1126133 - [7715ea_v2.1][dolphin]monkey test crash at crash libxul.so!nsTArray_Impl<mozilla::layers::AnimationSegment, nsTArrayInfallibleAllocator>::Clear() [nsTArray.h : 328 + 0x0]

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: Stability, defect)

Description

[yaoyao.wu]

CPU: arm  1 CPU
Crash reason:  SIGSEGV
Crash address: 0x0

Thread 27 (crashed)
 0  libxul.so!nsTArray_Impl<mozilla::layers::AnimationSegment, nsTArrayInfallibleAllocator>::Clear() [nsTArray.h : 328 + 0x0]
     r4 = 0xb6765b34    r5 = 0xb6765b44    r6 = 0xb6765b34    r7 = 0x00000001
     r8 = 0x00000001    r9 = 0xb6765c4c   r10 = 0x00000060    fp = 0xb3103960
     sp = 0xb3103778    lr = 0xb50ebae1    pc = 0xb50ebaac
    Found by: given as instruction pointer in context
 1  libxul.so!mozilla::layers::Animation::~Animation() [nsTArray.h : 741 + 0x5]
     r4 = 0xb6765b34    r5 = 0xb6765b44    r6 = 0xb6765b34    r7 = 0x00000001
     r8 = 0x00000001    r9 = 0xb6765c4c   r10 = 0x00000060    fp = 0xb3103960
     sp = 0xb3103790    pc = 0xb50ebae1
    Found by: call frame info
 2  libxul.so!nsTArray_Impl<mozilla::layers::Animation, nsTArrayInfallibleAllocator>::DestructRange(unsigned int, unsigned int) [nsTArray.h : 486 + 0x3]
     r4 = 0xb6765b94    r5 = 0xb6765b94    r6 = 0xb6765b34    r7 = 0x00000001
     r8 = 0x00000001    r9 = 0xb6765c4c   r10 = 0x00000060    fp = 0xb3103960
     sp = 0xb31037a0    pc = 0xb50ebb05
    Found by: call frame info
 3  libxul.so!mozilla::layers::CommonLayerAttributes::Assign(nsIntRect const&, nsIntRegion const&, mozilla::layers::EventRegions const&, mozilla::layers::TransformMatrix const&, float const&, float const&, unsigned int const&, float const&, bool const&, nsIntRect const&, bool const&, mozilla::gfx::PointTyped<mozilla::LayerPixel> const&, mozilla::gfx::MarginTyped<mozilla::LayerPixel> const&, bool const&, unsigned long long const&, mozilla::gfx::RectTyped<mozilla::LayerPixel> const&, mozilla::gfx::RectTyped<mozilla::LayerPixel> const&, unsigned long long const&, unsigned int const&, signed char const&, bool const&, mozilla::layers::PLayerParent*, mozilla::layers::PLayerChild*, nsTArray<mozilla::layers::Animation> const&, nsIntRegion const&, nsTArray<mozilla::layers::FrameMetrics> const&, std::string const&) [nsTArray.h : 1109 + 0x9]
     r4 = 0xb6765b3c    r5 = 0xb31039fc    r6 = 0xb6765b34    r7 = 0x00000001
     r8 = 0x00000001    r9 = 0xb6765c4c   r10 = 0x00000060    fp = 0xb3103960
     sp = 0xb31037b0    pc = 0xb50eddd9
    Found by: call frame info
 4  libxul.so!mozilla::layers::CommonLayerAttributes::operator=(mozilla::layers::CommonLayerAttributes const&) [LayersMessages.h : 3674 + 0x95]
     r4 = 0xb6765b3c    r5 = 0xb3103a18    r6 = 0xb3103ab4    r7 = 0xb3103bbc
     r8 = 0x00000001    r9 = 0xb3103ab8   r10 = 0x0000018c    fp = 0xb6e912ec
     sp = 0xb3103838    pc = 0xb50edfd1
    Found by: call frame info
 5  libxul.so!mozilla::layers::LayerAttributes::Assign(mozilla::layers::CommonLayerAttributes const&, mozilla::layers::SpecificLayerAttributes const&) [LayersMessages.cpp : 3142 + 0x3]
     r4 = 0xb6765b3c    r5 = 0xb3103a18    r6 = 0xb3103ab4    r7 = 0xb3103bbc
     r8 = 0x00000001    r9 = 0xb3103ab8   r10 = 0x0000018c    fp = 0xb6e912ec
     sp = 0xb31038a0    pc = 0xb50edfdf

Comment 1

[yaoyao.wu]

STR: run monkey test 

The log is uploaded to:ftp://ftp.spreadtrum.com/7715/1126133/
username:mouzhi
password:mouZHI$$61

Comment 2

[Rex Hung[:rhung]]

Hi, Yaoyao,

The log file on FTP is not valid. Could you check it? Thank you.

Comment 3

[yaoyao.wu]

(In reply to Rex Hung from comment #2)
> Hi, Yaoyao,
> 
> The log file on FTP is not valid. Could you check it? Thank you.

Hi Rex,

The log file is Ok now.Please check it.

Rex,could you please give me some suggestions on how to analysis these crashes issues？
As for these issues,I don't know how to begin the ayalysis.

Thanks a lot ~

Comment 4

[Julien Wajsberg [:julienw] (PTO -> Jan 5)]

Hey Kyle, do you know who could handle this?

Comment 5

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Someone familiar with layers?

Comment 6

[Julien Wajsberg [:julienw] (PTO -> Jan 5)]

Oh yeah, good suggestion... I know one of them !

Hey Nical, does this ring some bells?

Comment 7

[Nicolas Silva [:nical]]

(In reply to Julien Wajsberg [:julienw] from comment #6)
> Oh yeah, good suggestion... I know one of them !
> 
> Hey Nical, does this ring some bells?

Sorry for the late reply. Doesn't ring any bell. More elements in the stack trace would help seeing what's going on.

Comment 8

[Julien Wajsberg [:julienw] (PTO -> Jan 5)]

Hey Kyle, sorry to bother you again,

seems like we have 2 crashes in nsTArray at the same location, but with different item types.

Compare this bug with bug 1119608 comment 19 (be careful as this is not the same crash that bug 1119608 originally was created for).

Therefore this suggests more an issue with nsTArray than with Layers.

Comment 9

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

This is far more likely to be a memory corruption issue in the SMS code than a bug in nsTArray that has eluded us for over a decade.

Comment 10

[BMO Automation]

Firefox OS is not being worked on