1558546 - Crash in [@ nsRangeFrame::GetValueAtEventPoint]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-5547e6e3-9fd4-4174-9385-1b8f30190611.

Seen while looking at 67.0.1 crash stats for mobile: https://bit.ly/2Kb5vvg. Crashes occurred back to at least 63, but in 67.0.1 it is currently the #2 overall top crash.

Comments are not useful and the correlations don't show anything. APIs range from 22-28 and some phones from Oppo and Vivo are the top crashing devices currently.

Top 10 frames of crashing thread:

0 libxul.so nsRangeFrame::GetValueAtEventPoint xpcom/base/nsCOMPtr.h:823
1 libxul.so mozilla::dom::HTMLInputElement::StartRangeThumbDrag dom/html/HTMLInputElement.cpp:3462
2 libxul.so mozilla::dom::HTMLInputElement::PostHandleEventForRangeThumb xpcom/ds/nsTArray.h
3 libxul.so mozilla::dom::HTMLInputElement::PostHandleEvent dom/html/HTMLInputElement.cpp:4196
4 libxul.so mozilla::EventTargetChainItem::HandleEventTargetChain dom/events/EventDispatcher.cpp:556
5 libxul.so mozilla::EventTargetChainItem::HandleEventTargetChain dom/events/EventDispatcher.cpp:633
6 libxul.so mozilla::EventDispatcher::Dispatch dom/events/EventDispatcher.cpp:1048
7 libxul.so mozilla::PresShell::EventHandler::DispatchEvent layout/base/PresShell.cpp:8261
8 libxul.so mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo layout/base/PresShell.cpp:7700
9 libxul.so mozilla::PresShell::EventHandler::HandleEventUsingCoordinates layout/base/PresShell.cpp:6716

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Looks like null + offset crash.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: range_crash.html

testcase, try to drag the range thumb using mouse.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1558546, ensure range element has a frame before starting drag operation, r=hsivonen

This should be the minimal patch to fix the issue (should be safe for branches too).

Reusing an existing mouse/touch test for the crash testing.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4e074fb72148
ensure range element has a frame before starting drag operation, r=hsivonen

Comment 5

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/4e074fb72148

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 9071619 [details]
Bug 1558546, ensure range element has a frame before starting drag operation, r=hsivonen

Beta/Release Uplift Approval Request

• User impact if declined: Crashes
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Basically doing a null check.
• String changes made/needed: NA

Comment 7

[Julien Cristau [:jcristau] (back April 22)]

Comment on attachment 9071619 [details]
Bug 1558546, ensure range element has a frame before starting drag operation, r=hsivonen

simple crash fix, approved for 68.0b10

Comment 8

[Oana Pop-Rus]

https://hg.mozilla.org/releases/mozilla-beta/rev/44d7135f115d