1173571 - [Aries] crash in mozalloc_abort(char const*) | NS_DebugBreak | mozilla::ipc::FatalError(char const*, char const*, int, bool) | mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&)

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: Gaia::Customizer, defect)

Description

[Oliver Nelson [:oliverthor]]

This bug was filed from the Socorro interface and is 
report bp-fb341e56-902a-42d7-b624-d569c2150610.
=============================================================

Crash Report observed on Aries Device from when in 'Edit Mode' of Customizer for the 'Homescreen'. Edit line was observed on the icon (<div class="icon test-icon-cached"..) for Dialer. Attempting to edit by adding a single character, dismissing the keyboard and opening it again led on occasion to crash reports. Experienced 3 times quickly:
* https://crash-stats.mozilla.com/report/index/eff0d022-67a9-409e-9dbf-337222150610
* https://crash-stats.mozilla.com/report/index/892c4b84-1c3b-4091-9448-21c912150610

PreReq:
* Enable Customizer through setting Full DevTools and running the app (to enable Customizer after Factory Resetting phone).
Repro Steps:
1) Update phone to 20150610170534
2) Enable Customizer
3) Open Customizer at Homescreen via two-finger up gesture from bottom of screen
4) Tap the Dialer app to focus Customizer
5) Tap Home to return to homescreen
6) Tap edit button (far left, pencil in etched square)
7) Tap in HTML on line to open keyboard
8) Add character, close keyboard
9) Repeat step 8 until crash

--------------------------------------------------
Environmental Variables:
Device: Aries 3.0
BuildID: 20150610170534
Gaia: e3eaf72ccd1bfe6d60d37efde6d3b92c1dbc5ff9
Gecko: 95afddf894e3
Gonk: 75c7e6ca80d0c7a53f346ecfcde2343be95808c9
Version: 41.0a1 (3.0) 
Firmware Version: D5803_23.1.A.1.28_NCB.ftf
User Agent: Mozilla/5.0 (Mobile; rv:41.0) Gecko/41.0 Firefox/41.0
--------------------------------------------------

Repro Rate: 4/6 (not 100%, but fairly common)

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Narrowing down the steps, the crash happens when minimizing the keyboard.
1) tap the Rocketbar
2) long tap the space bar

Comment 2

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Tim, could you take a look at this bug please?

Comment 3

[Tim Guan-tin Chien [:timdream] (please needinfo)]

I am not familiar with the crash site logged here, can't help even though it is triggered by keyboard.

Comment 4

[Peter Bylenga [:PBylenga]]

[Blocking Requested - why for this release]:
reproducible crash

Comment 5

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Frame 	Module 	Signature 	Source
0 	libmozglue.so 	mozalloc_abort(char const*) 	memory/mozalloc/mozalloc_abort.cpp
1 	libxul.so 	NS_DebugBreak 	xpcom/base/nsDebugImpl.cpp
2 	libxul.so 	mozilla::ipc::FatalError(char const*, char const*, int, bool) 	ipc/glue/ProtocolUtils.cpp
3 	libxul.so 	mozilla::dom::PBrowserChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/ipc/ipdl/PBrowserChild.cpp:3310
4 	libxul.so 	mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/ipc/ipdl/PContentChild.cpp:5337
5 	libxul.so 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
6 	libxul.so 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp
7 	libxul.so 	mozilla::ipc::MessageChannel::OnMaybeDequeueOne() 	ipc/glue/MessageChannel.cpp
8 	libxul.so 	RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
9 	libxul.so 	mozilla::ipc::MessageChannel::DequeueTask::Run() 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/objdir-gecko/dist/include/mozilla/ipc/MessageChannel.h:446
10 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
11 	libxul.so 	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) 	ipc/chromium/src/base/message_loop.cc
12 	libxul.so 	MessageLoop::DoWork() 	ipc/chromium/src/base/message_loop.cc
13 	libxul.so 	mozilla::ipc::DoWorkRunnable::Run() 	ipc/glue/MessagePump.cpp
14 	libxul.so 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
15 	libxul.so 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
16 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
17 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
18 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
19 	libxul.so 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
20 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp
21 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
22 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
23 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp
24 	libxul.so 	content_process_main(int, char**) 	ipc/contentproc/plugin-container.cpp
25 	libxul.so 	mozilla::ipc::ProcLoaderLoadRunner::DoWork() 	ipc/glue/ProcessUtils_linux.cpp
26 	libxul.so 	XRE_ProcLoaderServiceRun 	ipc/glue/ProcessUtils_linux.cpp
27 	b2g 	main 	b2g/app/B2GLoader.cpp
28 	libc.so 	__libc_init 	/home/worker/workspace/B2G/bionic/libc/bionic/libc_init_dynamic.cpp:112
29 	b2g 	b2g@0xc1da 	
30 	linker 	set_soinfo_pool_protection 	/local/build/foxfone-one-v1.4-release/v18D/bionic/linker/linker.cpp:291
31 		@0xbec23d94

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Ben, Could point us to the right direction on who to ask to try to get this fixed, please?

Comment 7

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Can you log the message that is printed in mozilla::ipc::FatalError() (frame 2 from the stack trace). That may give you some clue as to what the problem is.

And I guess you could followup with Bill?

Comment 8

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Please needinfo me when you have the error.

Comment 9

[Peter Bylenga [:PBylenga]]

Adding qawanted to try to get the log from comment 7.

NI on Naoki for exposure as well.

Comment 10

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

The last crash I see with this is : 20150615010203

Does not seem to happen with 20150709163311; this build seems to clear the ActiveTargetsManager.
W/Built-in Keyboard( 1343): Content JS WARN: ActiveTargetsManager: clear 1 active target(s). 
W/Built-in Keyboard( 1343):     at ActiveTargetsManager.prototype.clearAllTargets (app://keyboard.gaiamobile.org/gaia_build_defer_index.js:51:1)
W/Built-in Keyboard( 1343): Content JS WARN: ActiveTargetsManager: clear 1 active target(s). 
W/Built-in Keyboard( 1343):     at ActiveTargetsManager.prototype.clearAllTargets (app://keyboard.gaiamobile.org/gaia_build_defer_index.js:51:1)

Comment 11

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Seems to have been fixed by Bug 1029356; https://github.com/mozilla-b2g/gaia/commit/3f2de4304c8a45f8af7d0245d1770a57074252eb

Should we close this off as WFM?  Or should we pursue to see if the code change is masking an issue?

Comment 12

[Pi Wei Cheng [:piwei] (inactive)]

Removing keyword due to bug being marked as fixed.

Comment 13

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Let's just close this.