Closed Bug 834760 Opened 11 years ago Closed 11 years ago

crash in mozilla::widget::PuppetWidget::DispatchEvent

Categories

(Firefox OS Graveyard :: General, defect)

Product:
Firefox OS Graveyard
Component:
General
Platform:
ARM
Gonk (Firefox OS)
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(blocking-b2g:tef+, firefox19 wontfix, firefox20 wontfix, firefox21 fixed, b2g18 fixed, b2g18-v1.0.0 fixed, b2g18-v1.0.1 fixed)

Status:
RESOLVED FIXED
Milestone:
B2G C4 (2jan on)
Project Flags:
blocking-b2g tef+
Tracking Flags:
Tracking Status
firefox19 --- wontfix
firefox20 --- wontfix
firefox21 --- fixed
b2g18 --- fixed
b2g18-v1.0.0 --- fixed
b2g18-v1.0.1 --- fixed

People

(Reporter: m1, Assigned: cjones)

References

Details

(Keywords: crash, Whiteboard: [b2g-crash][BTG-1063] QARegressExclude)

Crash Data

Attachments

(2 files)

decoded minidump of crash
36.45 KB, text/plain
Details
Null-check mAttachedWidgetListener
1.36 KB, patch
mwu
: review+
Details | Diff | Splinter Review 
Seen on AU 185 during APM on/off + MO Call + MO SMS stability testing.   It's the Cost Control app per the .extra file.


Top frames:
-----------
Crash reason:  SIGSEGV
Crash address: 0x0

Thread 0 (crashed)
 0  libxul.so!mozilla::widget::PuppetWidget::DispatchEvent [PuppetWidget.cpp : 289 + 0x8]
     r4 = 0x4194f010    r5 = 0xbefb8940    r6 = 0xbefb892c    r7 = 0x00000002
     r8 = 0x43480388    r9 = 0x43919740   r10 = 0x43919740    fp = 0x00000000
     sp = 0xbefb8918    lr = 0x40b1e91d    pc = 0x40ac400e
    Found by: given as instruction pointer in context
 1  libxul.so!mozilla::dom::TabChild::DispatchWidgetEvent [TabChild.cpp : 1577 + 0xb]
     r4 = 0xbefb8940    r5 = 0x41984480    r6 = 0xbefb89e0    r7 = 0x00000002
     r8 = 0x43480388    r9 = 0x43919740   r10 = 0x43919740    fp = 0x00000000
     sp = 0xbefb8928    pc = 0x40b1e91d
    Found by: call frame info
 2  libxul.so!mozilla::dom::TabChild::RecvRealTouchEvent [TabChild.cpp : 1499 + 0x7]
     r4 = 0x414ea100    r5 = 0x41984480    r6 = 0xbefb89e0    r7 = 0x00000002
     r8 = 0x43480388    r9 = 0x43919740   r10 = 0x43919740    fp = 0x00000000
     sp = 0xbefb8940    pc = 0x40b21165
    Found by: call frame info
 3  libxul.so!mozilla::dom::PBrowserChild::OnMessageReceived [PBrowserChild.cpp : 1724 + 0x9]
     r4 = 0x41984480    r5 = 0xbefb8ec4    r6 = 0xbefb89e0    r7 = 0x00000000
     r8 = 0x414ea100    r9 = 0x00000006   r10 = 0x00000000    fp = 0x00000000
     sp = 0xbefb89c0    pc = 0x40b9f863
    Found by: call frame info
This might be happening because we're forwarding events after TabParent::Destroy(), but it's impossible to tell from available information.  At any rate, all other uses of the widget listener in PuppetWidget null-check, as do other widget backends.
Assignee: nobody → jones.chris.g
Attachment #706508 - Flags: review?(mwu)
Attachment #706508 - Flags: review?(mwu) → review+
Severity: normal → critical
Crash Signature: [@ mozilla::widget::PuppetWidget::DispatchEvent]
Keywords: crash
Whiteboard: [BTG-1063] → [b2g-crash][BTG-1063]
TEF+ for partner acceptance.
blocking-b2g: tef? → tef+
https://hg.mozilla.org/releases/mozilla-b2g18/rev/b8be056ac8d8
Status: NEW → RESOLVED
Closed: 11 years ago
status-b2g18: --- → fixed
status-firefox20: --- → wontfix
status-firefox21: --- → fixed
Resolution: --- → FIXED
status-firefox19: --- → wontfix
Target Milestone: --- → B2G C4 (2jan on)
does not make sense to create a regression issue.
Flags: in-moztrap-
Whiteboard: [b2g-crash][BTG-1063] → [b2g-crash][BTG-1063] QARegressExclude
Cannot verify, need steps to blackbox test this issue.
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: