1444860 - Crash in nsMenuPopupFrame::ShouldFollowAnchor

Status: RESOLVED WORKSFORME

(Thunderbird :: General, defect)

Description

[Wayne Mery (:wsmwk)]

#4 crash for TB60.0a1.  crash-stats thinks the first crash happened 2017-03-18. First crash I find is bp-52ebeb0d-9ffd-4bb6-9dcb-73a630180219 53.0b1

Signature is seen for nightly and betas.

bp-a75e7db4-08dd-41bf-bdad-4fc890180302 (ccortizo)
=============================================================

Top 10 frames of crashing thread:

0 xul.dll nsMenuPopupFrame::ShouldFollowAnchor layout/xul/nsMenuPopupFrame.cpp:2558
1 xul.dll nsMenuPopupFrame::ShouldFollowAnchor layout/xul/nsMenuPopupFrame.cpp:2583
2 xul.dll nsMenuChainItem::UpdateFollowAnchor layout/xul/nsXULPopupManager.cpp:119
3 xul.dll nsXULPopupManager::ShowPopupCallback layout/xul/nsXULPopupManager.cpp:960
4 xul.dll nsXULPopupManager::FirePopupShowingEvent layout/xul/nsXULPopupManager.cpp:1536
5 xul.dll nsXULPopupShowingEvent::Run layout/xul/nsXULPopupManager.cpp:2779
6 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1040
7 xul.dll mozilla::Variant<JSAtom*, char16_t const*, mozilla::UniquePtr<char16_t [0], JS::FreePolicy> >::extract<0> mfbt/Variant.h:714
8 xul.dll std::swap<mozilla::Variant<int const, char const*, void  C:/builds/moz2_slave/tb-rel-c-beta-w32_bld-00000000/build/vs2015u3/VC/include/utility:52
9 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:517

=============================================================

Comment 1

[Jorg K (CEST = GMT+2)]

No C-C code involved, as far as I can see.

Comment 2

[Wayne Mery (:wsmwk)]

In Thunderbird 60.0b6 this is rare.  Nothing consistent in Firefox and also rare.  So I don't think this is actionable

Comment 3

[Edgaras]

It something with on-screen keyboard. Most reports have flag accessibly=active.

For me, it happens on Firefox when I select text in address bar and then I choose Copy or Paste, both crashes often, maybe ~30%.

I have ui.osk.detect_physical_keyboard=false.

My latest report bp-e1fb252c-ff57-42ef-8c3c-d30500181024 deeply in stack contains IME/OnScreenKeyboard related functions

==========
60 xul.dll mozilla::widget::IMEHandler::ShowOnScreenKeyboard widget/windows/WinIMEHandler.cpp:1054
61 xul.dll mozilla::widget::IMEHandler::MaybeShowOnScreenKeyboard widget/windows/WinIMEHandler.cpp:751
62 xul.dll mozilla::widget::IMEHandler::SetInputContext widget/windows/WinIMEHandler.cpp:463
63 xul.dll nsWindow::SetInputContext widget/windows/nsWindow.cpp:7492
64 xul.dll mozilla::IMEStateManager::SetInputContext dom/events/IMEStateManager.cpp:1408
65 xul.dll mozilla::IMEStateManager::SetIMEState dom/events/IMEStateManager.cpp:1379
66 xul.dll mozilla::IMEStateManager::OnClickInEditor dom/events/IMEStateManager.cpp:852
67 xul.dll mozilla::EditorEventListener::MouseClick editor/libeditor/EditorEventListener.cpp:662
==========

Comment 4

[Wayne Mery (:wsmwk)]

@edgaras, can you file a new bug report for your testcase?

The Thunderbird crashes I looked at seem unrelated to the firefox crashes.  A big increase when we shipped 60.2.1.  Unfortunately we do not have STR

bp-714a36a7-3760-43e3-902f-c40d80181004
 0 	xul.dll	nsMenuPopupFrame::ShouldFollowAnchor()	layout/xul/nsMenuPopupFrame.cpp:2558
1 	xul.dll	nsMenuPopupFrame::ShouldFollowAnchor(nsRect&)	layout/xul/nsMenuPopupFrame.cpp:2583
2 	xul.dll	nsMenuChainItem::UpdateFollowAnchor()	layout/xul/nsXULPopupManager.cpp:125
3 	xul.dll	nsXULPopupManager::ShowPopupCallback(nsIContent*, nsMenuPopupFrame*, bool, bool)	layout/xul/nsXULPopupManager.cpp:971
4 	xul.dll	nsXULPopupManager::FirePopupShowingEvent(nsIContent*, bool, bool, nsIDOMEvent*)	layout/xul/nsXULPopupManager.cpp:1547
5 	xul.dll	nsXULPopupManager::ShowPopup(nsIContent*, nsIContent*, nsTSubstring<char16_t> const&, int, int, bool, bool, bool, nsIDOMEvent*)	layout/xul/nsXULPopupManager.cpp:793
6 	xul.dll	mozilla::dom::PopupBoxObject::OpenPopup(mozilla::dom::Element*, nsTSubstring<char16_t> const&, int, int, bool, bool, mozilla::dom::Event*)	layout/xul/PopupBoxObject.cpp:93
7 	xul.dll	mozilla::dom::PopupBoxObjectBinding::openPopup	dom/bindings/PopupBoxObjectBinding.cpp:459
8 	xul.dll	js::ArgumentsObject::createTemplateObject(JSContext*, bool)	js/src/vm/ArgumentsObject.cpp:233
9 	xul.dll	js::Nursery::allocate(unsigned int)	js/src/gc/Nursery.cpp:402
10 	xul.dll	mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*)	dom/bindings/BindingUtils.cpp:3031

Comment 5

[Jorg K (CEST = GMT+2)]

Hmm, TB 60 and FF 63 crashes have similar call stacks. Of course the line numbers in layout/xul/nsMenuPopupFrame.cpp don't match since there are three versions in between. Clearly an M-C issue.

Comment 6

[Wayne Mery (:wsmwk)]

Whatever it was, it had developed into a topcrash for 60.*, but no sign of it in 68 or recent betas - https://crash-stats.mozilla.com/signature/?product=Thunderbird&version=68.1.0&version=68.0b0&version=68.0&version=67.0b0&version=66.0b0&version=65.0b0&signature=nsMenuPopupFrame%3A%3AShouldFollowAnchor&date=%3E%3D2019-03-13T01%3A00%3A00.000Z&date=%3C2019-09-13T01%3A00%3A00.000Z#bugzilla

And no other bug reports for this signature.