1920527 - ASan Nightly: Crash when scrolling Google Maps place pop-up after search

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[B.J. Herbison]

Attachment: The web page display before scrolling the restaurant box

To reproduce:
Create a new profile. Open maps.google.com. Search for restaurants. Click a restaurant from the list. Scroll the restaurant info box with the trackpad.

Expected:
The box scrolls.

Actual:
The box scrolls and then ASan Nightly goes away.

ASan Nightly build Id 20240923090434
Ubuntu 24.04.1 LTS using XFCE.

Several reports were submitted in the last hour with asanreporter.clientid [e-mail]. Several from my default profile and two from my new profile. The start of the most recent:

=================================================================
==103471==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7dd5a25ff0ca bp 0x7dd576bf67b0 sp 0x7dd576bf67b0 T69)
==103471==The signal is caused by a WRITE memory access.
==103471==Hint: address points to the zero page.

I tried just clicking on a location, without a search first, but the box scrolled without problem. I only tried restaurant searches.

Comment 1

[Andrew McCreight [:mccr8]]

That is a null deref so it doesn't need to be hidden. We need more frames of the stack in order to be able to triage this further.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Panning and Zooming' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 3

[Dan Robertson (:dlrobertson)]

Taking a look at this now... I'm guessing this likely has something to do with the recent wheel transaction work that was done

Comment 4

[Dan Robertson (:dlrobertson)]

When I run the STR locally on nightly, I see https://crash-stats.mozilla.org/report/index/e39c5cc9-7265-421f-863c-cb5680240923

Comment 5

[Dan Robertson (:dlrobertson)]

Can confirm that the latest nightly after bug 1917493 was backed out no longer reproduces the crash.

Comment 6

[Dan Robertson (:dlrobertson)]

Fixed by a backout of bug 1917493