1268909 - Read failblog, crash Firefox for Android

Status: RESOLVED INCOMPLETE

(Firefox for Android Graveyard :: General, defect)

Description

[Benjamin Smedberg]

I've been seeing lots of Firefox for Android crashes over the past... few months? I couldn't detect a pattern for a long time, and the crash reports pointed at existing bugs without a lot of technical detail. But more recently I've figured out the pattern!

Environment:
* Firefox for Android, beta channel
* I can reproduce on both a Galaxy Note 5 and a Nexus 7, and I think on a Galaxy S4 before I switched

STR:
* Open failblog.cheezburger.com/parenting
* Play a few cute videos (this may be required; I'm not sure)
* Click "next" and keep reading
* If you don't like /parenting, you might find /school and /win amusing enough until you crash
* After reading for a few "next" pages, Firefox will crash. This appears to be very reliable.

Here's a list of the crash reports I personally have reproduced with this:

Crash ID 	Date 	Signature 	Version 	User comments
487436b8-326f-4c4b-bdfc-b55232160414 	2016-04-14 02:07:53 	EMPTY: no crashing thread identified; ERROR_NO_THREAD_LIST   46.0b10 	bsmedberg. failblog causes this
93f97996-475f-4c7c-b28f-5b8822160415 	2016-04-15 02:21:23 	android.database.CursorWindowAllocationException: Cursor window allocation of 2048 kb failed. # Open Cursors=1 (# cursors opened by this proc=1) at android.database.CursorWindow.<init>(CursorWindow.java)   46.0b10 	bsmedberg
c53dfcbd-5369-4514-9ff8-e85362160226 	2016-02-26 02:18:35 	EMPTY: no crashing thread identified; ERROR_NO_MINIDUMP_HEADER   45.0b9 	bsmedberg
046e3c62-9518-4396-be5b-9c7802160416 	2016-04-16 23:33:09 	libhwui.so@0x6ef7a   46.0b10 	bsmedberg failblog
06e3d024-fa85-4b9d-adfb-4786d2160209 	2016-02-09 00:28:08 	java.lang.IllegalStateException: at android.database.sqlite.SQLiteClosable.acquireReference(SQLiteClosable.java)   45.0b3 	bsmedberg
d0a7bb88-1a5f-4f5a-8cb0-264092160226 	2016-02-26 02:04:34 	EMPTY: no crashing thread identified; ERROR_NO_MINIDUMP_HEADER   45.0b9 	bsmedberg
b70a60c4-de44-426b-ab81-476102160301 	2016-03-01 01:02:38 	java.lang.IllegalStateException: at android.database.sqlite.SQLiteClosable.acquireReference(SQLiteClosable.java)   45.0b9 	bsmedberg
f93975b2-5c43-4e17-afa6-96c702160225 	2016-02-25 01:30:53 	EMPTY: no crashing thread identified; ERROR_NO_MINIDUMP_HEADER   45.0b6 	bsmedberg
1db57006-a46d-4208-954f-c5fdb2160317 	2016-03-17 11:18:14 	android.database.CursorWindowAllocationException: Cursor window allocation of 2048 kb failed. # Open Cursors=1 (# cursors opened by this proc=1) at android.database.CursorWindow.<init>(CursorWindow.java)   46.0b1 	bsmedberg 

My memory is now fuzzy, but ISTR this started with Firefox 43 beta, although that may have been a change in the cheezburger website instead of Firefox.

snorp, I know this is related to bug 1245570 which you own. Margaret the signature from bug 760394 which you have talked about is also present. Please let me know if there are other ways I can help.

Comment 1

[James Willcox (:snorp) ([e-mail]) (he/him)]

I think the cursor window one is basically another manifestation of 1164027 (address space exhaustion). The SQLiteCloseable one should be fixed in 46 (bug 1254468), so if you are still seeing that one it's not good.

I think one contributing factor here is that when you play a video, a whole bunch of media libraries get mapped in and never leave. Decoder sandboxing would help this. The 'empty crashing thread' one is just breakpad crashing somewhere while generating the report, but we have no idea where yet.

Can we get some QA folks to go through the STR and see how reproducible it is? I didn't get a crash on the couple devices I tried here. I went through to about page 5.

Comment 2

[Bogdan Surd, QA [:bsurd, NI]]

Hello, I have tested this on a HTC Desire 820 (Android 6.0.1) and a Asus Transformer Pad (4.2.1) on the current Beta(50.0b12) and Nightly(52.0.a1) builds and didn't experience any kind of problem. Went trough 12 pages, playing most of the videos on both devices and I was not able to reproduce a crash.

Comment 3

[BMO Automation]

We have completed our launch of our new Firefox on Android. The development of the new versions use GitHub for issue tracking. If the bug report still reproduces in a current version of [Firefox on Android nightly](https://play.google.com/store/apps/details?id=org.mozilla.fenix) an issue can be reported at the [Fenix GitHub project](https://github.com/mozilla-mobile/fenix/). If you want to discuss your report please use [Mozilla's chat](https://wiki.mozilla.org/Matrix#Connect_to_Matrix) server https://chat.mozilla.org and join the [#fenix](https://chat.mozilla.org/#/room/#fenix:mozilla.org) channel.