992928 - crash in mozilla::widget::MouseScrollHandler::LastEventInfo::InitWheelEvent(nsWindowBase*, mozilla::WidgetWheelEvent&, mozilla::widget::ModifierKeyState const&)

Status: REOPENED

(Core :: Widget: Win32, defect, P3)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)(PTO: 5/2-5/10)]

This bug was filed from the Socorro interface and is 
report bp-b888fa85-e90f-4902-9f80-90c952140402.
=============================================================

The suspected line doesn't have division.

The preceding line has division.

> 864 double nativeDeltaPerUnit =
> 865   mIsPage ? static_cast<double>(WHEEL_DELTA) :
> 866             static_cast<double>(WHEEL_DELTA) / GetScrollAmount();
> 867
> 868 delta = static_cast<double>(mDelta) * orienter / nativeDeltaPerUnit;
> 869 mAccumulatedDelta += mDelta;
> 870 lineOrPageDelta =
> 871   mAccumulatedDelta * orienter / RoundDelta(nativeDeltaPerUnit); 

However, nativeDeltaPerUnit should not be rounded to 0 because GetScrollAmount() should be less than 10 in typical system (the default value is 3). And WHEEL_DELTA is 120. I.e., the scroll amount setting must be larger than 90. That doesn't make sense...

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 3

[Calixte Denizet (:calixte)]

There are still some crashes so reopen it.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 5

[David Parks [:handyman]]

There is at least one crash from a December build: https://crash-stats.mozilla.org/report/index/e55659e2-39f8-4cd2-8b0b-6bc6e0211222#tab-details

Minidumps suggest that GetScrollAmount is actually returning something that can lead to a (rounded) zero (anything above 120 will do). It seems that GetScrollAmount can, in some cases, return a user pref value (mousewheel.windows.vertical_amount_override or mousewheel.windows.horizontal_amount_override) so it can be anything. I believe you can also manually tweak these numbers in Windows (GETWHEELSCROLLLINES/GETWHEELSCROLLCHARS). We should check the value before the divide. Maybe we can get away with using a small number in case we calculate 0.

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Very low crash rate, only on older versions, lowering severity.