1479277 - Crash in void mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame | mozilla::ipc::MessageChannel::Send | mozilla::layers::PAPZCTreeManagerChild::SendUpdateZoomConstraints

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect, P3)

Description

[Julian Seward [:jseward]]

This bug was filed from the Socorro interface and is
report bp-3124021e-eabc-4ce8-a992-75e550180726.
=============================================================

This is topcrash #17 in the Windows nightly 20180726100339, with 5
crashes from 4 different installations.

Top 10 frames of crashing thread:

0 xul.dll void mozilla::ipc::MessageChannel::CxxStackFrame::CxxStackFrame ipc/glue/MessageChannel.cpp:249
1 xul.dll mozilla::ipc::MessageChannel::Send ipc/glue/MessageChannel.cpp:1019
2 xul.dll mozilla::layers::PAPZCTreeManagerChild::SendUpdateZoomConstraints ipc/ipdl/PAPZCTreeManagerChild.cpp:153
3 xul.dll mozilla::widget::PuppetWidget::UpdateZoomConstraints widget/PuppetWidget.cpp:582
4 xul.dll mozilla::PresShell::Destroy layout/base/PresShell.cpp:1405
5 xul.dll void nsDocumentViewer::DestroyPresShell layout/base/nsDocumentViewer.cpp:4648
6 xul.dll nsDocumentViewer::Destroy layout/base/nsDocumentViewer.cpp:1896
7 xul.dll nsDocShell::Destroy docshell/base/nsDocShell.cpp:5267
8 xul.dll nsWebBrowser::SetDocShell toolkit/components/browser/nsWebBrowser.cpp:1701
9 xul.dll nsWebBrowser::InternalDestroy toolkit/components/browser/nsWebBrowser.cpp:95

=============================================================

Comment 2

[Kartikaya Gupta (email:[e-mail])]

Attachment: Bug 1479277 - Don't try to send APZ messages after teardown.

Review commit: https://reviewboard.mozilla.org/r/260262/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/260262/

Comment 3

[Botond Ballo [:botond]]

Comment on attachment 8995970 [details]
Bug 1479277 - Don't try to send APZ messages after teardown.

https://reviewboard.mozilla.org/r/260262/#review267642

::: dom/ipc/TabChild.cpp:535
(Diff revision 1)
>  bool
>  TabChild::DoUpdateZoomConstraints(const uint32_t& aPresShellId,
>                                    const ViewID& aViewId,
>                                    const Maybe<ZoomConstraints>& aConstraints)
>  {
> -  if (!mApzcTreeManager) {
> +  if (!mApzcTreeManager || mDestroyed) {

Should this adjustment be made to other TabChild methods that use mApzcTreeManager, such as SetTargetAPZC?

Comment 4

[Kartikaya Gupta (email:[e-mail])]

(In reply to Botond Ballo [:botond] from comment #3)
> 
> Should this adjustment be made to other TabChild methods that use
> mApzcTreeManager, such as SetTargetAPZC?

There's no evidence that those methods need it - this message seems to be the only one that gets sent after the tabchild is torn down. If we find other messages where this problem occurs I'd like to understand why they happen before adding a similar guard.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ba650b0c1208
Don't try to send APZ messages after teardown. r=botond

Comment 6

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/ba650b0c1208