1476424 - Crash in android.os.TransactionTooLargeException: data parcel size 3124056 bytes at android.os.BinderProxy.transactNative(Native Method)

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is
report bp-4235e648-361e-4e49-b02a-083f80180717.
=============================================================

Seen while looking at trunk crash stats - crashes started using 20180717100050: https://bit.ly/2JvKCGz. There are also similar signatures with a data parcel size which is a different value: https://bit.ly/2LqHBZH. Very noticeable in this build.

Comments:
*crashed as soon as I started it. 

Top 10 frames of crashing thread:

0 libxul.so GeckoAppShellSupport::ReportJavaCrash widget/android/nsAppShell.cpp:280
1 libxul.so void mozilla::jni::NativeStub<mozilla::java::GeckoAppShell::ReportJavaCrash_t, GeckoAppShellSupport, mozilla::jni::Args<mozilla::jni::Ref<mozilla::jni::TypedObject<_jthrowable*>, _jthrowable*> const&, mozilla::jni::StringParam const&> >::Wrap<&GeckoAppShellSupport::ReportJavaCrash> widget/android/jni/Natives.h:778
2 base.odex base.odex@0x2286b 
3 dalvik-LinearAlloc (deleted) dalvik-LinearAlloc @0x4f6a 
4 libart.so libart.so@0x401775 
5 libart.so libart.so@0x4069ed 
6 base.vdex base.vdex@0x3b068e 
7 dalvik-LinearAlloc (deleted) dalvik-LinearAlloc @0x573a 
8 libart.so libart.so@0x3f047e 
9 libart.so libart.so@0x3f02b5 

=============================================================

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Petru, is this possibly fallout from the API26 work? Timing fits.

Comment 2

[Marcia Knous [:marcia]]

This signature moved up to the #17 top crash (I am not counting all the other individual signatures where the byte size is different). APIs from 28-26 are affected. Pixel/Pixel XL and Pixel 2/Pixel 2 XL are affected. Ioana - Can you try to see if you can reproduce the issue?

Other Comments:
*Lol I just download, open it and it's already crashed? 
*Literally just opened this after download. Didn't open anything. 
*I just opened settings!

Comment 3

[Ioana Chiorean]

Will investigate this together with Oana.

Comment 4

[Oana Horvath [:ohorvath - out of office]]

Reproducing on Nightly 2018-07-18 build.

STR:
1. Fresh install/clear app data.
2. Open Fennec.
3. Open the Settings menu.

Devices:
Google Pixel (Android 9)
Huawei Nexus 6P (Android 8.1.0)

Comment 5

[Oana Horvath [:ohorvath - out of office]]

Attachment: logcat.txt

Comment 6

[Marcia Knous [:marcia]]

I was also able to reproduce this on my Pixel, but only with a fresh install of Nightly (and following the STR in Comment 4).

Comment 7

[Marcia Knous [:marcia]]

Adding a few other of the top volume signatures.

Comment 8

[Andrei Lazar]

Attachment: Bug 1476424 Crash in android.os.TransactionTooLargeException: data parcel size 3124056 bytes at android.os.BinderProxy.transactNative(Native Method)

Upon saving the state of onboarding fragments, the bundle can exceed 3MB because of the bitmaps.
Therefore, now we pass a resources id instead of passing the full bitmap through the bundle.

Review commit: https://reviewboard.mozilla.org/r/258764/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/258764/

Comment 10

[(inactive) Jim Chen [:jchen] [:darchons]]

Comment on attachment 8994151 [details]
Bug 1476424 Crash in android.os.TransactionTooLargeException: data parcel size 3124056 bytes at android.os.BinderProxy.transactNative(Native Method)

https://reviewboard.mozilla.org/r/258764/#review265790

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bf5ff5b3b3f2
Crash in android.os.TransactionTooLargeException: data parcel size 3124056 bytes at android.os.BinderProxy.transactNative(Native Method) r=jchen

Comment 12

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/bf5ff5b3b3f2

Comment 13

[Marcia Knous [:marcia]]

While it looks as if the crash signatures listed in this bug stopped after the fix in Comment 12, I am still seeing individual crash reports with similar signatures that persist after the landing - here are two examples that have Build IDs after the patch landed:

* https://crash-stats.mozilla.com/report/index/5bf252c5-6379-4ba9-8c69-5c2070180801
* https://crash-stats.mozilla.com/report/index/4fac85d3-03e0-4a22-a02e-fe3420180802

Andrei - Should I file a new bug to track these?

Comment 14

[Andrei Lazar]

Hey Marcia, after investigations made for this issue, [as per https://developer.android.com/reference/android/os/TransactionTooLargeException] I found out that a safe maximum size for these kinds of transactions would be somewhere around 1MB (depending on OS version, CPU architecture etc.) so the second crash it's a surprise for me [the one crashing with 0.7MB]. Indeed filing a new bug would be necessary, also some steps to reproduce would be extremly helpful for me, and thank you very much for keeping an eye on this!

Comment 15

[Marcia Knous [:marcia]]

Filed Bug 1480852 to track the signatures that are happening after the landing.