1966887 - Crash in [@ mozilla::PresShell::EnsurePrecedingPointerRawUpdate]

Status: RESOLVED FIXED

(Core :: DOM: Events, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

4 crashes from 3 installs of Firefox 140.0a1 on Windows 11

Crash report: https://crash-stats.mozilla.org/report/index/d8787e03-9d2f-483d-a9a0-f0b2c0250516

MOZ_CRASH Reason:

MOZ_DIAGNOSTIC_ASSERT(!sDispatchingRawUpdateEventFromHere) (Dispatching ePointerRawUpdate should not be done recursively)

Top 10 frames:

0  xul.dll  mozilla::PresShell::EnsurePrecedingPointerRawUpdate(AutoWeakFrame&, mozilla::...  layout/base/PresShell.cpp:7412
0  xul.dll  mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, ns...  layout/base/PresShell.cpp:7366
1  xul.dll  nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent*, nsView*, nsEventStatus*)  view/nsViewManager.cpp:611
2  xul.dll  mozilla::PresShell::DispatchSynthMouseMove(mozilla::WidgetGUIEvent*)  layout/base/PresShell.cpp:4148
2  xul.dll  mozilla::PresShell::ProcessSynthMouseMoveEvent(bool)  layout/base/PresShell.cpp:6112
3  xul.dll  mozilla::PresShell::nsSynthMouseMoveEvent::Run()  layout/base/PresShell.h:2076
4  xul.dll  mozilla::PresShell::HandleEvent(nsIFrame*, mozilla::WidgetGUIEvent*, bool, ns...  layout/base/PresShell.cpp:7336
5  xul.dll  mozilla::PresShell::EventHandler::MaybeHandleEventWithAnotherPresShell(AutoWe...  layout/base/PresShell.cpp:8488
5  xul.dll  mozilla::PresShell::EventHandler::HandleEvent(AutoWeakFrame&, mozilla::Widget...  layout/base/PresShell.cpp:7541
6  xul.dll  mozilla::PresShell::EnsurePrecedingPointerRawUpdate(AutoWeakFrame&, mozilla::...  layout/base/PresShell.cpp:7435

Comment 1

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Ah, I forgot to remove the assertion because it's possible case. On the other hand, the crash report's stack trace is what I didn't expect. So, it detects a bug 😛

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1966887 - Remove the assertion in `EnsurePrecedingPointerRawUpdate()` which checks recursive calls r=smaug!

The assertion was intended to detect unexpected recursive event dispatching of
ePointerRawUpdate. However, if may occur if spinning the event loop with
opening a modal dialog or synchronous XHR. Therefore, the assertion may fail
even in the valid situations.

The crash reports are caused by synthesized eMouseMove. However, it'll be
checked after getting WidgetMousePointer* after the removing assertion.
So, the case is correctly handled anyway.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/898231085cb2
Remove the assertion in `EnsurePrecedingPointerRawUpdate()` which checks recursive calls r=smaug

Comment 4

[agoloman]

https://hg.mozilla.org/mozilla-central/rev/898231085cb2