessibleCaretEventHub::HandleTouchEvent
Frame 1: PresShell::HandleEvent() 

There should be AccessibleCaretEventHub::HandleEvent between frame 1 and 0.

Let's see if crash still happens with bug 1246918 and bug 1248847 landed.

Comment 2

[Ting-Yu Lin [:TYLin] (UTC-8)]

I found an invaluable comment in this report [1], which says "When Pointer events enabled and multiple touches present Nightly crashes (as soon as a second simultaneous touch makes contact)"

I can reproduce this on prebuild Nightly after turn on "dom.w3c_pointer_events.enabled" and multi-touch on the screen.

[1] https://crash-stats.mozilla.com/report/index/fe14b6b8-59ad-4152-8693-2cadb2160226

Comment 3

[Ting-Yu Lin [:TYLin] (UTC-8)]

Attachment: MozReview Request: Bug 1250560 Part 0 - Correct AccessibleCaretEventHub coding style by clang-format. r?roc

This patch is generatedy by applying clang-format on
AccessibleCaretEventHub.cpp.

Review commit: https://reviewboard.mozilla.org/r/37055/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/37055/

Comment 4

[Ting-Yu Lin [:TYLin] (UTC-8)]

Attachment: MozReview Request: Bug 1250560 Part 1 - Fix crash in HandleTouchEvent. r?roc

When enabling "dom.w3c_pointer_events.enabled", we might get a
eTouchCancel event without any touch data. That is, aEvent->touches is
an empty array.

Since |id| and |point| are used only in eTouchStart, I move them into
the eTouchStart to fix the crash.

Review commit: https://reviewboard.mozilla.org/r/37057/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/37057/

Comment 5

[Ting-Yu Lin [:TYLin] (UTC-8)]

Comment on attachment 8724520 [details]
MozReview Request: Bug 1250560 Part 0 - Correct AccessibleCaretEventHub coding style by clang-format. r?roc

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/37055/diff/1-2/

Comment 6

[Ting-Yu Lin [:TYLin] (UTC-8)]

Comment on attachment 8724521 [details]
MozReview Request: Bug 1250560 Part 1 - Fix crash in HandleTouchEvent. r?roc

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/37057/diff/1-2/

Comment 7

[Ting-Yu Lin [:TYLin] (UTC-8)]

Attachment: MozReview Request: Bug 1250560 - Fix crash in HandleTouchEvent. r?roc

When enabling "dom.w3c_pointer_events.enabled", we might get a
eTouchCancel event without any touch data. That is, aEvent->touches is
an empty array. We need to make sure it's non-empty before accessing
aEvent->touches[0].

Review commit: https://reviewboard.mozilla.org/r/37089/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/37089/

Comment 8

[Ting-Yu Lin [:TYLin] (UTC-8)]

Comment on attachment 8724542 [details]
MozReview Request: Bug 1250560 - Fix crash in HandleTouchEvent. r?roc

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/37089/diff/1-2/

Comment 9

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Comment on attachment 8724542 [details]
MozReview Request: Bug 1250560 - Fix crash in HandleTouchEvent. r?roc

https://reviewboard.mozilla.org/r/37089/#review33611

Comment 10

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8ad96eb28e4f

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/8ad96eb28e4f