1531130 - Intermittent gfx/layers/apz/test/mochitest/<anything> | application crashed [@ mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect, P5)

Description

[Treeherder Bug Filer]

#[markdown(off)]
Filed by: aciure [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=230806381&repo=autoland

https://queue.taskcluster.net/v1/task/LZHVZcpeT3Cy7B0BuT5L-A/runs/0/artifacts/public/logs/live_backing.log

[task 2019-02-27T17:53:00.991Z] 17:53:00 INFO - 1184 INFO TEST-START | gfx/layers/apz/test/mochitest/test_group_zoom.html
[task 2019-02-27T17:53:31.744Z] 17:53:31 INFO - wait for org.mozilla.geckoview.test complete; top activity=com.android.launcher3
[task 2019-02-27T17:53:31.847Z] 17:53:31 INFO - remoteautomation.py | Application ran for: 0:01:15.525388
[task 2019-02-27T17:53:32.371Z] 17:53:32 INFO - /data/tombstones does not exist; tombstone check skipped
[task 2019-02-27T17:53:32.916Z] 17:53:32 INFO - mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmpbynaT6/137605f1-c96f-4eed-1a87-b83bd24b3a79.dmp /builds/worker/workspace/build/symbols
[task 2019-02-27T17:54:00.096Z] 17:54:00 INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/137605f1-c96f-4eed-1a87-b83bd24b3a79.dmp
[task 2019-02-27T17:54:00.096Z] 17:54:00 INFO - mozcrash Saved app info as /builds/worker/workspace/build/blobber_upload_dir/137605f1-c96f-4eed-1a87-b83bd24b3a79.extra
[task 2019-02-27T17:54:00.101Z] 17:54:00 WARNING - PROCESS-CRASH | gfx/layers/apz/test/mochitest/test_group_zoom.html | application crashed [@ mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std::__ndk1::function<void (unsigned long, nsTArray<unsigned int> const&)> const&)]
[task 2019-02-27T17:54:00.101Z] 17:54:00 INFO - Crash dump filename: /tmp/tmpbynaT6/137605f1-c96f-4eed-1a87-b83bd24b3a79.dmp
[task 2019-02-27T17:54:00.101Z] 17:54:00 INFO - Operating system: Android
[task 2019-02-27T17:54:00.102Z] 17:54:00 INFO - 0.0.0 Linux 3.10.0+ #1 PREEMPT Thu Jan 5 00:46:30 UTC 2017 x86_64
[task 2019-02-27T17:54:00.102Z] 17:54:00 INFO - CPU: amd64
[task 2019-02-27T17:54:00.102Z] 17:54:00 INFO - family 6 model 2 stepping 3
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - 1 CPU
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - GPU: UNKNOWN
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Crash address: 0x4b0
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Process uptime: not available
[task 2019-02-27T17:54:00.103Z] 17:54:00 INFO - Thread 11 (crashed)
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - 0 libxul.so!mozilla::layers::APZCCallbackHelper::SendSetAllowedTouchBehaviorNotification(nsIWidget*, mozilla::dom::Document*, mozilla::WidgetTouchEvent const&, unsigned long, std::__ndk1::function<void (unsigned long, nsTArray<unsigned int> const&)> const&) [Document.h:46def7f1496fa04debd35617a74cce87f17ebe62 : 1255 + 0x0]
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rax = 0x0e15f753113f29e3 rdx = 0x00007568c509d120
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rcx = 0x000000000000001b rbx = 0x00007568c509d110
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rsi = 0x0000000000000000 rdi = 0x00007568b566a800
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rbp = 0x00007568c509d0e0 rsp = 0x00007568c509d090
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r8 = 0x00007568b567d320 r9 = 0x00007568c50a2450
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r10 = 0x0000000000000000 r11 = 0x0000000000000246
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r12 = 0x00007568c509d118 r13 = 0x00007568c509d268
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r14 = 0x00007568b567d000 r15 = 0x00007568c509d268
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rip = 0x00007568bd0dd39c
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - Found by: given as instruction pointer in context
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - 1 libxul.so!mozilla::dom::TabChild::RecvRealTouchEvent(mozilla::WidgetTouchEvent const&, mozilla::layers::ScrollableLayerGuid const&, unsigned long const&, nsEventStatus const&) [TabChild.cpp:46def7f1496fa04debd35617a74cce87f17ebe62 : 1696 + 0x5]
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rbx = 0x00007568c509d110 rbp = 0x00007568c509d200
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rsp = 0x00007568c509d0f0 r12 = 0x00007568c509d118
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r13 = 0x00007568c509d268 r14 = 0x00007568b567d000
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r15 = 0x00007568c509d268 rip = 0x00007568be562a32
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - Found by: call frame info
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - 2 libxul.so!mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) [PBrowserChild.cpp: : 4136 + 0x25]
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rbx = 0x00007568c509d2d0 rbp = 0x00007568c509d550
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - rsp = 0x00007568c509d210 r12 = 0x00007568b4886ce0
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r13 = 0x00007568c509d2b0 r14 = 0x0000000000000000
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - r15 = 0x00007568b4886cd8 rip = 0x00007568bccaee9c
[task 2019-02-27T17:54:00.113Z] 17:54:00 INFO - Found by: call frame info

Comment 1

[Kartikaya Gupta (email:[e-mail])]

From the stack seems like maybe document is null in TabChild and then we try calling getShell() on it in APZCCallbackHelper.

Comment 2

[Intermittent Failures Robot]

5 failures in 2981 pushes (0.002 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• autoland: 4
• mozilla-central: 1

Platform breakdown:

• android-em-7-0-x86_64: 5

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1531130&startday=2019-02-25&endday=2019-03-03&tree=all

Comment 3

[Intermittent Failures Robot]

6 failures in 2818 pushes (0.002 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-inbound: 4
• autoland: 2

Platform breakdown:

• android-em-7-0-x86_64: 6

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1531130&startday=2019-03-04&endday=2019-03-10&tree=all

Comment 4

[Kartikaya Gupta (email:[e-mail])]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #1)

From the stack seems like maybe document is null in TabChild and then we try calling getShell() on it in APZCCallbackHelper.

This looks correct. APZCCallbackHelper::SendSetTargetAPZCNotification, which is the other method called from TabChild and takes a Document*, already has a null check. So I guess omitting the null check was always a bug, but it never got hit until we started running android+e10s mochitests, since this codepath is specific to touch+e10s. We do run touch+e10s mochitests on Linux but maybe it just never triggered there.

Comment 6

[Kartikaya Gupta (email:[e-mail])]

Attachment: Bug 1531130 - Add some missing null checks. r?botond

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/51fc0fd585a7
Add some missing null checks. r=botond

Comment 9

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/51fc0fd585a7