Last Comment Bug 699725 - crash nsEventStateManager::FillInEventFromGestureDown
: crash nsEventStateManager::FillInEventFromGestureDown
Status: VERIFIED FIXED
[native-crash]
: crash, reproducible
Product: Firefox for Android
Classification: Client Software
Component: General (show other bugs)
: unspecified
: Other Android
: P2 critical (vote)
: ---
Assigned To: Gian-Carlo Pascutto [:gcp]
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-11-03 23:08 PDT by Ludovic Hirlimann [:Usul]
Modified: 2016-07-29 14:20 PDT (History)
6 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
11+


Attachments
Patch 1. Disable Gekco handling of click_hold. (962 bytes, patch)
2011-11-16 00:25 PST, Gian-Carlo Pascutto [:gcp]
mark.finkle: review+
Details | Diff | Splinter Review

Description Ludovic Hirlimann [:Usul] 2011-11-03 23:08:19 PDT
This bug was filed from the Socorro interface and is 
report bp-c670b2ce-6aec-465f-a51e-41a1b2111103 .
============================================================= 
can't reproduce for now. what i remembered happend :
i was visiting glenat.fr and clicked a link on the front page
while it was loading i realized i had not clicked the one i wanted
tried to click the android back button and then the awsome bar that's when it crashed
Comment 1 Aaron Train [:aaronmt] 2011-11-04 09:22:56 PDT
I
Comment 2 Aaron Train [:aaronmt] 2011-11-04 09:25:22 PDT
I can reproduce this by rapidly taping on links at www.androidcentral.com

20111104074346
http://hg.mozilla.org/projects/birch/rev/6eeeae97b14d

bp-538d287c-cba9-4721-a3b5-1cda62111104
Comment 3 Naoki Hirata :nhirata (please use needinfo instead of cc) 2011-11-04 11:30:53 PDT
From Socorro: 

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsEventStateManager::FillInEventFromGestureDown 	content/events/src/nsEventStateManager.cpp:2011
1 	libxul.so 	nsEventStateManager::FireContextClick 	content/events/src/nsEventStateManager.cpp:1912
2 	libxul.so 	nsEventStateManager::sClickHoldCallback 	content/events/src/nsEventStateManager.cpp:1806
3 	libxul.so 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:424
4 	libxul.so 	nsTimerEvent::Run 	xpcom/threads/nsTimerImpl.cpp:520
5 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:631
6 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
7 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
8 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:208
9 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:201
10 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:189
11 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:228
12 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3547
13 	libxul.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	toolkit/xre/nsAndroidStartup.cpp:139
14 	libmozutils.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	other-licenses/android/APKOpen.cpp:232
15 	libdvm.so 	dvmPlatformInvoke 	
16 	libdvm.so 	dvmCallJNIMethod_general 	
17 	libdvm.so 	dvmResolveNativeMethod 	
18 	libdvm.so 	dvmAsmSisterStart 	
19 	libdvm.so 	dvmMterpStd 	
20 	libdvm.so 	dvmInterpret 	
21 	libdvm.so 	dvmCallMethodV 	
22 	libdvm.so 	dvmCallMethod 	
23 	libdvm.so 	dvmAttachCurrentThread 	
24 	libc.so 	__thread_entry 	
25 	libc.so 	pthread_create 	

Show/hide other threads
Comment 4 Gian-Carlo Pascutto [:gcp] 2011-11-14 09:16:46 PST
Last log outputs in the relevant crashes:

I/PRLog   (16891): 2839792[46f0d080]: UpdateFilter: smoothSlack = -67.2812, filterLength = 32
I/PRLog   (16891): 2839792[46f0d080]: ###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsCOMPtr.h, line 849
I/Gecko   (16891): ###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsCOMPtr.h, line 849

I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) ProcessNextEvent [0 0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) running [4b42e030]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) ProcessNextEvent [0 0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) running [4b42e0c0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) ProcessNextEvent [0 0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) running [4b42e130]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) ProcessNextEvent [0 0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) running [4ad08a90]
I/PRLog   (17171): 3041120[47e0d080]: nsComponentManager: CreateInstanceByContractID(@mozilla.org/supports-PRUint64;1) succeeded
I/PRLog   (17171): 3041120[47e0d080]: nsObserverService::NotifyObservers(inner-window-destroyed)
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) ProcessNextEvent [0 0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) running [4a35b840]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) ProcessNextEvent [0 0]
I/PRLog   (17171): 3041120[47e0d080]: THRD(47e42080) running [4a3e1860]
I/PRLog   (17171): 3041120[47e0d080]: [this=4a3e1860] time between PostTimerEvent() and Fire(): 1904.000000ms
I/PRLog   (17171): 3041120[47e0d080]: [this=49a679c0] expected delay time  500ms
I/PRLog   (17171): 3041120[47e0d080]: [this=49a679c0] actual delay time   2352.000000ms
I/PRLog   (17171): 3041120[47e0d080]: [this=49a679c0] (mType is 0)       -------
I/PRLog   (17171): 3041120[47e0d080]: [this=49a679c0]     delta           1852ms
I/PRLog   (17171): 3041120[47e0d080]: UpdateFilter: smoothSlack = -51.0625, filterLength = 32
I/PRLog   (17171): 3041120[47e0d080]: ###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsCOMPtr.h, line 849
I/Gecko   (17171): ###!!! ASSERTION: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../dist/include/nsCOMPtr.h, line 849
Comment 5 Gian-Carlo Pascutto [:gcp] 2011-11-14 12:56:39 PST
http://hg.mozilla.org/projects/birch/annotate/f3eea1384f14/content/events/src/nsEventStateManager.cpp#l1906 

GetNearestWidget() is failing.
Comment 6 Gian-Carlo Pascutto [:gcp] 2011-11-15 08:07:34 PST
What seems to happen is that on MOUSE_BUTTON_DOWN, a Timer is started to determine whether the click is potentially a drag or "popup context menu" event. It also tracks the widget where the mouse went down. After the mousedown has lasted more than 500ms, a context menu click is inferred, and the code tries to figure out what to pop up a context menu for. It does this by investigating mPresContext->GetPrimaryFrameFor(mGestureDownContent) for the closest Widget. However, both that and it's parent are empty and don't contain any widgets. The code doesn't handle this null case and breaks.

I'd think this happens if you start a MOUSE_BUTTON_DOWN while the page is loading or being closed.

I can detect the "no widgets" case and bail out easily enough, but someone familiar with nsEventStateManager.cpp should comment if that's acceptable or if there's something else wrong that should be fixed instead.
Comment 7 Olli Pettay [:smaug] (vacation Aug 25-28) 2011-11-15 09:24:50 PST
(In reply to Gian-Carlo Pascutto (:gcp) from comment #6)
> It does this
> by investigating mPresContext->GetPrimaryFrameFor(mGestureDownContent) for
> the closest Widget. However, both that and it's parent are empty and don't
> contain any widgets.
What "that"?

> I can detect the "no widgets" case and bail out easily enough, but someone
> familiar with nsEventStateManager.cpp should comment if that's acceptable or
> if there's something else wrong that should be fixed instead.
Sounds ok
Comment 8 Gian-Carlo Pascutto [:gcp] 2011-11-15 09:34:09 PST
>However, both that and it's parent are empty
>What "that"

nsView* mCurrentTarget. This gets walked up through all parents and checked for any existing Widgets (view/src/nsView.cpp, around line 1100).
Comment 9 Gian-Carlo Pascutto [:gcp] 2011-11-15 10:54:19 PST
http://hg.mozilla.org/projects/birch/rev/65f78c4b804b

This added context menu handling inside Java/Android to Native Fennec, so the code here probably shouldn't even run. Will disable the relevant prefs and test.
Comment 10 Gian-Carlo Pascutto [:gcp] 2011-11-16 00:25:14 PST
Created attachment 574830 [details] [diff] [review]
Patch 1. Disable Gekco handling of click_hold.
Comment 11 Mark Finkle (:mfinkle) (use needinfo?) 2011-11-16 05:23:09 PST
Comment on attachment 574830 [details] [diff] [review]
Patch 1. Disable Gekco handling of click_hold.


>+/* Android has its own click_hold detection */
>+#ifndef ANDROID
> /* use long press to display a context menu */
> pref("ui.click_hold_context_menus", true);
>+#endif

You can just remove the preference. No need for the #ifndef
Comment 12 Gian-Carlo Pascutto [:gcp] 2011-11-16 05:46:50 PST
http://hg.mozilla.org/projects/birch/rev/426690602cd5
Comment 13 Aaron Train [:aaronmt] 2011-11-16 06:19:35 PST
Samsung Nexus S (Android 2.3.6)
20111116054452
http://hg.mozilla.org/projects/birch/rev/426690602cd5

Note You need to log in before you can comment on or make changes to this bug.