1908801 - Crash in [@ mozilla::StaticPrefs::dom_event_wheel_event_groups_enabled] from APZCTreeManager::MaybeOverrideLayersIdForWheelEvent

Status: RESOLVED FIXED

(Core :: Panning and Zooming, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/a9b18130-091a-4cc7-89a5-d81bb0240715

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(IsAtomic<bool>::value || NS_IsMainThread()) (Non-atomic static pref 'dom.event.wheel-event-groups.enabled' being accessed on background thread by getter)

Top 10 frames:

0  libxul.so  mozilla::StaticPrefs::dom_event_wheel_event_groups_enabled()  modules/libpref/init/StaticPrefList_dom.h:318
0  libxul.so  mozilla::layers::APZCTreeManager::MaybeOverrideLayersIdForWheelEvent(mozilla:...  gfx/layers/apz/src/APZCTreeManager.cpp:2406
1  libxul.so  mozilla::layers::APZCTreeManager::InputHandlingState::Finish(mozilla::layers:...  gfx/layers/apz/src/APZCTreeManager.cpp:2021
2  libxul.so  mozilla::layers::APZCTreeManager::ReceiveInputEvent(mozilla::InputData&, std:...  gfx/layers/apz/src/APZCTreeManager.cpp:0
3  libxul.so  mozilla::widget::NPZCSupport::HandleScrollEvent(long, int, float, float, floa...  widget/android/nsWindow.cpp:434
4  libxul.so  mozilla::jni::detail::Accessor<mozilla::widget::NPZCSupport>::operator->*<int...  widget/android/jni/Natives.h:660
4  libxul.so  mozilla::jni::NativeStub<mozilla::java::PanZoomController::NativeProvider::Ha...  widget/android/jni/Natives.h:1322
5  base.odex  base.odex@0x283354
6  base.art]  base.art]@0x480f1c
7  libart.so  libart.so@0x3afffc

Looks like APZ is accessing this pref from a thread it shouldn't, which is racey. I think the fix is to make the pref atomic?

Comment 1

[Botond Ballo [:botond]]

Regression from bug 1888946 which added this code.

Comment 2

[Botond Ballo [:botond]]

Yeah, changing the pref type here from bool to RelaxedAtomicBool should fix this.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1888946

:dlrobertson, since you are the author of the regressor, bug 1888946, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Dan Robertson (:dlrobertson)]

Attachment: Bug 1908801 - The wheel event groups enabled flag may be checked on a background thread. r=botond

The wheel event groups enabled flag should be an atomic pref, since it may be
checked on a background thread.

Comment 5

[Dan Robertson (:dlrobertson)]

Posted a patch

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1697ca4e344e
The wheel event groups enabled flag may be checked on a background thread. r=botond

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/1697ca4e344e