Seen on nexus 4 with current tip. Sometimes I hit the MOZ_ASSERT and sometimes the enable/disable button stops working and I get a [Parent 852] WARNING: Received impossible touch in OnTouchStart: file ../../../gfx/layers/apz/src/AsyncPanZoomController.cpp, line 734 STR: Start settings app enter screen lock and enable passcode lock. [Child 1195] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1349 [Parent 964] WARNING: Already have a paint with this sequence number: file ../../dist/include/mozilla/layers/APZTestData.h, line 50 [Parent 964] WARNING: Already have a paint with this sequence number: file ../../dist/include/mozilla/layers/APZTestData.h, line 50 [Child 1195] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1349 [Parent 964] WARNING: Received impossible touch in OnTouchStart: file ../../../gfx/layers/apz/src/AsyncPanZoomController.cpp, line 734 Program received signal SIGSEGV, Segmentation fault. 0xb498a7d6 in SendRealTouchEvent (event=..., this=0xad563370) at ../../../dom/ipc/TabParent.cpp:881 881 MOZ_ASSERT((!sEventCapturer && mEventCaptureDepth == 0) || (gdb) bt #0 0xb498a7d6 in SendRealTouchEvent (event=..., this=0xad563370) at ../../../dom/ipc/TabParent.cpp:881 #1 mozilla::dom::TabParent::SendRealTouchEvent (this=0xad563370, event=...) at ../../../dom/ipc/TabParent.cpp:864 #2 0xb4af0536 in mozilla::EventStateManager::HandleCrossProcessEvent (this=0xb1074df0, aEvent=0xbefbb100, aTargetFrame=<optimized out>, aStatus=0xbefbb0a8) at ../../../dom/events/EventStateManager.cpp:1245 #3 0xb4af3a54 in mozilla::EventStateManager::PostHandleEvent (this=0xb1074df0, aPresContext=0xae72a000, aEvent=0xbefbb100, aTargetFrame= 0xb1449318, aStatus=0xbefbb0a8) at ../../../dom/events/EventStateManager.cpp:2659 #4 0xb4fa40f2 in PresShell::HandleEventInternal (this=0xaed3a640, aEvent=0xbefbb100, aStatus=0xbefbb0a8) at ../../../layout/base/nsPresShell.cpp:7417 #5 0xb4fa42ec in PresShell::HandlePositionedEvent (this=0xaed3a640, aTargetFrame=<optimized out>, aEvent=0xbefbb100, aEventStatus=0xbefbb0a8) at ../../../layout/base/nsPresShell.cpp:7134 #6 0xb4fa4d26 in PresShell::HandleEvent (this=0xb215ee80, aFrame=<optimized out>, aEvent=0xbefbb100, aDontRetargetEvents=<optimized out>, aEventStatus=0xbefbb0a8) at ../../../layout/base/nsPresShell.cpp:6934 #7 0xb4c6262c in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=0xbefbb100, aView=<optimized out>, aStatus=0xbefbb0a8) at ../../../view/src/nsViewManager.cpp:774 #8 0xb4c60154 in nsView::HandleEvent (this=<optimized out>, aEvent=0xbefbb100, aUseAttachedEvents=<optimized out>) at ../../../view/src/nsView.cpp:1097 #9 0xb49a50ae in nsWindow::DispatchEvent (this=0xb06f3ba0, aEvent=<optimized out>, aStatus=@0xbefbb0d4) at ../../../widget/gonk/nsWindow.cpp:458

When you hit this assertion, what are the values of "sEventCapturer", "this", and "mEventCaptureDepth"?

Hit it again with todays 2.1 build: [Parent 2048] WARNING: zero axis length: file ../../../../../content/svg/content/src/nsSVGLength2.cpp, line 121 [Parent 2048] WARNING: zero axis length: file ../../../../../content/svg/content/src/nsSVGLength2.cpp, line 121 [Parent 2048] WARNING: No docshells for remote frames!: file ../../../../content/base/src/nsFrameLoader.cpp, line 511 [Child 4250] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1317 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 2048.2048] [Child 3109] WARNING: No inner window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 9694 0xb4d70780 in SendRealTouchEvent (event=..., this=0xab89a5c0) at ../../../dom/ipc/TabParent.cpp:978 978 MOZ_ASSERT((!sEventCapturer && mEventCaptureDepth == 0) || (gdb) bt #0 0xb4d70780 in SendRealTouchEvent (event=..., this=0xab89a5c0) at ../../../dom/ipc/TabParent.cpp:978 #1 mozilla::dom::TabParent::SendRealTouchEvent (this=0xab89a5c0, event=...) at ../../../dom/ipc/TabParent.cpp:961 #2 0xb4d70b18 in mozilla::dom::TabParent::InjectTouchEvent (this=0xab89a5c0, aType=..., aIdentifiers=0xae16b64c, aXs=0xae16b650, aYs=0xae16b654, aRxs=0xae16b658, aRys=0xae16b65c, aRotationAngles=0xae16b660, aForces=0xae16b664, aCount=1, aModifiers=0) at ../../../dom/ipc/TabParent.cpp:2141 #3 0xb432f9f6 in NS_InvokeByIndex (that=<optimized out>, methodIndex=3, paramCount=<optimized out>, params=<optimized out>) at ../../../../../../xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp:164 #4 0xb4675b90 in Invoke (this=0xbed44f38) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2369 #5 CallMethodHelper::Call (this=this@entry=0xbed44f38) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:1730 [Child 3109] WARNING: No inner window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 9694 [Child 3109] WARNING: No inner window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 9694 #6 0xb4675ee8 in XPCWrappedNative::CallMethod (ccx=..., mode=mode@entry=XPCWrappedNative::CALL_METHOD) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:1697 #7 0xb4678bca in XPC_WN_CallMethod (cx=0xb6a83460, argc=<optimized out>, vp=<optimized out>) at ../../../../js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1288 #8 0xb5a31166 in js::CallJSNative (cx=0xb6a83460, native=0xb4678acd <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:231 #9 0xb5a33ec0 in js::Invoke (cx=0xb6a83460, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:481 #10 0xb5a3a3ba in Interpret (cx=0xb6a83460, state=...) at ../../../js/src/vm/Interpreter.cpp:2563 #11 0xb5a3d4ac in RunScript (state=..., cx=0xb6a83460) at ../../../js/src/vm/Interpreter.cpp:428 #12 js::RunScript (cx=0xb6a83460, state=...) at ../../../js/src/vm/Interpreter.cpp:390 #13 0xb5a33e60 in js::Invoke (cx=cx@entry=0xb6a83460, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:500 #14 0xb594aebc in js::CallOrConstructBoundFunction (cx=0xb6a83460, argc=<optimized out>, vp=0xb17ec0d0) at ../../../js/src/jsfun.cpp:1585 #15 0xb5a31166 in js::CallJSNative (cx=0xb6a83460, native=0xb594acad <js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:231 #16 0xb5a33ec0 in js::Invoke (cx=0xb6a83460, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:481 #17 0xb5a3a3ba in Interpret (cx=0xb6a83460, state=...) at ../../../js/src/vm/Interpreter.cpp:2563 #18 0xb5a3d4ac in RunScript (state=..., cx=0xb6a83460) at ../../../js/src/vm/Interpreter.cpp:428 #19 js::RunScript (cx=0xb6a83460, state=...) at ../../../js/src/vm/Interpreter.cpp:390 #20 0xb5a33e60 in js::Invoke (cx=cx@entry=0xb6a83460, args=..., construct=construct@entry=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:500 #21 0xb594b1ae in js_fun_apply (cx=0xb6a83460, argc=<optimized out>, vp=0xbed47588) at ../../../js/src/jsfun.cpp:1325 #22 0xb5a31166 in js::CallJSNative (cx=0xb6a83460, native=0xb594b091 <js_fun_apply(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:231 #23 0xb5a33ec0 in js::Invoke (cx=cx@entry=0xb6a83460, args=..., construct=construct@entry=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:481 #24 0xb5a3dad2 in js::Invoke (cx=cx@entry=0xb6a83460, thisv=..., fval=..., argc=4294967176, argc@entry=2, argv=argv@entry=0xbed47730, rval=rval@entry=$jsval(-nan(0xfff8200000000))) at ../../../js/src/vm/Interpreter.cpp:537 #25 0xb5b65ea0 in js::jit::DoCallFallback (cx=0xb6a83460, frame=0xbed47778, stub_=<optimized out>, argc=2, vp=0xbed47720, res=$jsval(-nan(0xfff8200000000))) at ../../../js/src/jit/BaselineIC.cpp:8414 #26 0xb282a0e0 in ?? () #27 0xb282a0e0 in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?) (gdb) [Child 3109] WARNING: No inner window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 9694 [Child 3109] WARNING: No inner window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 9694 p this $1 = (mozilla::dom::TabParent * const) 0xab89a5c0 (gdb) p *this $2 = {<mozilla::dom::PBrowserParent> = {<mozilla::ipc::IProtocol> = {<mozilla::ipc::MessageListener> = {<mozilla::ipc::HasResultCodes> = {<No data fields>}, <mozilla::SupportsWeakPtr<mozilla::ipc::MessageListener>> = {mSelfReferencingWeakPtr = {mRef = {mPtr = 0xafdcbc40}}}, _vptr.MessageListener = 0xb65a2170 <vtable for mozilla::dom::TabParent+8>}, <No data fields>}, <mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>> = { _vptr.IProtocolManager = 0xb65a22f8 <vtable for mozilla::dom::TabParent+400>}, mChannel = 0xaf87ac30, mManager = 0xaf87ac08, mId = 2, mState = mozilla::dom::PBrowser::__Null, mManagedPColorPickerParent = {<nsTArray_Impl<mozilla::dom::PColorPickerParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::PColorPickerParent*, nsTArray_Impl<mozilla::dom::PColorPickerParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::PColorPickerParent*, nsTArray_Impl<mozilla::dom::PColorPickerParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPDocumentRendererParent = {<nsTArray_Impl<mozilla::ipc::PDocumentRendererParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::ipc::PDocumentRendererParent*, nsTArray_Impl<mozilla::ipc::PDocumentRendererParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::ipc::PDocumentRendererParent*, nsTArray_Impl<mozilla::ipc::PDocumentRendererParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPContentPermissionRequestParent = {<nsTArray_Impl<mozilla::dom::PContentPermissionRequestParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::PContentPermissionRequestParent*, nsTArray_Impl<mozilla::dom::PContentPermissionRequestParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::PContentPermissionRequestParent*, nsTArray_Impl<mozilla::dom::PContentPermissionRequestParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPFilePickerParent = {<nsTArray_Impl<mozilla::dom::PFilePickerParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::PFilePickerParent*, nsTArray_Impl<mozilla::dom::PFilePickerParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::PFilePickerParent*, nsTArray_Impl<mozilla::dom::PFilePickerParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPRenderFrameParent = {<nsTArray_Impl<mozilla::layout::PRenderFrameParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xaf7f0da0}, <nsTArray_TypedBase<mozilla::layout::PRenderFrameParent*, nsTArray_Impl<mozilla::layout::PRenderFrameParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::layout::PRenderFrameParent*, nsTArray_Impl<mozilla::layout::PRenderFrameParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPOfflineCacheUpdateParent = {<nsTArray_Impl<mozilla::docshell::POfflineCacheUpdateParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::docshell::POfflineCacheUpdateParent*, nsTArray_Impl<mozilla::docshell::POfflineCacheUpdateParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::docshell::POfflineCacheUpdateParent*, nsTArray_Impl<mozilla::docshell::POfflineCacheUpdateParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPIndexedDBParent = {<nsTArray_Impl<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArray_Impl<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArray_Impl<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}}, <nsITabParent> = {<nsISupports> = { _vptr.nsISupports = 0xb65a2334 <vtable for mozilla::dom::TabParent+460>}, <No data fields>}, <nsIAuthPromptProvider> = {<nsISupports> = { _vptr.nsISupports = 0xb65a2354 <vtable for mozilla::dom::TabParent+492>}, <No data fields>}, <nsISecureBrowserUI> = {<nsISupports> = { _vptr.nsISupports = 0xb65a236c <vtable for mozilla::dom::TabParent+516>}, <No data fields>}, <nsSupportsWeakReference> = {<nsISupportsWeakReference> = {<nsISupports> = { _vptr.nsISupports = 0xb65a238c <vtable for mozilla::dom::TabParent+548>}, <No data fields>}, mProxy = 0xb0a16280}, <mozilla::dom::TabContext> = {mInitialized = true, mOwnApp = {mRawPtr = 0xb0a16100}, mOwnAppId = 1027, mContainingApp = {mRawPtr = 0xb0a16110}, mContainingAppId = 1029, mScrollingBehavior = mozilla::layout::ASYNC_PAN_ZOOM, mIsBrowser = false}, mRefCnt = {static isThreadSafe = false, mValue = 3}, _mOwningThread = {pmThread = 0xb6a48080}, mFrameElement = 0xab99eba0, mBrowserDOMWindow = {mRawPtr = 0x0}, static mIMETabParent = 0x0, mIMECacheText = {<nsAString_internal> = { mData = 0xb60cb33e <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}, mIMESelectionAnchor = 0, mIMESelectionFocus = 0, mIMEComposing = false, mIMECompositionEnding = false, mIMECompositionText = {<nsFixedString> = {<nsString> = {<nsAString_internal> = {mData = 0xab89a664 u"", mLength = 0, mFlags = 65553}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xab89a664 u""}, mStorage = u"\000", '\xa5a5' <repeats 63 times>}, mIMECompositionStart = 0, mIMESeqno = 0, mIMECompositionRectOffset = 0, mIMECompositionRect = {<mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>> = {x = 0, y = 0, width = 0, height = 0}, <No data fields>}, mIMECaretRect = {<mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>> = {x = 0, y = 0, width = 0, height = 0}, <No data fields>}, mEventCaptureDepth = 0, mRect = {<mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>> = {x = 0, y = 0, width = 480, height = 854}, <No data fields>}, mDimensions = {<mozilla::gfx::BaseSize<int, nsIntSize>> = {width = 480, height = 743}, <No data fields>}, mOrientation = 1, mDPI = 254, mDefaultScale = {scale = 1.5}, mShown = true, mUpdatedDimensions = true, mManager = {mRawPtr = 0xaf87adfc}, mChildProcessOffsetAtTouchStart = {<mozilla::gfx::BasePoint<int, mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel>, mozilla::gfx::IntCoordTyped<mozilla::LayoutDevicePixel> >> = {x = 480, y = -45}, <mozilla::LayoutDevicePixel> = {<No data fields>}, <No data fields>}, mMarkedDestroying = false, mIsDestroyed = false, mAppPackageFileDescriptorSent = true, mChromeFlags = 0, mLoadContext = { mRawPtr = 0x0}} (gdb) p sEventCapturer $3 = (mozilla::dom::TabParent *) 0xab89a280 (gdb) p *sEventCapturer $4 = {<mozilla::dom::PBrowserParent> = {<mozilla::ipc::IProtocol> = {<mozilla::ipc::MessageListener> = {<mozilla::ipc::HasResultCodes> = {<No data fields>}, <mozilla::SupportsWeakPtr<mozilla::ipc::MessageListener>> = {mSelfReferencingWeakPtr = {mRef = {mPtr = 0xae7f5ee0}}}, _vptr.MessageListener = 0xb65a2170 <vtable for mozilla::dom::TabParent+8>}, <No data fields>}, <mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>> = { _vptr.IProtocolManager = 0xb65a22f8 <vtable for mozilla::dom::TabParent+400>}, mChannel = 0xa74fb030, mManager = 0xa74fb008, mId = 2, mState = mozilla::dom::PBrowser::__Null, mManagedPColorPickerParent = {<nsTArray_Impl<mozilla::dom::PColorPickerParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::PColorPickerParent*, nsTArray_Impl<mozilla::dom::PColorPickerParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::PColorPickerParent*, nsTArray_Impl<mozilla::dom::PColorPickerParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPDocumentRendererParent = {<nsTArray_Impl<mozilla::ipc::PDocumentRendererParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::ipc::PDocumentRendererParent*, nsTArray_Impl<mozilla::ipc::PDocumentRendererParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::ipc::PDocumentRendererParent*, nsTArray_Impl<mozilla::ipc::PDocumentRendererParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, p static NoIndex = <optimized out>}, <No data fields>}, mManagedPContentPermissionRequestParent = {<nsTArray_Impl<mozilla::dom::PContentPermissionRequestParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { m mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::PContentPermissionRequestParent*, nsTArray_Impl<mozilla::dom::PContentPermissionRequestParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::PContentPermissionRequestParent*, nsTArray_Impl<mozilla::dom::PContentPermissionRequestParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPFilePickerParent = {<nsTArray_Impl<mozilla::dom::PFilePickerParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { EventC mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::PFilePickerParent*, nsTArray_Impl<mozilla::dom::PFilePickerParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::PFilePickerParent*, nsTArray_Impl<mozilla::dom::PFilePickerParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPRenderFrameParent = {<nsTArray_Impl<mozilla::layout::PRenderFrameParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { apt mHdr = 0xab7ce030}, <nsTArray_TypedBase<mozilla::layout::PRenderFrameParent*, nsTArray_Impl<mozilla::layout::PRenderFrameParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::layout::PRenderFrameParent*, nsTArray_Impl<mozilla::layout::PRenderFrameParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPOfflineCacheUpdateParent = {<nsTArray_Impl<mozilla::docshell::POfflineCacheUpdateParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::docshell::POfflineCacheUpdateParent*, nsTArray_Impl<mozilla::docshell::POfflineCacheUpdateParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::docshell::POfflineCacheUpdateParent*, nsTArray_Impl<mozilla::docshell::POfflineCacheUpdateParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}, mManagedPIndexedDBParent = {<nsTArray_Impl<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArrayInfallibleAllocator>> = {<nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>> = { mHdr = 0xb66dc208 <nsTArrayHeader::sEmptyHdr>}, <nsTArray_TypedBase<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArray_Impl<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArrayInfallibleAllocator> >> = {<nsTArray_SafeElementAtHelper<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArray_Impl<mozilla::dom::indexedDB::PIndexedDBParent*, nsTArrayInfallibleAllocator> >> = {<No data fields>}, <No data fields>}, static NoIndex = <optimized out>}, <No data fields>}}, <nsITabParent> = {<nsISupports> = { _vptr.nsISupports = 0xb65a2334 <vtable for mozilla::dom::TabParent+460>}, <No data fields>}, <nsIAuthPromptProvider> = {<nsISupports> = { _vptr.nsISupports = 0xb65a2354 <vtable for mozilla::dom::TabParent+492>}, <No data fields>}, <nsISecureBrowserUI> = {<nsISupports> = { _vptr.nsISupports = 0xb65a236c <vtable for mozilla::dom::TabParent+516>}, <No data fields>}, <nsSupportsWeakReference> = {<nsISupportsWeakReference> = {<nsISupports> = { _vptr.nsISupports = 0xb65a238c <vtable for mozilla::dom::TabParent+548>}, <No data fields>}, mProxy = 0x0}, <mozilla::dom::TabContext> = {mInitialized = true, mOwnApp = {mRawPtr = 0x0}, mOwnAppId = 0, mContainingApp = {mRawPtr = 0xb09bcdf0}, mContainingAppId = 1029, mScrollingBehavior = mozilla::layout::ASYNC_PAN_ZOOM, mIsBrowser = true}, mRefCnt = {static isThreadSafe = false, mValue = 16}, _mOwningThread = {mThread = 0xb6a48080}, mFrameElement = 0xaac0db30, mBrowserDOMWindow = {mRawPtr = 0x0}, static mIMETabParent = 0x0, mIMECacheText = {<nsAString_internal> = { mData = 0xb60cb33e <gNullChar> u"", mLength = 0, mFlags = 1}, <No data fields>}, mIMESelectionAnchor = 0, mIMESelectionFocus = 0, mIMEComposing = false, mIMECompositionEnding = false, mIMECompositionText = {<nsFixedString> = {<nsString> = {<nsAString_internal> = {mData = 0xab89a324 u"", mLength = 0, mFlags = 65553}, <No data fields>}, mFixedCapacity = 63, mFixedBuf = 0xab89a324 u""}, mStorage = u"\000", '\xa5a5' <repeats 63 times>}, mIMECompositionStart = 0, mIMESeqno = 0, mIMECompositionRectOffset = 0, mIMECompositionRect = {<mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>> = {x = 0, y = 0, width = 0, height = 0}, <No data fields>}, mIMECaretRect = {<mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>> = {x = 0, y = 0, width = 0, height = 0}, <No data fields>}, mEventCaptureDepth = 1, mRect = {<mozilla::gfx::BaseRect<int, nsIntRect, nsIntPoint, nsIntSize, nsIntMargin>> = {x = 0, y = 0, width = 480, height = 854}, <No data fields>}, mDimensions = {<mozilla::gfx::BaseSize<int, nsIntSize>> = {width = 480, height = 674}, <No data fields>}, mOrientation = 1, mDPI = 254, mDefaultScale = {scale = 1.5}, mShown = true, mUpdatedDimensions = true, mManager = {mRawPtr = 0xa74fb1fc}, mChildProcessOffsetAtTouchStart = {<mozilla::gfx::BasePoint<int, mozilla::gfx::IntPointTyped<mozilla::LayoutDevicePixel>, mozilla::gfx::IntCoordTyped<mozilla::LayoutDevicePixel> >> = {x = 0, y = -114}, <mozilla::LayoutDevicePixel> = {<No data fields>}, <No data fields>}, mMarkedDestroying = false, mIsDestroyed = false, mAppPackageFileDescriptorSent = true, mChromeFlags = 262144, mLoadContext = {mRawPtr = 0x0}} (gdb) p mEventCaptureDepth $5 = 0 (gdb)

After opening metacritic music app from e.me

That's interesting, the stack this time is different from last time. This time it's going through TabParent::InjectTouchEvent. That combined with the fact that this != sEventCapturer probably means that the touch forwarder in JS is redispatching the event to the wrong TabParent (one that is not the event capturer). It might be either [1] or [2] that's picking up the wrong iframe, I'm not sure. The whole injectTouchEvent business is such a hack anyway but I don't really have any good ideas on how to get rid of it nicely. :( [1] https://github.com/mozilla-b2g/gaia/blob/c0ad76930d16b75e0e964625a4fb6041e39e0954/apps/system/js/edge_swipe_detector.js#L180-L181 [2] https://github.com/mozilla-b2g/gaia/blob/c0ad76930d16b75e0e964625a4fb6041e39e0954/apps/system/js/statusbar.js#L689-L690

(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #4) > That's interesting, the stack this time is different from last time. This > time it's going through TabParent::InjectTouchEvent. That combined with the > fact that this != sEventCapturer probably means that the touch forwarder in > JS is redispatching the event to the wrong TabParent (one that is not the > event capturer). It might be either [1] or [2] that's picking up the wrong > iframe, I'm not sure. > > The whole injectTouchEvent business is such a hack anyway but I don't really > have any good ideas on how to get rid of it nicely. :( > > [1] > https://github.com/mozilla-b2g/gaia/blob/ > c0ad76930d16b75e0e964625a4fb6041e39e0954/apps/system/js/edge_swipe_detector. > js#L180-L181 > [2] > https://github.com/mozilla-b2g/gaia/blob/ > c0ad76930d16b75e0e964625a4fb6041e39e0954/apps/system/js/statusbar.js#L689- > L690 So how should we proceed here?

Somebody who knows the swipe detector and/or statusbar code that is calling injectTouchEvent should take a look.

Flagging either Etienne or myself to take a look at this.

Another bt from current trunk: [Child 3329] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1510 [Parent 2770] ###!!! ASSERTION: Unexpected layers id in SetTargetAPZC; dropping message...: 'Error', file ../../../layout/ipc/RenderFrameParent.cpp, line 554 [Child 3329] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1510 [Parent 2770] WARNING: No docshells for remote frames!: file ../../../dom/base/nsFrameLoader.cpp, line 513 [Child 3329] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1510 [Child 3329] WARNING: Transparent content with displayports can be expensive.: file ../../../layout/base/nsDisplayList.cpp, line 1510 Program received signal SIGSEGV, Segmentation fault. 0xb4f351bc in SendRealTouchEvent (event=..., this=0xab1f0c00) at ../../../dom/ipc/TabParent.cpp:1078 1078 MOZ_ASSERT((!sEventCapturer && mEventCaptureDepth == 0) || (gdb) bt #0 0xb4f351bc in SendRealTouchEvent (event=..., this=0xab1f0c00) at ../../../dom/ipc/TabParent.cpp:1078 #1 mozilla::dom::TabParent::SendRealTouchEvent (this=0xab1f0c00, event=...) at ../../../dom/ipc/TabParent.cpp:1061 #2 0xb4f35f24 in mozilla::dom::TabParent::InjectTouchEvent (this=0xab1f0c00, aType=..., aIdentifiers=0xad957824, aXs=0xad9579a0, aYs=0xad9579a8, aRxs=0xad9579b4, aRys=0xad9579cc, aRotationAngles=0xad9579d4, aForces=0xad9579dc, aCount=1, aModifiers=0) at ../../../dom/ipc/TabParent.cpp:2201 #3 0xb427bc86 in NS_InvokeByIndex (that=<optimized out>, methodIndex=3, paramCount=<optimized out>, params=<optimized out>) at ../../../../../../xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp:164 #4 0xb45e3a3a in Invoke (this=0xbeaab9d8) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2395 #5 CallMethodHelper::Call (this=this@entry=0xbeaab9d8) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:1747 #6 0xb45e47a2 in XPCWrappedNative::CallMethod (ccx=..., mode=<optimized out>) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:1714 #7 0xb45e4bc6 in XPC_WN_CallMethod (cx=0xb6aa0150, argc=<optimized out>, vp=<optimized out>) at ../../../../js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1244 #8 0xaf8e58e0 in ?? ()

We can add a single check in touch_forwarder.js but I have no idea of what is the condition under which we shouldn't forward.

(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #4) > That's interesting, the stack this time is different from last time. This > time it's going through TabParent::InjectTouchEvent. That combined with the > fact that this != sEventCapturer probably means that the touch forwarder in > JS is redispatching the event to the wrong TabParent (one that is not the > event capturer). I'm not really sure I follow here. We're intentionally forwarding events from the system app to other frames, so the system app frame is the one that captures the events, then forwards it. If we are forwarding the touch event to an app frame, how would it be the wrong TabParent? Is there a chance that that frame we forward to is in some weird state like being opened or killed? To be honest, I don't really know our TabParent/touch logic enough to effectively debug this one in a timely manner. I'd be happy to sit down and peer-debug this though if that would help.

(In reply to Kevin Grandon :kgrandon from comment #10) > I'm not really sure I follow here. We're intentionally forwarding events > from the system app to other frames, so the system app frame is the one that > captures the events, then forwards it. If we are forwarding the touch event > to an app frame, how would it be the wrong TabParent? Is there a chance that > that frame we forward to is in some weird state like being opened or killed? So without the injectTouchEvent business, all touch events in a session go to the same target element. This applies to child processes as well - that is, if you put your finger down on a child process' content area and then move your finger around all of those touchmoves should go to the same child process regardless of what's actually under your finger. This behaviour is implemented in gecko for touch events normally (it's referred to as "touch event capturing"). There is also a B2G-specific fast-path that detects the child process that the touchstart goes to, and directly dispatches the subsequent touchmove events to that process. The TabParent for this child process is stored in the "sEventCapturer" field while the touch session is in progress. What's happening here is that the injectTouchEvent code is getting called on the TabParent of a different process while a touch session is already in progress. So in effect the JS code is attempting to forward the touch event to a TabParent that it's not intended for. The most likely cause for this that yes, the process ended or was pushed to the background and so the JS code picks up a different child process as being active instead of using the "capturing" process. That being said I'm planning on reworking a lot of this code as part of bug 950934 and bug 920036 so it might not be worth fixing this right now, particularly if we're not going to uplift the fix to 2.1.

Still seeing this on current trunk: Program received signal SIGSEGV, Segmentation fault. [Child 4639] WARNING: Channel provided to SetRequestContext is not an nsIHttpChannel so referrer is not available for reporting.: file ../../../dom/security/nsCSPContext.cpp, line 616 0xb4f69ff6 in mozilla::dom::TabParent::TryCapture (this=this@entry=0xaa290380, aEvent=...) at ../../../dom/ipc/TabParent.cpp:1316 1316 MOZ_ASSERT(sEventCapturer == this && mEventCaptureDepth > 0); (gdb) bt #0 0xb4f69ff6 in mozilla::dom::TabParent::TryCapture (this=this@entry=0xaa290380, aEvent=...) at ../../../dom/ipc/TabParent.cpp:1316 #1 0xb4f6ab24 in mozilla::dom::TabParent::InjectTouchEvent (this=0xaa290380, aType=..., aIdentifiers=0xae2d6b60, aXs=0xae3c7804, aYs=0xae3c780c, aRxs=0xae3c7820, aRys=0xae3c7828, aRotationAngles=0xae3c7830, aForces=0xae3c7838, aCount=1, aModifiers=0) at ../../../dom/ipc/TabParent.cpp:2502 #2 0xb4262da6 in NS_InvokeByIndex (that=<optimized out>, methodIndex=3, paramCount=<optimized out>, params=<optimized out>) at ../../../../../../xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp:163 #3 0xb45d777e in Invoke (this=0xbefc9880) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:2396 #4 CallMethodHelper::Call (this=this@entry=0xbefc9880) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:1733 #5 0xb45d8506 in XPCWrappedNative::CallMethod (ccx=..., mode=<optimized out>) at ../../../../js/xpconnect/src/XPCWrappedNative.cpp:1700 #6 0xb45d892e in XPC_WN_CallMethod (cx=0xb2713040, argc=<optimized out>, vp=<optimized out>) at ../../../../js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1166 #7 0xb58d6fc4 in js::CallJSNative (cx=0xb2713040, native=0xb45d8831 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:226 #8 0xb58fff34 in js::Invoke (cx=0xb2713040, args=..., construct=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:498 #9 0xb58fc574 in Interpret (cx=0xb2713040, state=...) at ../../../js/src/vm/Interpreter.cpp:2557 #10 0xb58ff8ae in js::RunScript (cx=cx@entry=0xb2713040, state=...) at ../../../js/src/vm/Interpreter.cpp:448 #11 0xb58fff02 in js::Invoke (cx=cx@entry=0xb2713040, args=..., construct=construct@entry=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:517 #12 0xb5b421d4 in js::CallOrConstructBoundFunction (cx=0xb2713040, argc=4294967176, vp=0xbefcadf8) at ../../../js/src/jsfun.cpp:1609 #13 0xb58d6fc4 in js::CallJSNative (cx=0xb2713040, native=0xb5b42009 <js::CallOrConstructBoundFunction(JSContext*, unsigned int, JS::Value*)>, args=...) at ../../../js/src/jscntxtinlines.h:226 #14 0xb58fff34 in js::Invoke (cx=cx@entry=0xb2713040, args=..., construct=construct@entry=js::NO_CONSTRUCT) at ../../../js/src/vm/Interpreter.cpp:498 #15 0xb59007c6 in js::Invoke (cx=cx@entry=0xb2713040, thisv=..., fval=..., argc=argc@entry=0, argv=argv@entry=0xbefcb078, rval=rval@entry=$jsval(-nan(0xfff8200000000))) at ../../../js/src/vm/Interpreter.cpp:554 #16 0xb5a08246 in js::jit::DoCallFallback (cx=0xb2713040, frame=0xbefcb0a8, stub_=<optimized out>, argc=0, vp=0xbefcb068, res=$jsval(-nan(0xfff8200000000))) at ../../../js/src/jit/BaselineIC.cpp:9502 #17 0xb2807cd4 in ?? () #18 0xb2807cd4 in ?? () Backtrace stopped: previous frame identical to this frame (corrupt stack?)

With ./check_versions.sh Gaia-Rev cf277306be1fef2060f2d2335ea0b875524816ff Gecko-Rev Build-ID 20150204120723 Version 38.0a1 Device-Name flame FW-Release 4.4.2 FW-Incremental eng.idefix.20150204.115943 FW-Date Wed Feb 4 12:00:18 PST 2015 Bootloader L1TC100118D0

Still seeing this on trunk during a search on the search page: #0 0xb4fc2912 in SendRealTouchEvent (event=..., this=0xbee0e4d8) at ../../../dom/ipc/TabParent.cpp:1314 #1 mozilla::dom::TabParent::SendRealTouchEvent (this=this@entry=0xbee0e4d8, event=...) at ../../../dom/ipc/TabParent.cpp:1298 #2 0xb4d1e542 in mozilla::EventStateManager::DispatchCrossProcessEvent (this=this@entry=0xae06d380, aEvent=0x0, aEvent@entry=0xbee0e4d8, aFrameLoader=aFrameLoader@entry=0xabf6b460, aStatus=0x0, aStatus@entry=0xbee0e428) at ../../../dom/events/EventStateManager.cpp:1109 #3 0xb4d2174c in HandleCrossProcessEvent (aStatus=0xbee0e428, aEvent=0xbee0e4d8, this=0xae06d380) at ../../../dom/events/EventStateManager.cpp:1250 #4 mozilla::EventStateManager::HandleCrossProcessEvent (this=0xae06d380, aEvent=0xbee0e4d8, aStatus=0xbee0e428) at ../../../dom/events/EventStateManager.cpp:1173 #5 0xb4d24e50 in mozilla::EventStateManager::PostHandleEvent (this=this@entry=0xae06d380, aPresContext=aPresContext@entry=0xae05be00, aEvent=aEvent@entry=0xbee0e4d8, aTargetFrame=0xab251bf0, aStatus=aStatus@entry=0xbee0e428) at ../../../dom/events/EventStateManager.cpp:2730 #6 0xb5289acc in PresShell::HandleEventInternal (this=this@entry=0xae3b9100, aEvent=aEvent@entry=0xbee0e4d8, aStatus=aStatus@entry=0xbee0e428) at ../../../layout/base/nsPresShell.cpp:8091 #7 0xb5289c86 in PresShell::HandlePositionedEvent (this=this@entry=0xae3b9100, aTargetFrame=aTargetFrame@entry=0xab251bf0, aEvent=aEvent@entry=0xbee0e4d8, aEventStatus=aEventStatus@entry=0xbee0e428) at ../../../layout/base/nsPresShell.cpp:7915 #8 0xb528a8a2 in PresShell::HandleEvent (this=0xb0669fc0, aFrame=<optimized out>, aEvent=0xbee0e4d8, aDontRetargetEvents=<optimized out>, aEventStatus=0xbee0e428) at ../../../layout/base/nsPresShell.cpp:7712 #9 0xb50ef92c in nsViewManager::DispatchEvent (this=<optimized out>, aEvent=aEvent@entry=0xbee0e4d8, aView=aView@entry=0xafe754b0, aStatus=aStatus@entry=0xbee0e428) at ../../view/nsViewManager.cpp:776 #10 0xb50ed590 in nsView::HandleEvent (this=<optimized out>, aEvent=0xbee0e4d8, aUseAttachedEvents=<optimized out>) at ../../view/nsView.cpp:1085 #11 0xb5117b06 in nsWindow::DispatchEvent (this=0xb062f6c0, aEvent=<optimized out>, aStatus=@0xbee0e464: (nsEventStatus_eConsumeNoDefault | unknown: 396)) at ../../../widget/gonk/nsWindow.cpp:607 #12 0xb50f103e in nsBaseWidget::DispatchEventForAPZ (this=this@entry=0xb062f6c0, aEvent=aEvent@entry=0xbee0e4d8, aGuid=..., aInputBlockId=aInputBlockId@entry=558) at ../../widget/nsBaseWidget.cpp:995 #13 0xb5118d0c in nsWindow::DispatchTouchEventForAPZ (this=0xb062f6c0, aInput=..., aGuid=..., aInputBlockId=aInputBlockId@entry=558) at ../../../widget/gonk/nsWindow.cpp:329 #14 0xb5118d3e in DispatchTouchInputOnMainThread::Run (this=<optimized out>) at ../../../widget/gonk/nsWindow.cpp:261 #15 0xb426f2b0 in nsThread::ProcessNextEvent (this=0xb6b533c0, aMayWait=<optimized out>, aResult=0xbee0e5c7) at ../../../xpcom/threads/nsThread.cpp:855 #16 0xb4284734 in NS_ProcessNextEvent (aThread=0xb6b533c0, aMayWait=aMayWait@entry=false) at /Volumes/2mac/moz/ib2g/xpcom/glue/nsThreadUtils.cpp:265 #17 0xb443bd8c in mozilla::ipc::MessagePump::Run (this=0xb6b07690, aDelegate=0xb6b321c0) at ../../../ipc/glue/MessagePump.cpp:99 #18 0xb4427a10 in MessageLoop::RunInternal (this=this@entry=0xb6b321c0) at ../../../ipc/chromium/src/base/message_loop.cc:233 #19 0xb4427a2a in RunHandler (this=0xb6b321c0) at ../../../ipc/chromium/src/base/message_loop.cc:226 #20 MessageLoop::Run (this=0xb6b321c0) at ../../../ipc/chromium/src/base/message_loop.cc:200 #21 0xb50f344a in nsBaseAppShell::Run (this=0xb6b48100) at ../../widget/nsBaseAppShell.cpp:164 #22 0xb553554a in nsAppStartup::Run (this=0xb1e26430) at ../../../../toolkit/components/startup/nsAppStartup.cpp:281 #23 0xb5565548 in XREMain::XRE_mainRun (this=this@entry=0xbee0e750) at ../../../toolkit/xre/nsAppRunner.cpp:4160 #24 0xb556571c in XREMain::XRE_main (this=this@entry=0xbee0e750, argc=argc@entry=1, argv=argv@entry=0xb6b27288, aAppData=aAppData@entry=0xb6ff7858 <_ZL8sAppData>) at ../../../toolkit/xre/nsAppRunner.cpp:4236 #25 0xb5565896 in XRE_main (argc=1, argv=0xb6b27288, aAppData=0xb6ff7858 <_ZL8sAppData>, aFlags=<optimized out>) at ../../../toolkit/xre/nsAppRunner.cpp:4456 #26 0xb6fdc13a in do_main (argc=argc@entry=1, argv=argv@entry=0xb6b27288) at ../../../b2g/app/nsBrowserApp.cpp:167 #27 0xb6fdc276 in b2g_main (argc=argc@entry=1, argv=argv@entry=0xbee0fa24) at ../../../b2g/app/nsBrowserApp.cpp:299 #28 0xb6fdbfa4 in RunProcesses (aReservedFds=..., argv=0xbee0fa24, argc=1) at ../../../b2g/app/B2GLoader.cpp:225 #29 main (argc=1, argv=0xbee0fa24) at ../../../b2g/app/B2GLoader.cpp:290 (gdb) p sEventCapturer $3 = (mozilla::dom::TabParent *) 0xae0d3500 (gdb) p mEventCaptureDepth $4 = -1229684480 (gdb) p this $5 = (mozilla::dom::TabParent * const) 0xbee0e4d8 (gdb)

Patches on bug 1116579 do away with this whole event capturer business and should resolve this bug. I don't plan on uplifting it to 2.2 though as it's mostly an optimization and kinda risky.

Should be fixed by bug 1143518 since this code doesn't exist any more.