676316 - Crash Report [@ @0x0 | nsDeviceMotion::DeviceMotionChanged ]

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Build identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0a1) Gecko/20110803 Firefox/8.0a1

Mac OS X : 10.6.7
STR: 
1. go to http://people.mozilla.com/~nhirata/html_tp/ball.html
2. while moving the computer, close the window
Expected: no crash
Actual : crash

This bug was filed from the Socorro interface and is 
report bp-ac7017a6-5840-41ba-adf0-2acd92110803 .
============================================================= 
Frame 	Module 	Signature [Expand] 	Source
0 		@0x0 	
1 	XUL 	nsDeviceMotion::DeviceMotionChanged 	dom/system/nsDeviceMotion.cpp:236
2 	XUL 	nsDeviceMotionSystem::UpdateHandler 	dom/system/cocoa/nsDeviceMotionSystem.mm:146
3 	XUL 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
4 	XUL 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
5 	XUL 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
6 	XUL 	NS_ProcessPendingEvents_P 	obj-firefox/x86_64/xpcom/build/nsThreadUtils.cpp:195
7 	XUL 	nsBaseAppShell::NativeEventCallback 	widget/src/xpwidgets/nsBaseAppShell.cpp:130
8 	XUL 	nsAppShell::ProcessGeckoEvents 	widget/src/cocoa/nsAppShell.mm:424
9 	CoreFoundation 	__CFRunLoopDoSources0 	
10 	CoreFoundation 	__CFRunLoopRun 	
11 	CoreFoundation 	CFRunLoopRunSpecific 	
12 	HIToolbox 	HIToolbox@0x2e7ed 	
13 	HIToolbox 	HIToolbox@0x2e550 	
14 	HIToolbox 	HIToolbox@0x2e4ab 	
15 	AppKit 	_DPSNextEvent 	
16 	AppKit 	-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] 	
17 	AppKit 	-[NSApplication run] 	
18 	XUL 	nsAppShell::Run 	widget/src/cocoa/nsAppShell.mm:771
19 	XUL 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:224
20 	XUL 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3577
21 	firefox 	main 	browser/app/nsBrowserApp.cpp:198
22 	firefox 	firefox@0xb73

Comment 1

[Jose Fandos]

I can consistently get this after visiting the 404 page for github.com.

http://github.com/sdflkofwoei should take you there. Just leaving it open and then either closing the tab or clicking within another link seems to trigger this.

https://crash-stats.mozilla.com/report/index/bp-3d0e6af8-6ad4-4eb5-aa0a-1bc112110804

http://crash-stats.mozilla.com/report/index/bp-1c8969ff-a30c-40a8-921e-0a52a2110804

http://crash-stats.mozilla.com/report/index/bp-e82e1b4a-9055-4a5c-a1f3-db6be2110801

https://crash-stats.mozilla.com/report/index/bp-7afdbc93-ff68-4e00-becf-ec8e12110801

Comment 2

[Marcia Knous [:marcia]]

Possible dupe of Bug 673472? Signature seems very similar.

Comment 3

[Josh Matthews [:jdm]]

Attachment: Reverse the device motion listener removal early return logic.

Ugh. I should never be allowed to touch IndexOf, it turns out.

Comment 4

[Doug Turner (:dougt)]

http://hg.mozilla.org/mozilla-central/rev/be090ee1747a

Comment 5

[Josh Matthews [:jdm]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/899a225fd580

Comment 7

[Marco Bonardo [:mak]]

http://hg.mozilla.org/mozilla-central/rev/899a225fd580