468753 - Startup crash in nsViewManager::ProcessSynthMouseMoveEvent

Status: RESOLVED FIXED

(Core :: Web Painting, defect)

Description

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Stack:

#0  0x021e21b2 in nsViewManager::ProcessSynthMouseMoveEvent (this=0x91f3160, aFromScroll=0) at /Users/roc/mozilla-trunk/view/src/nsViewManager.cpp:2418
#1  0x021e4a38 in nsSynthMouseMoveEvent::Run (this=0xca175d0) at /Users/roc/mozilla-trunk/view/src/nsViewManager.cpp:2281
#2  0x0049f344 in nsThread::ProcessNextEvent (this=0xa16240, mayWait=0, result=0xbfffd724) at /Users/roc/mozilla-trunk/xpcom/threads/nsThread.cpp:510
#3  0x0042927e in NS_ProcessPendingEvents_P (thread=0xa16240, timeout=20) at nsThreadUtils.cpp:180
#4  0x048f6c6d in nsBaseAppShell::NativeEventCallback (this=0x50133a0) at /Users/roc/mozilla-trunk/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#5  0x048ae930 in nsAppShell::ProcessGeckoEvents (aInfo=0x50133a0) at /Users/roc/mozilla-trunk/widget/src/cocoa/nsAppShell.mm:373

I think Josh has seen this.

The crash is at
  pointVM->GetViewObserver()->DispatchSynthMouseMove(&event, !aFromScroll);
GetViewObserver has returned null. I think we just need to null-check it. Since we're running off an event it is definitely possible that PresShell::Destroy has been called which has called SetViewObserver(nsnull) on the view manager (assuming something is keeping a reference to the view manager which has prevented mSynthMouseMoveEvent.Revoke() from running in the destructor).

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Attachment: fix [Checkin: Comment 5 & 8]

This should do it.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 352253 [details] [diff] [review]
fix
[Checkin: Comment 5 & 8]

r+sr=dbaron.  Thanks for cleaning up after this.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Ah ha, I've been seeing this one a lot when running Fennec. Thanks for fixing it! :)

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I've hit this a few times today already. We'd better get a fix landed ASAP

Comment 5

[Serge Gautherie (:sgautherie)]

Comment on attachment 352253 [details] [diff] [review]
fix
[Checkin: Comment 5 & 8]

http://hg.mozilla.org/mozilla-central/rev/2646df2fb217

Comment 6

[Serge Gautherie (:sgautherie)]

Comment on attachment 352253 [details] [diff] [review]
fix
[Checkin: Comment 5 & 8]

Does not apply to 1.9.1:
{
patching file view/src/nsViewManager.cpp
Hunk #1 FAILED at 2409
1 out of 1 hunks FAILED
}

Comment 7

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Yes, the patch that caused this regression (in bug 302561) hasn't landed in 1.9.1.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Fixed on 1.9.1 (landed along with bug 302561):
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/9175e83d7cc2