2004169 - Poison crash in [@ mozilla::layers::GestureEventListener::HandleInputTimeoutMaxTap]

Status: RESOLVED DUPLICATE of bug 1996570

(Core :: Panning and Zooming, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/95dfae8a-6b94-4b40-b161-d05990251204

Reason:

SIGSEGV / SEGV_MAPERR

Top 10 frames:

0  libxul.so  mozilla::RefPtrTraits<mozilla::CancelableRunnable>::Release(mozilla::Cancelab...  mfbt/RefPtr.h:49
0  libxul.so  RefPtr<mozilla::CancelableRunnable>::ConstRemovingRefPtrTraits<mozilla::Cance...  mfbt/RefPtr.h:409
0  libxul.so  RefPtr<mozilla::CancelableRunnable>::assign_assuming_AddRef(mozilla::Cancelab...  mfbt/RefPtr.h:68
0  libxul.so  RefPtr<mozilla::CancelableRunnable>::operator=(std::nullptr_t)  mfbt/RefPtr.h:180
0  libxul.so  mozilla::layers::GestureEventListener::HandleInputTimeoutMaxTap(bool)  gfx/layers/apz/src/GestureEventListener.cpp:577
1  libxul.so  mozilla::detail::RunnableMethodArguments<bool>::apply<mozilla::layers::Gestur...  xpcom/threads/nsThreadUtils.h:1083
1  libxul.so  std::__ndk1::__invoke[abi:nn190000]<mozilla::detail::RunnableMethodArguments<...  /builds/worker/fetches/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/c++/v1/__type_traits/invoke.h:150
1  libxul.so  std::__ndk1::__apply_tuple_impl[abi:nn190000]<mozilla::detail::RunnableMethod...  /builds/worker/fetches/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/c++/v1/tuple:1383
1  libxul.so  std::__ndk1::apply[abi:nn190000]<mozilla::detail::RunnableMethodArguments<boo...  /builds/worker/fetches/android-ndk/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/c++/v1/tuple:1387
1  libxul.so  mozilla::detail::RunnableMethodArguments<bool>::apply<mozilla::layers::Gestur...  xpcom/threads/nsThreadUtils.h:1081

These are all crashes on poison values. It looks like this maybe first showed up on 145? Although it showed up in 145 release but not 145 Nightly so maybe there could be some kind of Android change that caused this?

Comment 1

[Hiroyuki Ikezoe (:hiro)]

This one looks a case fixed by bug 1996570. And I hadn't noticed that there was a review comment by Botond for the patch for bug 1996570. Now I revised it.

I might be overlooking this since I haven't looked the crash report yet.

Comment 2

[Andrew McCreight [:mccr8]]

Ah, right, I'll dupe it over to that one. I think we should bump it up to sec-high because it is being seen in the wild.