1277241 - MOZ_CRASH("GFX: Overscroll issue > 0")

Status: RESOLVED INCOMPLETE

(Core :: Panning and Zooming, defect, P5)

Description

[Thomas Zimmermann [:tzimmermann] [:tdz]]

I saw this crash on a b2g phone while scrolling down. I don't know if it's specific to b2g, but the crashed code seems to be platform agnostic.

m-c rev: 299490

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 333.868]
0xb36bdfe2 in mozilla::layers::Axis::OverscrollBy (this=<optimized out>, aOverscroll=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/Axis.cpp:234
234           MOZ_CRASH("GFX: Overscroll issue > 0");

The backtrace is

(gdb) bt
#0  0xb36bdfe2 in mozilla::layers::Axis::OverscrollBy (this=<optimized out>, aOverscroll=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/Axis.cpp:234
#1  0xb36be130 in mozilla::layers::GenericOverscrollEffect::ConsumeOverscroll (this=0xa780c868, aOverscroll=..., aShouldOverscrollX=<optimized out>,
    aShouldOverscrollY=<optimized out>) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/Overscroll.h:90
#2  0xb36bde10 in mozilla::layers::AsyncPanZoomController::OverscrollBy (this=<optimized out>, aOverscroll=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:2372
#3  0xb36cf9a0 in mozilla::layers::AsyncPanZoomController::AttemptScroll (this=0xa8fa4c00, aStartPoint=..., aEndPoint=..., aOverscrollHandoffState=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:2333
#4  0xb36cfa86 in mozilla::layers::APZCTreeManager::DispatchScroll (this=0xa8d65400, aPrev=aPrev@entry=0xaa5d6400, aStartPoint=..., aEndPoint=..., aOverscrollHandoffState=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/APZCTreeManager.cpp:1453
#5  0xb36cfae4 in mozilla::layers::AsyncPanZoomController::CallDispatchScroll (this=this@entry=0xaa5d6400, aStartPoint=..., aEndPoint=..., aOverscrollHandoffState=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:2491
#6  0xb36cf9da in mozilla::layers::AsyncPanZoomController::AttemptScroll (this=0xaa5d6400, aStartPoint=..., aEndPoint=..., aOverscrollHandoffState=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:2321
#7  0xb36cfa86 in mozilla::layers::APZCTreeManager::DispatchScroll (this=0xa8d65400, aPrev=aPrev@entry=0xa8fa4c00, aStartPoint=..., aEndPoint=..., aOverscrollHandoffState=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/APZCTreeManager.cpp:1453
#8  0xb36cfae4 in mozilla::layers::AsyncPanZoomController::CallDispatchScroll (this=this@entry=0xa8fa4c00, aStartPoint=..., aEndPoint=..., aOverscrollHandoffState=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:2491
#9  0xb36cfdb8 in mozilla::layers::AsyncPanZoomController::TrackTouch (this=0xa8fa4c00, aEvent=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:2513
#10 0xb36cfe34 in mozilla::layers::AsyncPanZoomController::OnTouchMove (this=0xa8fa4c00, aEvent=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:1146
#11 0xb36d0398 in mozilla::layers::AsyncPanZoomController::HandleInputEvent (this=0xa8fa4c00, aEvent=..., aTransformToApzc=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/AsyncPanZoomController.cpp:961
#12 0xb36cec44 in mozilla::layers::InputQueue::MaybeHandleCurrentBlock (this=0xabd40ce0, block=0xa7653f60, aEvent=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/InputQueue.cpp:78
#13 0xb36cedb2 in mozilla::layers::InputQueue::ReceiveTouchInput (this=0xabd40ce0, aTarget=..., aTargetConfirmed=<optimized out>, aEvent=...,
    aOutInputBlockId=aOutInputBlockId@entry=0xad3ffab0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/InputQueue.cpp:174
#14 0xb36d05c8 in mozilla::layers::InputQueue::ReceiveInputEvent (this=0xabd40ce0, aTarget=..., aTargetConfirmed=<optimized out>, aEvent=...,
    aOutInputBlockId=aOutInputBlockId@entry=0xad3ffab0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/InputQueue.cpp:40
#15 0xb36d091c in mozilla::layers::APZCTreeManager::ProcessTouchInput (this=this@entry=0xa8d65400, aInput=..., aOutTargetGuid=aOutTargetGuid@entry=0xad3ffab8,
    aOutInputBlockId=aOutInputBlockId@entry=0xad3ffab0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/APZCTreeManager.cpp:972
#16 0xb36d0a10 in mozilla::layers::APZCTreeManager::ReceiveInputEvent (this=0xa8d65400, aEvent=..., aOutTargetGuid=aOutTargetGuid@entry=0xad3ffab8,
    aOutInputBlockId=aOutInputBlockId@entry=0xad3ffab0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/APZCTreeManager.cpp:675
#17 0xb43bdc36 in nsWindow::DispatchTouchInputViaAPZ (this=0xad6c8080, aInput=...) at ../../../../hg.mozilla.org/mozilla-central/widget/gonk/nsWindow.cpp:207
#18 0xb43bdcb2 in nsWindow::DispatchTouchInput (aInput=...) at ../../../../hg.mozilla.org/mozilla-central/widget/gonk/nsWindow.cpp:163
#19 0xb439186a in mozilla::GeckoTouchDispatcher::DispatchTouchEvent (this=this@entry=0xad488ba0, aMultiTouch=...)
    at ../../../../hg.mozilla.org/mozilla-central/widget/gonk/GeckoTouchDispatcher.cpp:332
#20 0xb4392168 in mozilla::GeckoTouchDispatcher::DispatchTouchMoveEvents (this=0xad488ba0, aVsyncTime=...)
    at ../../../../hg.mozilla.org/mozilla-central/widget/gonk/GeckoTouchDispatcher.cpp:184
#21 0xb43921fc in mozilla::GeckoTouchDispatcher::NotifyVsync (this=<optimized out>, aVsyncTimestamp=...)
    at ../../../../hg.mozilla.org/mozilla-central/widget/gonk/GeckoTouchDispatcher.cpp:100
#22 0xb3701f3c in mozilla::layers::CompositorVsyncScheduler::DispatchTouchEvents (this=this@entry=0xaa7820c0, aVsyncTimestamp=...)
---Type <return> to continue, or q <return> to quit---
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/ipc/CompositorBridgeParent.cpp:542
#23 0xb37102b4 in mozilla::layers::CompositorVsyncScheduler::Composite (this=0xaa7820c0, aVsyncTimestamp=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/ipc/CompositorBridgeParent.cpp:472
#24 0xb3700abe in applyImpl<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), StoreCopyPassByValue<mozilla::TimeStamp>, 0u> (args=..., m=<optimized out>, o=<optimized out>) at ../../dist/include/nsThreadUtils.h:715
#25 apply<mozilla::layers::CompositorVsyncScheduler, void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp)> (m=<optimized out>, o=<optimized out>, 
    this=<optimized out>) at ../../dist/include/nsThreadUtils.h:722
#26 nsRunnableMethodImpl<void (mozilla::layers::CompositorVsyncScheduler::*)(mozilla::TimeStamp), true, true, mozilla::TimeStamp>::Run (this=<optimized out>)
    at ../../dist/include/nsThreadUtils.h:749
#27 0xb32cd74a in MessageLoop::RunTask (this=0xad3ffcd4, aTask=...)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:349
#28 0xb32cfb70 in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) (this=<optimized out>, pending_task=<optimized out>)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:357
#29 0xb32cfc02 in MessageLoop::DoWork (this=0xad3ffcd4) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:432
#30 0xb32ca5ae in base::MessagePumpDefault::Run (this=0xad6cbbf8, delegate=0xad3ffcd4)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_pump_default.cc:36
#31 0xb32ca2f4 in MessageLoop::RunInternal (this=this@entry=0xad3ffcd4)
    at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:235
#32 0xb32ca43c in RunHandler (this=0xad3ffcd4) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:228
#33 MessageLoop::Run (this=this@entry=0xad3ffcd4) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/message_loop.cc:208
#34 0xb32d2260 in base::Thread::ThreadMain (this=0xad6bcc00) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/thread.cc:180
#35 0xb32d0d7a in ThreadFunc (closure=<optimized out>) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/ipc/chromium/src/base/platform_thread_posix.cc:38
#36 0xb6d77bb0 in __pthread_start (arg=0xad54f400, arg@entry=<error reading variable: value has been optimized out>) at bionic/libc/bionic/pthread_create.cpp:141
#37 0xb6d75af4 in __start_thread (fn=<optimized out>, arg=<optimized out>) at bionic/libc/bionic/clone.cpp:41
#38 0x00000000 in ?? ()

Comment 1

[Botond Ballo [:botond]]

This sounds like the same issue as bug 1266707. Thomas, if you're able to provide the information I requested in bug 1266707 comment 2, that would be helpful.

Comment 2

[Thomas Zimmermann [:tzimmermann] [:tdz]]

(In reply to Botond Ballo [:botond] from comment #1)
> This sounds like the same issue as bug 1266707. Thomas, if you're able to
> provide the information I requested in bug 1266707 comment 2, that would be
> helpful.

Sorry for the long delay. I didn't notice the request. The message you're asking for is shown below.


E/Default Home Screen( 2534):     at proto.refresh/handleError (app://homescreen.gaiamobile.org/shared/elements/gaia-site-icon/script.js:558:11)
I/Gecko   (  318): [Parent 318] ###!!! ASSERTION: composition end (1201.000000) is not equal (within error) to page end (1221.000000)
I/Gecko   (  318): : 'false', file /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/Axis.cpp, line 233
F/MOZ_CRASH(  318): Hit MOZ_CRASH(GFX: Overscroll issue > 0) at /home/mozilla/Projects/mozilla/src/hg.mozilla.org/mozilla-central/gfx/layers/apz/src/Axis.cpp:234

Comment 3

[Botond Ballo [:botond]]

(In reply to Thomas Zimmermann [:tzimmermann] [:tdz] from comment #2)
> I/Gecko   (  318): [Parent 318] ###!!! ASSERTION: composition end
> (1201.000000) is not equal (within error) to page end (1221.000000)

Ok, thanks; this tells us that the problem is (very likely) not a particularly severe case of rounding error, but some other, larger source of inconsistency.

A couple of other questions:

  - Does this happen reliably on a particular webpage / in a particular app,
    or is it intermittent?

  - If you're able to catch it in the debugger again at the place where you
    got the backtrace in comment 1, could you print
    "mAsyncPanZoomController->mFrameMetrics", and post the output please?

Comment 4

[Thomas Zimmermann [:tzimmermann] [:tdz]]

Just a quick note: B2G isn't in a good shape ATM so I'm blocked here. I'll report back when the build works again.

Comment 5

[Kartikaya Gupta (email:[e-mail])]

Is the B2G build working again?

Comment 6

[Kartikaya Gupta (email:[e-mail])]

Reopen if this comes back.