1516426 - Crash in mozilla::TouchManager::SuppressInvalidPointsAndGetTargetedFrame

Status: RESOLVED FIXED

(Core :: DOM: Events, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-93d830f0-ba2f-4b4f-8fc5-b187f0181201.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll static class nsIFrame* mozilla::TouchManager::SuppressInvalidPointsAndGetTargetedFrame layout/base/TouchManager.cpp:196
1 xul.dll mozilla::PresShell::HandleEvent layout/base/PresShell.cpp:7283
2 xul.dll nsViewManager::DispatchEvent view/nsViewManager.cpp:812
3 xul.dll nsView::HandleEvent view/nsView.cpp:1141
4 xul.dll mozilla::widget::PuppetWidget::DispatchEvent widget/PuppetWidget.cpp:408
5 xul.dll mozilla::layers::APZCCallbackHelper::DispatchWidgetEvent gfx/layers/apz/util/APZCCallbackHelper.cpp:537
6 xul.dll mozilla::dom::TabChild::RecvRealTouchEvent dom/ipc/TabChild.cpp:1919
7 xul.dll mozilla::dom::PBrowserChild::OnMessageReceived ipc/ipdl/PBrowserChild.cpp:3968
8 xul.dll void mozilla::ipc::MessageChannel::DispatchMessageW ipc/glue/MessageChannel.cpp:2175
9 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:2045

=============================================================

content crashes with this signature are regressing on windows builds since firefox 63. many comments refer to scrolling/zooming on a touchscreen in the print preview.

Comment 1

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Olli, can you think about suspicious commit that triggers this crash in 63?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Shadow DOM

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: touch_crash.diff

I'm thinking this kind of super safe patch for branches and then more complicated on Nightly.

Comment 4

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Comment on attachment 9034522 [details] [diff] [review]
touch_crash.diff

Well, might cause a web-compat, but fine to avoid crash in branches.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7814dee9683a
null check touch target before trying to access it's frame, r=masayuki

Comment 6

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/7814dee9683a

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 9034522 [details] [diff] [review]
touch_crash.diff

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: Bug 1471947

User impact if declined: Crashes

Is this code covered by automated tests?: No

Has the fix been verified in Nightly?: No

Needs manual test from QE?: No

If yes, steps to reproduce: The fix is based on the crash reports, which strongly hint about null pointer

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): Just a null pointer crash

String changes made/needed: NA

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9034522 [details] [diff] [review]
touch_crash.diff

[Triage Comment]
Simple null check crash fix. Approved for 65.0b9.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/df848230cb30