952195 - crash in mozilla::dom::TabChild::UpdateTapState(mozilla::WidgetTouchEvent const&, nsEventStatus)

Status: RESOLVED DUPLICATE of bug 952170

(Core :: DOM: Core & HTML, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-293dba36-8272-4751-8caa-53f612131219.
=============================================================
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozilla::dom::TabChild::UpdateTapState(mozilla::WidgetTouchEvent const&, nsEventStatus) 	dom/ipc/TabChild.cpp
1 	libxul.so 	mozilla::dom::TabChild::RecvRealTouchEvent(mozilla::WidgetTouchEvent const&, mozilla::layers::ScrollableLayerGuid const&) 	dom/ipc/TabChild.cpp
2 	libxul.so 	mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/ipc/ipdl/PBrowserChild.cpp
3 	libxul.so 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/ipc/ipdl/PContentChild.cpp
4 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
5 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
6 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
7 	libxul.so 	RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
8 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/builds/slave/b2g_m-cen_ham_ntly-00000000000/build/objdir-gecko/ipc/glue/../../dist/include/mozilla/ipc/MessageChannel.h
9 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
10 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
11 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
12 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
13 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
14 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
15 	libxul.so 	nsThread::Shutdown() 	xpcom/threads/nsThread.cpp
16 	libxul.so 	nsRunnableMethodImpl<nsresult (mozilla::net::<unnamed>::CacheFilesDeletor::*)(), void, true>::Run 	
17 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
18 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
19 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
20 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
21 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
22 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
23 	libxul.so 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
24 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
25 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
26 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
27 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
28 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
29 	plugin-container 	main 	ipc/app/MozillaRuntimeMain.cpp
30 	libc.so 	__libc_init 	bionic/libc/bionic/libc_init_dynamic.c
31 		@0xb00045a9

More reports : 
https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozilla%3A%3Adom%3A%3ATabChild%3A%3AUpdateTapState%28mozilla%3A%3AWidgetTouchEvent+const%26%2C+nsEventStatus%29

STR: 
Occurred when trying to update a contact with a picture really quick after creating a new contact with an image from the gallery.
(ie. gallery opened / closed and tried to open it again )


Gaia      e6276c96fcf087a12800419be8a9e25fcbbc924d
Gecko     http://hg.mozilla.org/mozilla-central/rev/5c7fa2bfea8b
BuildID   20131219040202
Version   29.0a1
ro.build.version.incremental=eng.archermind.20131114.105818
ro.build.date=Thu Nov 14 10:58:33 CST 2013