Intermittent gfx/layers/apz/test/mochitest/<anything> | application crashed [@ mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std

RESOLVED FIXED in Firefox 67

Status

()

defect
P5
critical
RESOLVED FIXED
3 months ago
3 months ago

People

(Reporter: intermittent-bug-filer, Assigned: kats)

Tracking

({crash, intermittent-failure, regression})

unspecified
mozilla67
Points:
---

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox65 unaffected, firefox66 unaffected, firefox67 fixed)

Details

(crash signature)

Attachments

(1 attachment)

Reporter

Description

3 months ago
treeherder

#[markdown(off)]
Filed by: aciure [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=230806381&repo=autoland

https://queue.taskcluster.net/v1/task/LZHVZcpeT3Cy7B0BuT5L-A/runs/0/artifacts/public/logs/live_backing.log

[task 2019-02-27T17:53:00.991Z] 17:53:00 INFO - 1184 INFO TEST-START | gfx/layers/apz/test/mochitest/test_group_zoom.html
[task 2019-02-27T17:53:31.744Z] 17:53:31 INFO - wait for org.mozilla.geckoview.test complete; top activity=com.android.launcher3
[task 2019-02-27T17:53:31.847Z] 17:53:31 INFO - remoteautomation.py | Application ran for: 0:01:15.525388
[task 2019-02-27T17:53:32.371Z] 17:53:32 INFO - /data/tombstones does not exist; tombstone check skipped
[task 2019-02-27T17:53:32.916Z] 17:53:32 INFO - mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmpbynaT6/137605f1-c96f-4eed-1a87-b83bd24b3a79.dmp /builds/worker/workspace/build/symbols
[task 2019-02-27T17:54:00.096Z] 17:54:00 INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/137605f1-c96f-4eed-1a87-b83bd24b3a79.dmp
[task 2019-02-27T17:54:00.096Z] 17:54:00 INFO - mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/137605f1-c96f-4eed-1a87-b83bd24b3a79.extra
[task 2019-02-27T17:54:00.101Z] 17:54:00 WARNING - PROCESS-CRASH | gfx/layers/apz/test/mochitest/test_group_zoom.html | application crashed [@ mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std::__ndk1::function<void (unsigned long, nsTArray<unsigned int> const&)> const&)]
[task 2019-02-27T17:54:00.101Z] 17:54:00 INFO - Crash dump filename: /tmp/tmpbynaT6/137605f1-c96f-4eed-1a87-b83bd24b3a79.dmp
[task 2019-02-27T17:54:00.101Z] 17:54:00 INFO - Operating system: Android
[task 2019-02-27T17:54:00.102Z] 17:54:00 INFO - 0.0.0 Linux 3.10.0+ #1 PREEMPT Thu Jan 5 00:46:30 UTC 2017 x86_64
[task 2019-02-27T17:54:00.102Z] 17:54:00 INFO - CPU: amd64
[task 2019-02-27T17:54:00.102Z] 17:54:00 INFO - family 6 model 2 stepping 3
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - 1 CPU
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - GPU: UNKNOWN
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Crash address: 0x4b0
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Process uptime: not available
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Thread 11 (crashed)
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - 0 libxul.so!mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std::__ndk1::function<void (unsigned long, nsTArray<unsigned int> const&)> const&) [Document.h:46def7f1496fa04debd35617a74cce87f17ebe62 : 1255 + 0x0]
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rax = 0x0e15f753113f29e3 rdx = 0x00007568c509d120
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rcx = 0x000000000000001b rbx = 0x00007568c509d110
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rsi = 0x0000000000000000 rdi = 0x00007568b566a800
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rbp = 0x00007568c509d0e0 rsp = 0x00007568c509d090
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r8 = 0x00007568b567d320 r9 = 0x00007568c50a2450
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r10 = 0x0000000000000000 r11 = 0x0000000000000246
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r12 = 0x00007568c509d118 r13 = 0x00007568c509d268
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r14 = 0x00007568b567d000 r15 = 0x00007568c509d268
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rip = 0x00007568bd0dd39c
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - Found by: given as instruction pointer in context
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - 1 libxul.so!mozilla::dom::TabChild::RecvRealTouchEvent(mozilla::WidgetTouchEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&, nsEventStatus const&) [TabChild.cpp:46def7f1496fa04debd35617a74cce87f17ebe62 : 1696 + 0x5]
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rbx = 0x00007568c509d110 rbp = 0x00007568c509d200
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rsp = 0x00007568c509d0f0 r12 = 0x00007568c509d118
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r13 = 0x00007568c509d268 r14 = 0x00007568b567d000
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r15 = 0x00007568c509d268 rip = 0x00007568be562a32
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - Found by: call frame info
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - 2 libxul.so!mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) [PBrowserChild.cpp: : 4136 + 0x25]
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rbx = 0x00007568c509d2d0 rbp = 0x00007568c509d550
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rsp = 0x00007568c509d210 r12 = 0x00007568b4886ce0
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r13 = 0x00007568c509d2b0 r14 = 0x0000000000000000
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r15 = 0x00007568b4886cd8 rip = 0x00007568bccaee9c
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - Found by: call frame info

From the stack seems like maybe document is null in TabChild and then we try calling getShell() on it in APZCCallbackHelper.

Summary: Intermittent gfx/layers/apz/test/mochitest/test_group_zoom.html | application crashed [@ mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std → Intermittent gfx/layers/apz/test/mochitest/<anything> | application crashed [@ mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std
Comment hidden (Intermittent Failures Robot)
Comment hidden (Intermittent Failures Robot)

(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #1)

From the stack seems like maybe document is null in TabChild and then we try calling getShell() on it in APZCCallbackHelper.

This looks correct. APZCCallbackHelper::SendSetTargetAPZCNotification, which is the other method called from TabChild and takes a Document*, already has a null check. So I guess omitting the null check was always a bug, but it never got hit until we started running android+e10s mochitests, since this codepath is specific to touch+e10s. We do run touch+e10s mochitests on Linux but maybe it just never triggered there.

Assignee: nobody → kats
Duplicate of this bug: 1533923
Duplicate of this bug: 1534184

Comment 8

3 months ago
Pushed by kgupta@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/51fc0fd585a7
Add some missing null checks. r=botond

Comment 9

3 months ago
bugherder
Status: NEW → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.