1263808 - crash in java.lang.NullPointerException: Null native pointer at org.mozilla.gecko.gfx.NativePanZoomController.disposeNative(Native Method)

Status: RESOLVED FIXED

(Core Graveyard :: Widget: Android, defect)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

This bug was filed from the Socorro interface and is 
report bp-ca2be46b-86cb-4b7b-a3f2-db50e2160408.
=============================================================

The first crashes are from the 4/07 Nightly, so I think it may be a regression from bug 1257959.

Comment 1

[Kartikaya Gupta (email:[e-mail])]

This seems to be in generated wrapper code? I'm having a hard time following this shutdown code, but it looks like the NPE is thrown from somewhere in [1]? That can't be right...

[1] http://mxr.mozilla.org/mozilla-central/source/widget/android/nsWindow.cpp?rev=cce22ba996a6#432

Comment 2

[(inactive) Jim Chen [:jchen] [:darchons]]

Yeah, the wrapper code threw the exception because the NPZC instance has already been "disposed" (or has not been initialized) when calling disposeNative. disposeNative is called by NativePanZoomController.destroy [1], which guards against being called twice. So I think NativePanZoomController.destroy is actually being called too early, before NPZC has initialized. That doesn't appear to be directly related to bug 1257959, but maybe it's a side-effect.

[1] http://mxr.mozilla.org/mozilla-central/source/mobile/android/base/java/org/mozilla/gecko/gfx/NativePanZoomController.java?rev=21bf1af375c1#246

Comment 3

[:Margaret Leibovic]

This is one of our top crashes on Nightly right now.

Comment 4

[Randall Barker [:rbarker]]

Attachment: 0001-Bug-1263808-Prevent-NativePanZoomController.disposeNative-from-being-called-before-NPZCSupport-has-attached.-r-16041916-7083555.patch

Comment 5

[Randall Barker [:rbarker]]

Comment on attachment 8743062 [details] [diff] [review]
0001-Bug-1263808-Prevent-NativePanZoomController.disposeNative-from-being-called-before-NPZCSupport-has-attached.-r-16041916-7083555.patch

I am unable to reproduce this. After discussion with :snorp, I believe this is what we agreed could possibly prevent the exception from being thrown at the possibility that NPZCSupport might leak.

Comment 6

[Kevin Brosnan [Ex-Mozilla]]

[Tracking Requested - why for this release]: Should be fixed before APZ goes to release.

Comment 7

[(inactive) Jim Chen [:jchen] [:darchons]]

Comment on attachment 8743062 [details] [diff] [review]
0001-Bug-1263808-Prevent-NativePanZoomController.disposeNative-from-being-called-before-NPZCSupport-has-attached.-r-16041916-7083555.patch

I have a suspicion that this is related to bug 1260451, which was fixed in the 4/16 nightly. We can revisit this if we get crash reports from after that nightly.

Comment 8

[Kartikaya Gupta (email:[e-mail])]

I don't see any of these past the 20160414030247 nightly, so I think we can close it and reopen it if comes back.

Comment 9

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

This is looking pretty bad in 48: #10 topcrash with 2887 reports in the past week.

Comment 10

[Botond Ballo [:botond]]

Switching needinfo to :rbarker as :kats is away this week

Comment 11

[Randall Barker [:rbarker]]

Jim, should we try landing this patch now or is there something else you would like to try first?

Comment 12

[(inactive) Jim Chen [:jchen] [:darchons]]

This crash doesn't appear in the Beta top crashes, so maybe it's not as bad, but I guess we should fix it. I can work on it.

Comment 13

[(inactive) Jim Chen [:jchen] [:darchons]]

Attachment: Guard against premature LayerView destruction (v1)

Basically the same as the other patch except using mGeckoisReady in
GeckoLayerClient as the flag. Also guard against a case where
LayerView.onSizeChanged is called after LayerView destruction and results in a
NPE from mCompositor being null.

Comment 14

[Randall Barker [:rbarker]]

Comment on attachment 8779754 [details] [diff] [review]
Guard against premature LayerView destruction (v1)

Review of attachment 8779754 [details] [diff] [review]:
-----------------------------------------------------------------

Of course I was in the process of trying to remove PanZoomTarget. But that may not possible anyway.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0ff858bf7e79
Guard against premature LayerView destruction; r=rbarker

Comment 16

[(inactive) Jim Chen [:jchen] [:darchons]]

Comment on attachment 8779754 [details] [diff] [review]
Guard against premature LayerView destruction (v1)

Approval Request Comment
[Feature/regressing bug #]: N/A
[User impact if declined]: Possible crash when using Fennec (one of current top crashes on release)
[Describe test coverage new/current, TreeHerder]: Locally
[Risks and why]: Small; only thing patch does is to avoid crash condition
[String/UUID change made/needed]: None

Comment 17

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0ff858bf7e79

Comment 18

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Hi Sylvestre, Kevin, I was reviewing this bug for uplift to Aurora and noticed that this seems to be a top crasher on Fennec48 (at spot #11). Is this something we would want to include in the 48.0.1 that is being planned? Just fyi it seems like a good ride-along.

Comment 19

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8779754 [details] [diff] [review]
Guard against premature LayerView destruction (v1)

Crash fix, let's validate on Aurora50 and Beta49 so we can consider taking this as a ride-along in 48.0.x.

Comment 20

[Kevin Brosnan [Ex-Mozilla]]

I don't see any reports of this on 49 https://mozilla.github.io/bug-signatures-status/#/bug/1263808?_k=yipag2 though there are some crashes on 50 and 51. Odd.

Crash stats reports that this is 1% of total crashes so it is a significant win. While this is several changes they look to be checking for null values and making sure gecko is active.

Comment 21

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

This doesn't appear to apply cleanly to aurora.

Comment 22

[(inactive) Jim Chen [:jchen] [:darchons]]

Attachment: Patch for Aurora (v1)

Comment 23

[(inactive) Jim Chen [:jchen] [:darchons]]

Attachment: Patch for Beta (v1)

Comment 24

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e1604afddd41

Comment 25

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/81b1e4ba20f2