819286 - Crash when browser tab closes while zooming

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Martijn Wargers (dead)]

Steps to reproduce:
- Visit url testcase
- Tap on the button, a new window opens
- Double tap on the button, or make a pinch zoom gesture

Expected result: no crash
Actual result: crash

Comment 1

[Joe Cheng [:jcheng] (please needinfo)]

BB+, P2 - severe usability issue

Comment 2

[Ben Francis [:benfrancis]]

Thanks for the test case. I can reproduce a full crash of B2G.

This is what I see in logcat http://pastebin.mozilla.org/1985278

Justin, any idea where to start with this?

Comment 3

[Justin Lebar (not reading bugmail)]

- Figure out which process is crashing (browser process or main process).  You probably already have this figured out, but it's not clear from the bug.

- Attach gdb

- Reproduce the crash

- (gdb) bt

Comment 4

[[:fabrice] Fabrice Desré]

I tested with current inbound and gaia tip, and got no crash.

Comment 5

[[:fabrice] Fabrice Desré]

Hm, forget the previous comment. I can actually crash when double clicking on the button, but not when using pinch to zoom. I'll get a backtrace.

Comment 6

[[:fabrice] Fabrice Desré]

Program received signal SIGSEGV, Segmentation fault.
nsEventStateManager::MapEventCoordinatesForChildProcess (aFrameLoader=0x0, aEvent=0xbe8200c0)
    at /home/fabrice/dev/inbound/content/events/src/nsEventStateManager.cpp:1590
1590	  nsIFrame* targetFrame = aFrameLoader->GetPrimaryFrameOfOwningContent();
(gdb) bt
#0  nsEventStateManager::MapEventCoordinatesForChildProcess (aFrameLoader=0x0, aEvent=0xbe8200c0)
    at /home/fabrice/dev/inbound/content/events/src/nsEventStateManager.cpp:1590
#1  0x41055e32 in mozilla::dom::TabParent::TryCapture (this=0x492a87a0, aEvent=<value optimized out>)
    at /home/fabrice/dev/inbound/dom/ipc/TabParent.cpp:484
#2  0x40fd9006 in nsWindow::DispatchInputEvent (aEvent=..., aWasCaptured=0xbe820647) at /home/fabrice/dev/inbound/widget/gonk/nsWindow.cpp:278
#3  0x40fd816a in sendTouchEvent (this=<value optimized out>) at /home/fabrice/dev/inbound/widget/gonk/nsAppShell.cpp:197
#4  GeckoInputDispatcher::dispatchOnce (this=<value optimized out>) at /home/fabrice/dev/inbound/widget/gonk/nsAppShell.cpp:443
#5  0x40fd73b0 in nsAppShell::ProcessNextNativeEvent (this=0x4293b6a0, mayWait=<value optimized out>)
    at /home/fabrice/dev/inbound/widget/gonk/nsAppShell.cpp:725
#6  0x40ff40fa in nsBaseAppShell::DoProcessNextNativeEvent (this=0xbe8205e0, mayWait=71, recursionDepth=1227524000)
    at /home/fabrice/dev/inbound/widget/xpwidgets/nsBaseAppShell.cpp:139
#7  0x40ff41c0 in nsBaseAppShell::OnProcessNextEvent (this=0x4293b6a0, thr=0x40409880, mayWait=false, recursionDepth=0)
    at /home/fabrice/dev/inbound/widget/xpwidgets/nsBaseAppShell.cpp:286
#8  0x41171aca in nsThread::ProcessNextEvent (this=0x40409880, mayWait=false, result=0xbe820817)
    at /home/fabrice/dev/inbound/xpcom/threads/nsThread.cpp:600
#9  0x41151db2 in NS_ProcessNextEvent_P (thread=0x4293b6a0, mayWait=false)
    at /home/fabrice/dev/b2g/B2G/objdir-gecko/xpcom/build/nsThreadUtils.cpp:221
#10 0x410693fc in mozilla::ipc::MessagePump::Run (this=0x40402400, aDelegate=0x4042d0c0) at /home/fabrice/dev/inbound/ipc/glue/MessagePump.cpp:82
#11 0x4119383c in MessageLoop::RunInternal (this=0x0) at /home/fabrice/dev/inbound/ipc/chromium/src/base/message_loop.cc:215
#12 0x411938f2 in MessageLoop::RunHandler (this=0x4042d0c0) at /home/fabrice/dev/inbound/ipc/chromium/src/base/message_loop.cc:208
#13 MessageLoop::Run (this=0x4042d0c0) at /home/fabrice/dev/inbound/ipc/chromium/src/base/message_loop.cc:182
#14 0x40ff3cc0 in nsBaseAppShell::Run (this=0x4293b6a0) at /home/fabrice/dev/inbound/widget/xpwidgets/nsBaseAppShell.cpp:163
#15 0x40f50acc in nsAppStartup::Run (this=0x42c8b910) at /home/fabrice/dev/inbound/toolkit/components/startup/nsAppStartup.cpp:291
#16 0x40993420 in XREMain::XRE_mainRun (this=0xbe8209d4) at /home/fabrice/dev/inbound/toolkit/xre/nsAppRunner.cpp:3824
#17 0x40995bec in XREMain::XRE_main (this=0xbe8209d4, argc=<value optimized out>, argv=0xbe822bb4, aAppData=<value optimized out>)
    at /home/fabrice/dev/inbound/toolkit/xre/nsAppRunner.cpp:3891
#18 0x40995d50 in XRE_main (argc=1, argv=0xbe822bb4, aAppData=0x1f184, aFlags=<value optimized out>)
    at /home/fabrice/dev/inbound/toolkit/xre/nsAppRunner.cpp:4089
#19 0x0000a15e in do_main (argc=1, argv=0xbe822bb4) at /home/fabrice/dev/inbound/b2g/app/nsBrowserApp.cpp:164
#20 main (argc=1, argv=0xbe822bb4) at /home/fabrice/dev/inbound/b2g/app/nsBrowserApp.cpp:253

Comment 7

[[:fabrice] Fabrice Desré]

Attachment: wip

That patch prevents the crash, but is probably not doing what we should (how do we end up with a null mFrameElement in the first place?).

Comment 8

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Comment on attachment 690639 [details] [diff] [review]
wip

Hm yeah, this is really bad.

We should also set sEventCapturer to null here, because this TabParent can't do anything without a frameloader and we may trying to send events to the wrong place.

Comment 9

[[:fabrice] Fabrice Desré]

Attachment: patch

Comment 10

[[:fabrice] Fabrice Desré]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ee1418ff5eda

Comment 11

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/ee1418ff5eda

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/102c5a258e7d
https://hg.mozilla.org/releases/mozilla-b2g18/rev/23f211b0600c