1710013 - Crash in [@ mozilla::layers::AxisPhysicsMSDModel::IsFinished]

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

5 crashes on 3+ installations with 89 betas, all with macOS 11, both on x64 and AArch64

Crash report: https://crash-stats.mozilla.org/report/index/2f889a2a-1027-445b-9fdd-d70500210503

Reason: EXC_BAD_ACCESS / EXC_I386_GPFLT

Top 10 frames of crashing thread:

0 XUL mozilla::layers::AxisPhysicsMSDModel::IsFinished const gfx/layers/AxisPhysicsMSDModel.cpp:73
1 XUL mozilla::layers::AsyncPanZoomController::OnPan gfx/layers/apz/src/AsyncPanZoomController.cpp:2694
2 XUL mozilla::PanGestureInput::TransformToLocal widget/InputData.cpp:500
3 XUL mozilla::layers::AsyncPanZoomController::HandleInputEvent gfx/layers/apz/src/AsyncPanZoomController.cpp:1094
4 XUL mozilla::layers::InputQueue::ProcessQueue gfx/layers/apz/src/InputQueue.cpp:964
5 libmozglue.dylib moz_xmalloc memory/mozalloc/mozalloc.cpp:52
6 XUL nsTArrayInfallibleAllocator::ResultTypeProxy nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_RelocateUsingMemutils>::EnsureCapacity<nsTArrayInfallibleAllocator> xpcom/ds/nsTArray-inl.h:162
7 XUL mozilla::layers::InputQueue::ReceivePanGestureInput gfx/layers/apz/src/InputQueue.cpp:478
8 XUL mozilla::layers::InputQueue::ReceiveInputEvent gfx/layers/apz/src/InputQueue.cpp:53
9 XUL mozilla::layers::APZCTreeManager::ReceiveInputEvent gfx/layers/apz/src/APZCTreeManager.cpp:1718

Comment 1

[Hiroyuki Ikezoe (:hiro)]

Looks like bug 1707519 is insufficient, we probably need to hold a strong reference of the OverscollAnimation instance in question.

Comment 2

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1710013 - Hold a strong reference of OverscrollAnimation instance to avoid being derefed. r?botond

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/da6f855e06e0
Hold a strong reference of OverscrollAnimation instance to avoid being derefed. r=botond

Comment 4

[Hiroyuki Ikezoe (:hiro)]

Comment on attachment 9220772 [details]
Bug 1710013 - Hold a strong reference of OverscrollAnimation instance to avoid being derefed. r?botond

Beta/Release Uplift Approval Request

• User impact if declined: [Required for MR1 / Proton] Crash
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The change is pretty small/simple, and made the code in question more robust, actually this is a case fallen from bug 1707519
• String changes made/needed: none

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/da6f855e06e0

Comment 6

[Pascal Chevrel:pascalc]

Comment on attachment 9220772 [details]
Bug 1710013 - Hold a strong reference of OverscrollAnimation instance to avoid being derefed. r?botond

Crash fix for a new 89 feature, approved for 89 beta 11, thanks.

Comment 7

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/02685f08e59e