Closed Bug 1479277 Opened 4 years ago Closed 4 years ago

Crash in void mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame | mozilla::ipc::MessageChannel::Send | mozilla::layers::PAPZCTreeManagerChild::SendUpdateZoomConstraints


(Core :: Panning and Zooming, defect, P3)

Windows 10



Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- unaffected
firefox61 --- unaffected
firefox62 --- unaffected
firefox63 --- fixed


(Reporter: jseward, Assigned: kats)


(Keywords: crash, regression, Whiteboard: [gfx-noted])

Crash Data


(1 file)

This bug was filed from the Socorro interface and is
report bp-3124021e-eabc-4ce8-a992-75e550180726.

This is topcrash #17 in the Windows nightly 20180726100339, with 5
crashes from 4 different installations.

Top 10 frames of crashing thread:

0 xul.dll void mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame ipc/glue/MessageChannel.cpp:249
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:1019
2 xul.dll mozilla::layers::PAPZCTreeManagerChild::SendUpdateZoomConstraints ipc/ipdl/PAPZCTreeManagerChild.cpp:153
3 xul.dll mozilla::widget::PuppetWidget::UpdateZoomConstraints widget/PuppetWidget.cpp:582
4 xul.dll mozilla::PresShell::Destroy layout/base/PresShell.cpp:1405
5 xul.dll void nsDocumentViewer::DestroyPresShell layout/base/nsDocumentViewer.cpp:4648
6 xul.dll nsDocumentViewer::Destroy layout/base/nsDocumentViewer.cpp:1896
7 xul.dll nsDocShell::Destroy docshell/base/nsDocShell.cpp:5267
8 xul.dll nsWebBrowser::SetDocShell toolkit/components/browser/nsWebBrowser.cpp:1701
9 xul.dll nsWebBrowser::InternalDestroy toolkit/components/browser/nsWebBrowser.cpp:95

Flags: needinfo?(bugmail)
Assignee: nobody → bugmail
Component: Graphics: Text → Panning and Zooming
Flags: needinfo?(bugmail)
Comment on attachment 8995970 [details]
Bug 1479277 - Don't try to send APZ messages after teardown.

::: dom/ipc/TabChild.cpp:535
(Diff revision 1)
>  bool
>  TabChild::DoUpdateZoomConstraints(const uint32_t& aPresShellId,
>                                    const ViewID& aViewId,
>                                    const Maybe<ZoomConstraints>& aConstraints)
>  {
> -  if (!mApzcTreeManager) {
> +  if (!mApzcTreeManager || mDestroyed) {

Should this adjustment be made to other TabChild methods that use mApzcTreeManager, such as SetTargetAPZC?
Attachment #8995970 - Flags: review?(botond) → review+
(In reply to Botond Ballo [:botond] from comment #3)
> Should this adjustment be made to other TabChild methods that use
> mApzcTreeManager, such as SetTargetAPZC?

There's no evidence that those methods need it - this message seems to be the only one that gets sent after the tabchild is torn down. If we find other messages where this problem occurs I'd like to understand why they happen before adding a similar guard.
Pushed by
Don't try to send APZ messages after teardown. r=botond
Priority: -- → P3
Whiteboard: [gfx-noted]
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla63
You need to log in before you can comment on or make changes to this bug.