1791154 - Crash in [@ mozilla::layers::RemoteContentController::UpdateOverscrollVelocity]

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/6adb6f7b-35ad-4624-8ab9-07e920220915

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so mozilla::layers::RemoteContentController::UpdateOverscrollVelocity gfx/layers/ipc/RemoteContentController.cpp:269
1 libxul.so mozilla::detail::RunnableMethodImpl<mozilla::layers::RemoteContentController*, void  xpcom/threads/nsThreadUtils.h:1200
2 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:465
3 libxul.so mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:300
4 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:356
5 libxul.so nsThread::ThreadFunc xpcom/threads/nsThread.cpp:384
6 libnss3.so _pt_root nsprpub/pr/src/pthreads/ptthread.c:201
7 libc.so libc.so@0x00000000000b1810 
8 libc.so libc.so@0x00000000000512f0 
9 libc.so libc.so@0x00000000000b1704 

This appears to be a null pointer access, maybe related to bug 1785786?

Comment 1

[Hiroyuki Ikezoe (:hiro)]

Yeah, the code path in question was added in bug 1785786. Though I am not sure about crash reports before bug 1785786, at least for the report in comment 0, it looks we just need a null check.

Comment 2

[Jamie Nicol [:jnicol]]

Attachment: Bug 1791154 - Check for null root content controller in UpdateOverscrollVelocity/Offset. r?hiro

In bug 1785786 we added a GPU process implementation for
RemoteContentController::UpdateOverscrollVelocity and
RemoteContentController::UpdateOverscrollOffset. These work by looking
up the root content controller and using it to forward the message to
the parent process. However, we neglected to add a null check on the
result of the lookup. This patch adds the null check.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/473798bd1191
Check for null root content controller in UpdateOverscrollVelocity/Offset. r=hiro

Comment 4

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/473798bd1191