1779364 - Crash in [@ wl_proxy_destroy | moz_container_wayland_frame_callback_handler] when dragging and dropping tabs

Status: RESOLVED FIXED

(Core :: Graphics, defect, P1)

Description

[Marco Castelluccio [:marco]]

Crash report: https://crash-stats.mozilla.org/report/index/57b66c19-9b18-445a-bb23-616cf0220713

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libwayland-client.so.0 wl_proxy_destroy src/wayland-client.c:544
1 libxul.so moz_container_wayland_frame_callback_handler widget/gtk/MozContainerWayland.cpp:247
2 libxul.so RunnableFunction<void  ipc/chromium/src/base/task.h:324
3 libxul.so mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:851
4 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1205
5 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85
6 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:355
7 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:150
8 libxul.so nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:295
9 libxul.so XREMain::XRE_mainRun toolkit/xre/nsAppRunner.cpp:5719

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1778767

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

:jimb, since you are the author of the regressor, bug 1778767, could you take a look?
For more information, please visit auto_nag documentation.

Comment 4

[Cosmin Sabou [:CosminS]]

Regressor has been backed out from central and requested new desktop nightlies: https://hg.mozilla.org/mozilla-central/rev/04b02c492dab34ec35205f2338b27dc9469969fc

Comment 5

[Jim Blandy :jimb]

I can reproduce this.

Comment 6

[Jim Blandy :jimb]

The problem is entirely obvious. I carelessly left some experimental code in the final patch for bug 1778767 which does not use the new MozClearPointer helper function, and does not check for a null pointer before passing it to wl_callback_destroy.

Comment 7

[Jim Blandy :jimb]

I have a revised patch for this up in bug 1778767.