1349581 - Crash in java.lang.UnsatisfiedLinkError: at org.webrtc.voiceengine.WebRtcAudioRecord.nativeDataIsRecorded(Native Method)

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect, P1)

Description

[Marcia Knous [:marcia]]

[Tracking Requested - why for this release]: New crash which emerged in B1 that we should keep an eye on.

This bug was filed from the Socorro interface and is 
report bp-feba985f-2333-41d9-9c1e-ca0be2170322.
=============================================================

Seen while looking at the latest beta crash data: http://bit.ly/2o4M7kp

Crash started in B1 and has continued into B4.

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

This looks fairly important a crash using WebRTC on several devices. Most commonly the Galaxy S7. All the URLs are adult chatroulette style sites. Would be good to know if this reproduces on a clean WebRTC site such as https://appear.in/

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Good news everyone! Does not require visiting adult sites. 

STR:
1. On desktop open an https://appear.in session
2. Connect to the same session with your Android device, I used a Nexus 5x Android 7.1.2 (should be device independent)
3. Close the desktop tab
4. Crash on Android

Comment 3

[Marcia Knous [:marcia]]

Sebastian: Any idea who could own looking into this?

Comment 4

[Sebastian Kaspari (:sebastian; :pocmo)]

> java.lang.UnsatisfiedLinkError: No implementation found for void org.webrtc.voiceengine.WebRtcAudioRecord.nativeDataIsRecorded(int, long) (tried Java_org_webrtc_voiceengine_WebRtcAudioRecord_nativeDataIsRecorded and Java_org_webrtc_voiceengine_WebRtcAudioRecord_nativeDataIsRecorded__IJ)

Ouch.

We only have crash reports for Beta 53. I wonder if other versions are affected to and/or if this is a regression.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

Well, we could still take a patch for 53. Tracking.

Comment 6

[Kevin Brosnan [Ex-Mozilla]]

21:27.71 INFO: Last good revision: 935e36fde31c6ecd8321beb29d896e42a70aecd0
21:27.71 INFO: First bad revision: 126348e718d03dec640b30b5def70fce8aa71527
21:27.71 INFO: Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=935e36fde31c6ecd8321beb29d896e42a70aecd0&tochange=126348e718d03dec640b30b5def70fce8aa71527

21:28.08 INFO: Looks like the following bug has the changes which introduced the regression:
https://bugzilla.mozilla.org/show_bug.cgi?id=1250356

WebRTC.org library update was the cause of this crash.

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

gcp - any thoughts on this?
references to this are in media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc and media/webrtc/trunk/webrtc/modules/audio_device/android/java/src/org/webrtc/voiceengine/WebRtcAudioRecord.java

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Doesn't reproduce on my Nexus 4 on 5.1.1. I have a Galaxy S7 on 7.0, will see if it reproduces there.

Comment 9

[Gian-Carlo Pascutto [:gcp]]

Not reproducing on the S7 either, but this is Nightly. Will try beta.

Comment 10

[Gian-Carlo Pascutto [:gcp]]

Reproduces on beta. So that explains why the signatures are for 53 only: Nightly (and presumably Aurora) work fine.

Comment 11

[Gian-Carlo Pascutto [:gcp]]

Relevant code seems unchanged between Beta and Nightly.

I would like to bisect when it started working again, but there's many intermediate builds that break due to rust issues, so that's a pain.

Comment 12

[Randell Jesup [:jesup] (needinfo me)]

kbrosnan: can you bisect when this started working again in 54, per gcp's comments in comment 10 and comment 11?  Thanks

Comment 13

[Gian-Carlo Pascutto [:gcp]]

This was fixed by:

The first good revision is:
changeset:   361107:1079899f663f
user:        Alex Chronopoulos <[e-mail]>
date:        Wed Jan 25 10:47:09 2017 +0200
summary:     Bug 1333438: Pref on full duplex for Android. r=padenot

Is that change something you can consider uplifting, or does it have more dependencies?

Comment 14

[Wesley Huang [:wesley_huang] (EPM) (NI me)]

per triage meeting this happens on beta(53) only.

Comment 15

[Gian-Carlo Pascutto [:gcp]]

The relevant functions are registered/mapped in AudioRecordJni, which links AudioRecordJni::DataIsRecorded to nativeDataIsRecorded. That constructor is called when we set up the audio engine, and looks OK to me. I see it running in the logs, too:

D/JVM     ( 2611): JNIEnvironment::RegisterNatives(org/webrtc/voiceengine/WebRtcAudioRecord)
D/JVM     ( 2611): NativeRegistration::ctor@[tid=2957]
D/JVM     ( 2611): NativeRegistration::NewObject@[tid=2957]

And the function appears to be in libxul.so. Also, considering that the crash happens on closing a tab, we can suspect it's more likely to be a shutdown issue, rather than a missing setup. And indeed, VERBOSE logging shows:

D/AudioRecordJni( 2611): Terminate@[tid=2636]
D/AudioRecordJni( 2611): StopRecording@[tid=2636]
D/OpenSLESPlayer( 2611): Terminate@[tid=2636]
D/OpenSLESPlayer( 2611): StopPlayout@[tid=2636]
D/AudioManager( 2611): Close@[tid=2636]
D/WebRtcAudioManager( 2611): dispose@[name=Gecko, id=847]
D/AudioRecordJni( 2611): ~dtor@[tid=2636]
D/AudioRecordJni( 2611): Terminate@[tid=2636]
D/AudioRecordJni( 2611): StopRecording@[tid=2636]
D/JVM     ( 2611): GlobalRef::dtor@[tid=2636]
D/JVM     ( 2611): NativeRegistration::dtor@[tid=2636]
D/JVM     ( 2611): JNIEnvironment::dtor@[tid=2636]
D/JVM     ( 2611): AttachCurrentThreadIfNeeded::dtor@[tid=2636]
D/OpenSLESPlayer( 2611): dtor@[tid=2636]
D/OpenSLESPlayer( 2611): Terminate@[tid=2636]
D/OpenSLESPlayer( 2611): StopPlayout@[tid=2636]
D/OpenSLESPlayer( 2611): DestroyAudioPlayer
D/OpenSLESPlayer( 2611): DestroyMix
D/OpenSLESPlayer( 2611): DestroyEngine
D/AudioManager( 2611): ~dtor@[tid=2636]
D/AudioManager( 2611): Close@[tid=2636]
D/AudioManager( 2611): JavaAudioManager::dtor@[tid=2636]
D/JVM     ( 2611): GlobalRef::dtor@[tid=2636]
D/JVM     ( 2611): NativeRegistration::dtor@[tid=2636]
D/JVM     ( 2611): JNIEnvironment::dtor@[tid=2636]
D/JVM     ( 2611): AttachCurrentThreadIfNeeded::dtor@[tid=2636]
E/art     ( 2611): No implementation found for void org.webrtc.voiceengine.WebRtcAudioRecord.nativeDataIsRecorded(int, long) (tried Java_org_webrtc_voiceengine_WebRtcAudioRecord_nativeDataIsRecorded and Java_org_webrtc_voiceengine_WebRtcAudioRecord_nativeDataIsRecorded__IJ)

So, we've already shut down all audio engines, but something is still trying to call the (now deregistered) native method afterwards.

Comment 16

[Gian-Carlo Pascutto [:gcp]]

Or maybe the problem is that the shutdown functions seems to be called twice?

This NativeRegistration call is new, and in the above log seems to be called twice, for the same thread, on shutdown.

Comment 17

[Gian-Carlo Pascutto [:gcp]]

media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.h
123:  rtc::scoped_ptr<JNIEnvironment> j_environment_;

media/webrtc/trunk/webrtc/modules/audio_device/android/audio_manager.h
137:  rtc::scoped_ptr<JNIEnvironment> j_environment_;

I think this is the root problem: there are two of these for the current thread (2611) in the log above. They're scoped_ptrs, who upon destruction will call:

  jni_->UnregisterNatives(j_class_);

I'm not sure what the ownership model is actually supposed to be, though.

Comment 18

[Gian-Carlo Pascutto [:gcp]]

padenot pointed out the Java stack in the crash report shows the thread is still alive:

org.webrtc.voiceengine.WebRtcAudioRecord$AudioRecordThread.run(WebRtcAudioRecord.java:84)

Looking at the impl ofAudioRecordJni::StopRecording that's surprising, since it sets a stop flag and then synchronously waits for the thread to exit.

Comment 19

[Gian-Carlo Pascutto [:gcp]]

Logging in the Java code, I don't see the stopRecording there actually being called:

D/WebRtcAudioRecord(12699): startRecording
D/WebRtcAudioRecord(12699): AudioRecordThread@[name=AudioRecordJavaThread, id=549]
E/WebRtcAudioRecord(12699): AudioRecord entering thread
D/WebRtcAudioRecord(12699): ctor@[name=Gecko, id=517

Comment 20

[Gian-Carlo Pascutto [:gcp]]

I made StopRecording print the state of initialized_ and recording_:

D/AudioRecordJni(13874): AttachAudioBuffer
D/AudioRecordJni(13874): SetRecordingSampleRate(48000)
D/AudioRecordJni(13874): SetRecordingChannels(1)
D/AudioRecordJni(13874): total_delay_in_milliseconds: 50
D/AudioManager(13874): Init@[tid=13897]
D/WebRtcAudioManager(13874): init@[name=Gecko, id=532]
D/WebRtcAudioManager(13874): audio mode is: MODE_NORMAL
D/OpenSLESPlayer(13874): Init@[tid=13897]
D/AudioRecordJni(13874): Init@[tid=13897]
D/AudioRecordJni(13874): Terminate@[tid=13897]
D/AudioRecordJni(13874): StopRecording@[tid=13897]
D/AudioRecordJni(13874): StopRecording init:0 record:0
D/OpenSLESPlayer(13874): Terminate@[tid=13897]
D/OpenSLESPlayer(13874): StopPlayout@[tid=13897]
D/AudioManager(13874): Close@[tid=13897]
D/WebRtcAudioManager(13874): dispose@[name=Gecko, id=532]
D/AudioRecordJni(13874): ~dtor@[tid=13897]
D/AudioRecordJni(13874): Terminate@[tid=13897]
D/AudioRecordJni(13874): StopRecording@[tid=13897]
D/AudioRecordJni(13874): StopRecording init:0 record:0

Where'd the StartRecording go, and how does the thread exist without it?

Comment 21

[Gian-Carlo Pascutto [:gcp]]

It looks like we're starting the audio subsystem twice, from different threads, and only one of them gets the StartRecording call, and StopRecording gets sent to the other one.

https://pastebin.mozilla.org/8983517

D/AudioManager(15305): JavaAudioManager::ctor@[tid=15679]
D/AudioRecordJni(15305): Init@[tid=15679]
D/AudioRecordJni(15305): StartRecording@[tid=15679]
...
D/AudioManager(15305): Init@[tid=15336]
D/OpenSLESPlayer(15305): Init@[tid=15336]
D/AudioRecordJni(15305): Init@[tid=15336]
D/AudioRecordJni(15305): StopRecording@[tid=15336]

At this point StopRecording bails early because it hasn't ever seen itself start the recording Java thread (so it thinks it isn't running), and then goes on to delete the link with the native objects. Boom!

Comment 22

[Gian-Carlo Pascutto [:gcp]]

Breakpoint 2, webrtc::AudioRecordJni::JavaAudioRecord::StartRecording (this=0x877fbf80)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc:52
52      bool AudioRecordJni::JavaAudioRecord::StartRecording() {
(gdb) bt
#0  webrtc::AudioRecordJni::JavaAudioRecord::StartRecording (this=0x877fbf80)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc:52
#1  0xa0a0fddc in webrtc::AudioRecordJni::StartRecording (this=0x87856bc8)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc:154
#2  0xa0a17a0a in webrtc::AudioDeviceTemplate<webrtc::AudioRecordJni, webrtc::OpenSLESPlayer>::StartRecording (
    this=0x87856b00)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_template.h:189
#3  0xa0a1506e in webrtc::AudioDeviceModuleImpl::StartRecording (this=<optimized out>)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_impl.cc:1551
#4  0xa0a43ff2 in webrtc::VoEBaseImpl::StartSend (this=this@entry=0x86a8f0c0)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/voice_engine/voe_base_impl.cc:639
#5  0xa0a44110 in webrtc::VoEBaseImpl::StartSend (this=0x86a8f0c0, channel=<optimized out>)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/voice_engine/voe_base_impl.cc:555
#6  0x9f7f1418 in mozilla::MediaEngineWebRTCMicrophoneSource::Start (this=0x8c596ce0, aStream=0x8aec66b0, 
    aID=2, aPrincipalHandle=...) at /home/morbo/hg/firefox/dom/media/webrtc/MediaEngineWebRTCAudio.cpp:467
#7  0x9f61be86 in mozilla::MediaOperationTask::Run (this=0x8b156c00)
    at /home/morbo/hg/firefox/dom/media/MediaManager.cpp:509
#8  0x9d85ec24 in nsThread::ProcessNextEvent (this=0x8875f460, aMayWait=<optimized out>, aResult=0x889c5c57)
    at /home/morbo/hg/firefox/xpcom/threads/nsThread.cpp:1269
#9  0x9d861d0a in NS_ProcessNextEvent (aThread=0x8875f460, aMayWait=<optimized out>)
    at /home/morbo/hg/firefox/xpcom/threads/nsThreadUtils.cpp:389
#10 0x9dcd9588 in mozilla::ipc::MessagePumpForNonMainThreads::Run (this=0x887e8040, aDelegate=0x889c5cdc)
    at /home/morbo/hg/firefox/ipc/glue/MessagePump.cpp:368
#11 0x9dc80622 in MessageLoop::RunInternal (this=this@entry=0x889c5cdc)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/message_loop.cc:238
#12 0x9dc8063a in MessageLoop::RunHandler (this=this@entry=0x889c5cdc)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/message_loop.cc:231
#13 0x9dc80650 in MessageLoop::Run (this=0x889c5cdc)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/message_loop.cc:211
#14 0x9dc94c9e in base::Thread::ThreadMain (this=0x864fd880)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/thread.cc:179
#15 0x9dc910f8 in ThreadFunc (closure=<optimized out>)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/platform_thread_posix.cc:38


Breakpoint 1, webrtc::AudioRecordJni::StopRecording (this=this@entry=0x847d4fc8)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc:162
162     int32_t AudioRecordJni::StopRecording() {
(gdb) bt
#0  webrtc::AudioRecordJni::StopRecording (this=this@entry=0x847d4fc8)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc:162
#1  0xa0a10042 in webrtc::AudioRecordJni::Terminate (this=0x847d4fc8)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_record_jni.cc:125
#2  0xa0a18ec6 in webrtc::AudioDeviceTemplate<webrtc::AudioRecordJni, webrtc::OpenSLESPlayer>::Terminate (
    this=0x847d4f00)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/android/audio_device_template.h:80
#3  0xa0a14744 in webrtc::AudioDeviceModuleImpl::Terminate (this=0x847db000)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/modules/audio_device/audio_device_impl.cc:565
#4  0xa0a4066e in webrtc::VoEBaseImpl::TerminateInternal (this=this@entry=0x886120c0)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/voice_engine/voe_base_impl.cc:695
#5  0xa0a40772 in webrtc::VoEBaseImpl::Terminate (this=0x886120c0)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/voice_engine/voe_base_impl.cc:386
#6  0xa0a488d6 in webrtc::VoiceEngineImpl::Release (this=0x88612000)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/voice_engine/voice_engine_impl.cc:61
#7  0xa0a48dc4 in webrtc::VoiceEngine::Delete (voiceEngine=@0x844d1fbc: 0x88612000)
    at /home/morbo/hg/firefox/media/webrtc/trunk/webrtc/voice_engine/voice_engine_impl.cc:126
#8  0xa0e63720 in mozilla::WebrtcAudioConduit::~WebrtcAudioConduit (this=this@entry=0x844d1fb0, 
    __in_chrg=<optimized out>)
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp:112
#9  0xa0e63a9c in mozilla::WebrtcAudioConduit::~WebrtcAudioConduit (this=0x844d1fb0, __in_chrg=<optimized out>)
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp:114
#10 0xa0eb5d50 in Release (this=0x844d1fb0)
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/media-conduit/MediaConduitInterface.h:283
#11 Release (aPtr=0x844d1fb0) at /home/morbo/hg/firefox/objdir-android/dist/include/mozilla/RefPtr.h:40
#12 Release (aPtr=0x844d1fb0) at /home/morbo/hg/firefox/objdir-android/dist/include/mozilla/RefPtr.h:395
#13 ~RefPtr (this=0x847f3398, __in_chrg=<optimized out>)
    at /home/morbo/hg/firefox/objdir-android/dist/include/mozilla/RefPtr.h:78
#14 ~pair (this=0x847f3394, __in_chrg=<optimized out>)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/utility:248
#15 ~pair (this=0x847f3390, __in_chrg=<optimized out>)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/utility:248
#16 ~__value_type (this=0x847f3390, __in_chrg=<optimized out>)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/map:617
#17 __destroy<std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > > > (__p=0x847f3390)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/memory:1589
#18 destroy<std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > > > (__p=0x847f3390, __a=...)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/memory:1487
#19 std::__ndk1::__tree<std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > >, std::__ndk1::__map_value_compare<unsigned int, std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > >, std::__ndk1::less<unsigned int>, true>, std::__ndk1::allocator<std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > > > >::destroy (this=this@entry=0x8b1172a0, __nd=0x847f3380)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/__tree:1445
#20 0xa0eb5d72 in std::__ndk1::__tree<std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > >, std::__ndk1::__map_value_compare<unsigned int, std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > >, std::__ndk1::less<unsigned int>, true>, std::__ndk1::allocator<std::__ndk1::__value_type<unsigned int, std::__ndk1::pair<bool, RefPtr<mozilla::MediaSessionConduit> > > > >::~__tree (this=0x8b1172a0, __in_chrg=<optimized out>)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/__tree:1433
#21 0xa0eb8bdc in ~map (this=0x8b1172a0, __in_chrg=<optimized out>)
    at /home/morbo/android-ndk-r11c/sources/cxx-stl/llvm-libc++/libcxx/include/map:783
#22 mozilla::PeerConnectionMedia::~PeerConnectionMedia (this=0x8b117200, __in_chrg=<optimized out>)
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h:232
#23 0xa0eb8de4 in mozilla::PeerConnectionMedia::~PeerConnectionMedia (this=0x8b117200, 
    __in_chrg=<optimized out>)
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h:234
#24 0xa0eb42f8 in mozilla::PeerConnectionMedia::Release (this=0x8b117200)
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.h:602
#25 0xa0eaebc6 in mozilla::PeerConnectionMedia::SelfDestruct_m (this=0x8b117200)
---Type <return> to continue, or q <return> to quit---
    at /home/morbo/hg/firefox/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp:1093
#26 0xa0eb305a in apply<mozilla::PeerConnectionMedia*, void (mozilla::PeerConnectionMedia::*)()> (args=..., 
    method=
    (void (mozilla::PeerConnectionMedia::*)(mozilla::PeerConnectionMedia * const)) 0xa0eaeae5 <mozilla::PeerConnectionMedia::SelfDestruct_m()>, obj=<optimized out>)
    at /home/morbo/hg/firefox/media/mtransport/runnable_utils.h:102
#27 mozilla::runnable_args_memfn<mozilla::PeerConnectionMedia*, void (mozilla::PeerConnectionMedia::*)()>::Run
    (this=<optimized out>) at /home/morbo/hg/firefox/media/mtransport/runnable_utils.h:170
#28 0x9d85ec24 in nsThread::ProcessNextEvent (this=0xa347e0e0, aMayWait=<optimized out>, aResult=0xaf8857cf)
    at /home/morbo/hg/firefox/xpcom/threads/nsThread.cpp:1269
#29 0x9d861d0a in NS_ProcessNextEvent (aThread=0xa347e0e0, aMayWait=<optimized out>)
    at /home/morbo/hg/firefox/xpcom/threads/nsThreadUtils.cpp:389
#30 0x9dcd9158 in mozilla::ipc::MessagePump::Run (this=0xa341b250, aDelegate=0xa3470060)
    at /home/morbo/hg/firefox/ipc/glue/MessagePump.cpp:96
#31 0x9dc80622 in MessageLoop::RunInternal (this=this@entry=0xa3470060)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/message_loop.cc:238
#32 0x9dc8063a in MessageLoop::RunHandler (this=this@entry=0xa3470060)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/message_loop.cc:231
#33 0x9dc80650 in MessageLoop::Run (this=0xa3470060)
    at /home/morbo/hg/firefox/ipc/chromium/src/base/message_loop.cc:211
#34 0x9fcf9cbe in nsBaseAppShell::Run (this=0x8fa84900) at /home/morbo/hg/firefox/widget/nsBaseAppShell.cpp:156
#35 0xa0d2977e in nsAppStartup::Run (this=0x91a323a0)
    at /home/morbo/hg/firefox/toolkit/components/startup/nsAppStartup.cpp:283
#36 0xa0dcab68 in XREMain::XRE_mainRun (this=this@entry=0xaf8859d0)
    at /home/morbo/hg/firefox/toolkit/xre/nsAppRunner.cpp:4512
#37 0xa0dcba0c in XREMain::XRE_main (this=this@entry=0xaf8859d0, argc=argc@entry=6, 
    argv=argv@entry=0xa340b7e0, aConfig=...) at /home/morbo/hg/firefox/toolkit/xre/nsAppRunner.cpp:4692
#38 0xa0dcbc6a in XRE_main (argc=6, argv=0xa340b7e0, aConfig=...)
    at /home/morbo/hg/firefox/toolkit/xre/nsAppRunner.cpp:4783
#39 0xa0dce7dc in GeckoStart (env=<optimized out>, argv=0xa340b7e0, argc=6, aAppData=...)
    at /home/morbo/hg/firefox/toolkit/xre/nsAndroidStartup.cpp:50
#40 0xa0dd3a42 in mozilla::BootstrapImpl::GeckoStart (this=<optimized out>, aEnv=<optimized out>, 
    argv=<optimized out>, argc=<optimized out>, aAppData=...)
    at /home/morbo/hg/firefox/toolkit/xre/Bootstrap.cpp:74
#41 0xafac17ba in Java_org_mozilla_gecko_mozglue_GeckoLoader_nativeRun (jenv=0xb7718808, jc=<optimized out>, 
    jargs=<optimized out>, crashFd=-1, ipcFd=-1) at /home/morbo/hg/firefox/mozglue/android/APKOpen.cpp:435

Comment 23

[Randell Jesup [:jesup] (needinfo me)]

Attachment: defer nativeRegistration for android Jni to avoid thread issues

this is worth a try... - gcp, can you try it?

Comment 24

[Randell Jesup [:jesup] (needinfo me)]

Attachment: defer nativeRegistration for android Jni to avoid thread issues

fixed a build issue -- Try https://treeherder.mozilla.org/#/jobs?repo=try&revision=c5c93eb5a880a5d34b3ac695247d066227c5fdf1

Comment 25

[Randell Jesup [:jesup] (needinfo me)]

patch Tested on Beta (and on Nightly with full-duplex disabled) (Samsung G7).  No crashes.

Comment 26

[Gian-Carlo Pascutto [:gcp]]

Comment on attachment 8853471 [details] [diff] [review]
defer nativeRegistration for android Jni to avoid thread issues

Review of attachment 8853471 [details] [diff] [review]:
-----------------------------------------------------------------

I presume you checked all methods that use j_audio_record_.

Comment 27

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2f38397908ce
defer nativeRegistration for android Jni to avoid thread issues r=gcp

Comment 28

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 8853471 [details] [diff] [review]
defer nativeRegistration for android Jni to avoid thread issues

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1250356

[User impact if declined]: crashes in common cases in webrtc on android

[Is this code covered by automated tests?]: no

[Has the fix been verified in Nightly?]: by hand in local nightly and beta builds

[Needs manual test from QE? If yes, steps to reproduce]: See comments on bug for steps (basically, get into call, have the other end close the tab).

[List of other uplifts needed for the feature/fix]: none

[Is the change risky?]: no

[Why is the change risky/not risky?]: simple deferment of object creation, with runtime checks.

[String changes made/needed]: none


Landing on Nightly on Aurora in case we (or the user) turns full_duplex off.

Comment 29

[Randell Jesup [:jesup] (needinfo me)]

54/55 -> disabled since default for full-duplex on them is "on" for android

Comment 30

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/2f38397908ce

Comment 31

[Randell Jesup [:jesup] (needinfo me)]

disabled->affected because we might switch the default before release; we want the uplift to 54

Comment 32

[Randell Jesup [:jesup] (needinfo me)]

This is a pretty serious problem in 53 for Android.  The other side killing a connection/tab/navigating-away is not an uncommon case.

Comment 33

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8853471 [details] [diff] [review]
defer nativeRegistration for android Jni to avoid thread issues

This seems to crop up for the first time in beta 53, let's uplift and avoid shipping the crash issue to release.

Comment 34

[Randell Jesup [:jesup] (needinfo me)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/632c2b8c17297a8d4c70fc33a518808d81fc18c7
https://hg.mozilla.org/releases/mozilla-beta/rev/ad3b4d7ad2830000553da75c1887181d8add89ef