Closed Bug 1666201 Opened 4 years ago Closed 4 years ago

Crash when asynchronously dispatching synthesized mouse event

Categories

(Core Graveyard :: Widget: Android, defect)

Product:
Core Graveyard
Component:
Widget: Android
Platform:
Unspecified
Android
Type:
defect

Tracking

(firefox83 fixed)

Status:
RESOLVED FIXED
Milestone:
83 Branch
Tracking Flags:
Tracking Status
firefox83 --- fixed

People

(Reporter: edgar, Assigned: edgar)

References

Details

Attachments

(3 files)

Bug 1666201 - Part 1: Rename ToWidget{Wheel|Mouse}Event to ToWidgetEvent;
47 bytes, text/x-phabricator-request
Details | Review
Bug 1666201 - Part 2: Make Dispatch*Thread support multiple types of event;
47 bytes, text/x-phabricator-request
Details | Review
Bug 1666201 - Part 3: Ensure synthesized mouse event is dispatched on correct thread;
47 bytes, text/x-phabricator-request
Details | Review

Some test expects synthesized mouse events to be dispatched asynchronously by setting test.events.async.enabled to true, but android would crash then.

For example, https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=316224259&repo=autoland&lineNumber=3596

[task 2020-09-21T00:45:00.805Z] 00:45:00 WARNING - PROCESS-CRASH | dom/tests/mochitest/pointerlock/test_pointerlock_xorigin_iframe.html | application crashed [@ nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*)]
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Mozilla crash reason: MOZ_ASSERT(aEvent->AsKeyboardEvent())
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Crash dump filename: /tmp/tmpqZlH2x/1a17f6db-d331-eb17-e8f7-485ed270c551.dmp
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Operating system: Android
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - 0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - CPU: amd64
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - family 6 model 6 stepping 3
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - 4 CPUs
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - GPU: UNKNOWN
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Crash reason: SIGSEGV /SEGV_MAPERR
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Crash address: 0x0
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Process uptime: not available
[task 2020-09-21T00:45:00.805Z] 00:45:00 INFO - Thread 11 (crashed)
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - 0 libxul.so!nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent*) [nsBaseWidget.cpp:12856303559f543c6eff77be30f5c525af4bdc6d : 1128 + 0x29]
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rax = 0x000075acdb737327 rdx = 0x0000000000000004
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rcx = 0x000075acde894fe8 rbx = 0x000075acdf19a138
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rsi = 0x000075acdf198f90 rdi = 0x000000000000001b
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rbp = 0x000075acdf19a110 rsp = 0x000075acdf19a0b0
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r8 = 0x000000000000ffff r9 = 0x0000000000000000
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r10 = 0x000075acfbd563d0 r11 = 0x0000000000000246
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r12 = 0x0000000000000000 r13 = 0x000075acc854e440
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - r14 = 0x000075acde3f7c00 r15 = 0x000075acc8758000
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rip = 0x000075acd6871c06
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - Found by: given as instruction pointer in context
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - 1 libxul.so!mozilla::dom::BrowserParent::RecvDispatchMouseEvent(mozilla::WidgetMouseEvent const&) [BrowserParent.cpp:12856303559f543c6eff77be30f5c525af4bdc6d : 1601 + 0x23]
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rbp = 0x000075acdf19a260 rsp = 0x000075acdf19a120
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - rip = 0x000075acd63f44ba
[task 2020-09-21T00:45:00.806Z] 00:45:00 INFO - Found by: previous frame's frame pointer
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - 2 libxul.so!mozilla::dom::PBrowserParent::OnMessageReceived(IPC::Message const&, IPC::Message*&) [PBrowserParent.cpp: : 6926 + 0x8]
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - rbp = 0x000075acdf19a420 rsp = 0x000075acdf19a270
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - rip = 0x000075acd37dda64
[task 2020-09-21T00:45:00.807Z] 00:45:00 INFO - Found by: previous frame's frame pointer
...

Blocks: 1520785

I could not reproduce this crash locally with x86 emulator on Mac, this seems to happen on try only?

Edit: I could reproduce this.

So they can be used in template.

Assignee: nobody → echen
Status: NEW → ASSIGNED
Attachment #9177996 - Attachment description: Bug 1666201 - Part 3: Ensure synthesized mouse event is dispatched on correct thread; → Bug1666201 - Part 3: Ensure synthesized mouse event is dispatched on correct thread;
Attachment #9177996 - Attachment description: Bug1666201 - Part 3: Ensure synthesized mouse event is dispatched on correct thread; → Bug 1666201 - Part 3: Ensure synthesized mouse event is dispatched on correct thread;
Pushed by echen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/cb30150e8289
Part 1: Rename ToWidget{Wheel|Mouse}Event to ToWidgetEvent; r=kats
https://hg.mozilla.org/integration/autoland/rev/e960f750c588
Part 2: Make Dispatch*Thread support multiple types of event; r=kats
https://hg.mozilla.org/integration/autoland/rev/1688cdab3d48
Part 3: Ensure synthesized mouse event is dispatched on correct thread; r=kats

Hmm, not sure why wpt test fails in test-verify. I will check it in bug 1520785, let's try to land this separately first.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=b817ac032d548208ce11cde32d6b54ecde2d24f2

Flags: needinfo?(echen)
Pushed by echen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/c3b35d74c60c
Part 1: Rename ToWidget{Wheel|Mouse}Event to ToWidgetEvent; r=kats
https://hg.mozilla.org/integration/autoland/rev/9bc6706e66dd
Part 2: Make Dispatch*Thread support multiple types of event; r=kats
https://hg.mozilla.org/integration/autoland/rev/3d50251246b5
Part 3: Ensure synthesized mouse event is dispatched on correct thread; r=kats

https://hg.mozilla.org/mozilla-central/rev/c3b35d74c60c
https://hg.mozilla.org/mozilla-central/rev/9bc6706e66dd
https://hg.mozilla.org/mozilla-central/rev/3d50251246b5

Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox83: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 83 Branch
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: