1666201 - Crash when asynchronously dispatching synthesized mouse event

Status: RESOLVED FIXED

(Core Graveyard :: Widget: Android, defect)

Description

[Edgar Chen [:edgar]]

Some test expects synthesized mouse events to be dispatched asynchronously by setting test.events.async.enabled to true, but android would crash then.

For example, https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=316224259&repo=autoland&lineNumber=3596

[task 2020-09-21T00:45:00.805Z] 00:45:00 WARNING - PROCESS-CRASH | dom/tests/mochitest/pointerlock/test_pointerlock_xorigin_iframe.html | application crashed [@ nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*)]
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Mozilla crash reason: MOZ_ASSERT(aEvent->AsKeyboardEvent())
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Crash dump filename: /tmp/tmpqZlH2x/1a17f6db-d331-eb17-e8f7-485ed270c551.dmp
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Operating system: Android
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - 0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - CPU: amd64
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - family 6 model 6 stepping 3
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - 4 CPUs
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - GPU: UNKNOWN
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Crash address: 0x0
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Process uptime: not available
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Thread 11 (crashed)
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - 0 libxul.so!nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*) [nsBaseWidget.cpp:12856303559f543c6eff77be30f5c525af4bdc6d : 1128 + 0x29]
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rax = 0x000075acdb737327 rdx = 0x0000000000000004
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rcx = 0x000075acde894fe8 rbx = 0x000075acdf19a138
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rsi = 0x000075acdf198f90 rdi = 0x000000000000001b
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rbp = 0x000075acdf19a110 rsp = 0x000075acdf19a0b0
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r8 = 0x000000000000ffff r9 = 0x0000000000000000
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r10 = 0x000075acfbd563d0 r11 = 0x0000000000000246
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r12 = 0x0000000000000000 r13 = 0x000075acc854e440
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r14 = 0x000075acde3f7c00 r15 = 0x000075acc8758000
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rip = 0x000075acd6871c06
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - Found by: given as instruction pointer in context
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - 1 libxul.so!mozilla::dom::BrowserParent::RecvDispatchMouseEvent(mozilla::WidgetMouseEvent const&) [BrowserParent.cpp:12856303559f543c6eff77be30f5c525af4bdc6d : 1601 + 0x23]
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rbp = 0x000075acdf19a260 rsp = 0x000075acdf19a120
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rip = 0x000075acd63f44ba
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - Found by: previous frame's frame pointer
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - 2 libxul.so!mozilla::dom::PBrowserParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) [PBrowserParent.cpp: : 6926 + 0x8]
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - rbp = 0x000075acdf19a420 rsp = 0x000075acdf19a270
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - rip = 0x000075acd37dda64
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - Found by: previous frame's frame pointer
...

Comment 1

[Edgar Chen [:edgar]]

I could not reproduce this crash locally with x86 emulator on Mac, this seems to happen on try only?

Edit: I could reproduce this.

Comment 2

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=422cb88836a18ea731f8f0560fddfddfa76500d4

Comment 3

[Edgar Chen [:edgar]]

https://treeherder.mozilla.org/#/jobs?repo=try&group_state=expanded&revision=d8db5bcab6d9ed1f1aa2103a344afa49e8786342

Comment 4

[Edgar Chen [:edgar]]

Attachment: Bug 1666201 - Part 1: Rename ToWidget{Wheel|Mouse}Event to ToWidgetEvent;

So they can be used in template.

Comment 5

[Edgar Chen [:edgar]]

Attachment: Bug 1666201 - Part 2: Make Dispatch*Thread support multiple types of event;

Depends on D91490

Comment 6

[Edgar Chen [:edgar]]

Attachment: Bug 1666201 - Part 3: Ensure synthesized mouse event is dispatched on correct thread;

Depends on D91491

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cb30150e8289
Part 1: Rename ToWidget{Wheel|Mouse}Event to ToWidgetEvent; r=kats
https://hg.mozilla.org/integration/autoland/rev/e960f750c588
Part 2: Make Dispatch*Thread support multiple types of event; r=kats
https://hg.mozilla.org/integration/autoland/rev/1688cdab3d48
Part 3: Ensure synthesized mouse event is dispatched on correct thread; r=kats

Comment 8

[Bogdan Tara[:bogdan_tara | bogdant]]

Backed out 5 changesets (bug 1662094, bug 1666201, bug 1520785) for pointerevent related failures.

Push with failures:
https://treeherder.mozilla.org/#/jobs?repo=autoland&revision=0ff76cb4b991afecb9befb8dba4c482c60a56487&selectedTaskRun=LEvgV_MtQ0OhouPl1hgUSg.0

https://treeherder.mozilla.org/#/jobs?repo=autoland&group_state=expanded&resultStatus=testfailed%2Cbusted%2Cexception&searchStr=linux%2C18.04%2Cx64%2Cwebrender%2Copt%2Cweb%2Cplatform%2Ctests%2Cwith%2Cfission%2Cenabled%2Ctest-linux1804-64-qr%2Fopt-web-platform-tests-fis-e10s%2Cwpt5&revision=fbaf0074074f2948256a21e6e8a81231395da0d2&selectedTaskRun=DTnOU6UoQGeyFO-DXH5LkQ.0

Backout link: https://hg.mozilla.org/integration/autoland/rev/ba35799faec2ed9da469c2a7ade75398d9daf688

Failures logs:
https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=317238179&repo=autoland&lineNumber=2105

https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=317251404&repo=autoland&lineNumber=8590

Comment 9

[Edgar Chen [:edgar]]

Hmm, not sure why wpt test fails in test-verify. I will check it in bug 1520785, let's try to land this separately first.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=b817ac032d548208ce11cde32d6b54ecde2d24f2

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c3b35d74c60c
Part 1: Rename ToWidget{Wheel|Mouse}Event to ToWidgetEvent; r=kats
https://hg.mozilla.org/integration/autoland/rev/9bc6706e66dd
Part 2: Make Dispatch*Thread support multiple types of event; r=kats
https://hg.mozilla.org/integration/autoland/rev/3d50251246b5
Part 3: Ensure synthesized mouse event is dispatched on correct thread; r=kats

Comment 11

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/c3b35d74c60c
https://hg.mozilla.org/mozilla-central/rev/9bc6706e66dd
https://hg.mozilla.org/mozilla-central/rev/3d50251246b5