Closed Bug 1644561 Opened 4 years ago Closed 4 years ago

org.mozilla.reference.browser.debug Abort message: 'java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: use of deleted local reference 0xe5e5e5e5e5e5e5e5'

Categories

(GeckoView :: General, defect, P1)

Product:
GeckoView
Component:
General
Platform:
Unspecified
All
Type:
defect

Tracking

(firefox77 unaffected, firefox78 unaffected, firefox79 fixed)

Status:
RESOLVED FIXED
Milestone:
mozilla79
Tracking Flags:
Tracking Status
firefox77 --- unaffected
firefox78 --- unaffected
firefox79 --- fixed

People

(Reporter: aryx, Assigned: agi)

References

(Regression)

Details

(Keywords: csectype-uaf, regression, sec-high, Whiteboard: [geckoview:m79][fxr:p1][post-critsmash-triage])

Attachments

(3 files)

log.txt
257.71 KB, text/plain
Details
Bug 1644561 - Verify that mCapturePixelsResults is not empty.
47 bytes, text/x-phabricator-request
tjr
: sec-approval+
Details | Review
Bug 1644561 - Add stress test for capturePixels().
47 bytes, text/x-phabricator-request
tjr
: sec-approval+
Details | Review
Attached file log.txt —

reference-browser's ui-test-x86 task crashed during the execution of closeAllPrivateTabsTest:

Firebase log (might be inaccessible to you, see attached log instead): https://console.firebase.google.com/project/moz-reference-browser-230023/testlab/histories/bh.b4e77beaed81bc1c/matrices/5697564772749494586/executions/bs.fe571cf653bee7b2/issues

     *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'google/walleye/walleye:9/PQ3A.190801.002/5670241:user/release-keys'
Revision: 'MP1'
ABI: 'arm64'
pid: 13253, tid: 13253, name: e.browser.debug  >>> org.mozilla.reference.browser.debug <<<
signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
Abort message: 'java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: use of deleted local reference 0xe5e5e5e5e5e5e5e5'
    x0  0000000000000000  x1  00000000000033c5  x2  0000000000000006  x3  0000000000000008
    x4  fefeff71c5c21667  x5  fefeff71c5c21667  x6  fefeff71c5c21667  x7  7f7f7f7fffff7f7f
    x8  0000000000000083  x9  00000072c89789a0  x10 fffffff87ffffbdf  x11 0000000000000001
    x12 ffffffffffffefff  x13 ffffffffffffffff  x14 ffffffffff000000  x15 ffffffffffffffff
    x16 00000072c89b12c8  x17 00000072c88ef2d8  x18 0000007fca19c49a  x19 00000000000033c5
    x20 00000000000033c5  x21 0000000000000083  x22 0000007246814c00  x23 000000723cb53c40
    x24 0000000000000014  x25 0000000000000012  x26 0000000000000005  x27 000000724661bbf3
    x28 000000724661baa7  x29 0000007fca19d220
    sp  0000007fca19d1e0  lr  00000072c88e3a90  pc  00000072c88e3abc

06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: use of deleted local reference 0xe5e5e5e5e5e5e5e5
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] from long org.mozilla.gecko.GeckoThread.runUiThreadCallback()
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] "main" prio=5 tid=1 Runnable
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] | group="main" sCount=0 dsCount=0 flags=0 obj=0x75034910 self=0x7246814c00
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] | sysTid=13253 nice=-10 cgrp=default sched=0/0 handle=0x72cc1cb548
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] | state=R schedstat=( 4027402546 152291869 1685 ) utm=389 stm=12 core=5 HZ=100
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] | stack=0x7fc99a7000-0x7fc99a9000 stackSize=8MB
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] | held mutexes= "mutator lock"(shared held)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #00 pc 00000000003c7324 /system/lib64/libart.so (art::DumpNativeStack(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, int, BacktraceMap*, char const*, art::ArtMethod*, void*, bool)+220)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #01 pc 0000000000495dc0 /system/lib64/libart.so (art::Thread::DumpStack(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, bool, BacktraceMap*, bool) const+352)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #02 pc 00000000002e85ac /system/lib64/libart.so (art::JavaVMExt::JniAbort(char const*, char const*)+972)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #03 pc 00000000002e8abc /system/lib64/libart.so (art::JavaVMExt::JniAbortF(char const*, char const*, ...)+180)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #04 pc 000000000049bab4 /system/lib64/libart.so (art::Thread::DecodeJObject(_jobject*) const+708)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #05 pc 00000000000fca80 /system/lib64/libart.so (art::(anonymous namespace)::ScopedCheck::CheckInstance(art::ScopedObjectAccess&, art::(anonymous namespace)::ScopedCheck::InstanceKind, _jobject*, bool)+96)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #06 pc 00000000000fbd74 /system/lib64/libart.so (art::(anonymous namespace)::ScopedCheck::CheckPossibleHeapValue(art::ScopedObjectAccess&, char, art::(anonymous namespace)::JniValueType)+580)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #07 pc 00000000000fb31c /system/lib64/libart.so (art::(anonymous namespace)::ScopedCheck::Check(art::ScopedObjectAccess&, bool, char const*, art::(anonymous namespace)::JniValueType*)+628)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #08 pc 00000000000fe2fc /system/lib64/libart.so (art::(anonymous namespace)::CheckJNI::NewRef(char const*, _JNIEnv*, _jobject*, art::IndirectRefKind)+684)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #09 pc 0000000002580f40 /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (nsWindow::LayerViewSupport::RecvScreenPixels(mozilla::ipc::Shmem&&, mozilla::gfx::IntSizeTyped<mozilla::ScreenPixel> const&)+524)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #10 pc 0000000002580d2c /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (nsWindow::RecvScreenPixels(mozilla::ipc::Shmem&&, mozilla::gfx::IntSizeTyped<mozilla::ScreenPixel> const&)+76)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #11 pc 0000000001313674 /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (mozilla::layers::UiCompositorControllerChild::RecvScreenPixels(mozilla::ipc::Shmem&&, mozilla::gfx::IntSizeTyped<mozilla::ScreenPixel> const&)+24)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #12 pc 0000000003907a1c /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (mozilla::layers::PUiCompositorControllerChild::OnMessageReceived(IPC::Message const&)+1396)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #13 pc 000000000335922c /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)+716)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #14 pc 0000000003359e64 /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (mozilla::ipc::MessageChannel::MessageTask::Run()+328)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #15 pc 000000000400e5ec /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/lib/arm64/libxul.so (_ZN7mozilla3jni10NativeStubINS_4java11GeckoThread21RunUiThreadCallback_tE18GeckoThreadSupportNS0_4ArgsIJEEEE4WrapIXadL_ZNS5_19RunUiThreadCallbackEvEEEElP7_JNIEnvP7_jclass+340)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #16 pc 0000000000565be0 /system/lib64/libart.so (art_quick_generic_jni_trampoline+144)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #17 pc 000000000055ce4c /system/lib64/libart.so (art_quick_invoke_static_stub+604)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #18 pc 00000000000cf760 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #19 pc 00000000002823b0 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #20 pc 000000000027c36c /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+948)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #21 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #22 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #23 pc 0000000000286202 /dev/ashmem/dalvik-classes3.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug-63PcNl46TCdonI-n7IvvaA==/base.apk!classes3.dex (deleted) (org.mozilla.gecko.GeckoThread$1.run+6)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #24 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #25 pc 000000000051cb58 /system/lib64/libart.so (artQuickToInterpreterBridge+1032)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #26 pc 0000000000565cfc /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #27 pc 0000000000038fa0 /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.Handler.handleCallback+64)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #28 pc 000000000000cfdc /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.Handler.dispatchMessage+60)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #29 pc 00000000000189f8 /dev/ashmem/dalvik-jit-code-cache (deleted) (androidx.test.espresso.base.Interrogator.loopAndInterrogate+424)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #30 pc 000000000055ce4c /system/lib64/libart.so (art_quick_invoke_static_stub+604)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #31 pc 00000000000cf760 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #32 pc 00000000002823b0 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #33 pc 000000000027c36c /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+948)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #34 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #35 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #36 pc 00000000000c0dee /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.base.UiControllerImpl.loopUntil+70)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #37 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #38 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #39 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #40 pc 000000000052d758 /system/lib64/libart.so (MterpInvokeDirect+296)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #41 pc 000000000054f214 /system/lib64/libart.so (ExecuteMterpImpl+14484)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #42 pc 00000000000c1958 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.base.UiControllerImpl.loopUntil+8)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #43 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #44 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #45 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #46 pc 000000000052d758 /system/lib64/libart.so (MterpInvokeDirect+296)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #47 pc 000000000054f214 /system/lib64/libart.so (ExecuteMterpImpl+14484)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #48 pc 00000000000c11b6 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.base.UiControllerImpl.injectMotionEvent+102)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #49 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #50 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #51 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #52 pc 000000000052d390 /system/lib64/libart.so (MterpInvokeInterface+1392)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #53 pc 000000000054f314 /system/lib64/libart.so (ExecuteMterpImpl+14740)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #54 pc 00000000000b81c2 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.action.MotionEvents.sendUp+34)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #55 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #56 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #57 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #58 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #59 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #60 pc 00000000000b8186 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.action.MotionEvents.sendUp+34)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #61 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #62 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #63 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #64 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #65 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #66 pc 00000000000b9314 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.action.Tap.sendSingleTap+32)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #67 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #68 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #69 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #70 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #71 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #72 pc 00000000000b92d8 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.action.Tap.access$100)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #73 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #74 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #75 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #76 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #77 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #78 pc 00000000000b9092 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.action.Tap$1.sendTap+2)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #79 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #80 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #81 pc 000000000027d45c /system/lib64/libart.so (bool art::interpreter::DoCall<true, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+724)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #82 pc 000000000052ebfc /system/lib64/libart.so (MterpInvokeInterfaceRange+1388)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #83 pc 000000000054f614 /system/lib64/libart.so (ExecuteMterpImpl+15508)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #84 pc 00000000000b6b08 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.action.GeneralClickAction.perform+108)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #85 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #86 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #87 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #88 pc 000000000052d390 /system/lib64/libart.so (MterpInvokeInterface+1392)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #89 pc 000000000054f314 /system/lib64/libart.so (ExecuteMterpImpl+14740)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #90 pc 00000000000b45c4 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.ViewInteraction$SingleExecutionViewAction.perform+20)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #91 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #92 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #93 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #94 pc 000000000052c418 /system/lib64/libart.so (MterpInvokeVirtual+584)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #95 pc 000000000054f114 /system/lib64/libart.so (ExecuteMterpImpl+14228)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #96 pc 00000000000b5566 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.ViewInteraction.doPerform+314)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #97 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #98 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #99 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #100 pc 000000000052d758 /system/lib64/libart.so (MterpInvokeDirect+296)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #101 pc 000000000054f214 /system/lib64/libart.so (ExecuteMterpImpl+14484)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #102 pc 00000000000b536c /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.ViewInteraction.access$100)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #103 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #104 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #105 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #106 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #107 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #108 pc 00000000000b4374 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.ViewInteraction$1.call+8)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #109 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #110 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #111 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #112 pc 000000000052c418 /system/lib64/libart.so (MterpInvokeVirtual+584)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #113 pc 000000000054f114 /system/lib64/libart.so (ExecuteMterpImpl+14228)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #114 pc 00000000000b4350 /dev/ashmem/dalvik-classes.dex extracted in memory from /data/app/org.mozilla.reference.browser.debug.test--r90dJF_qWBIr4rji00ZiQ==/base.apk (deleted) (androidx.test.espresso.ViewInteraction$1.call)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #115 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #116 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #117 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #118 pc 000000000052d390 /system/lib64/libart.so (MterpInvokeInterface+1392)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #119 pc 000000000054f314 /system/lib64/libart.so (ExecuteMterpImpl+14740)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #120 pc 0000000000113156 /system/framework/boot.vdex (java.util.concurrent.FutureTask.run+62)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #121 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #122 pc 000000000051cb58 /system/lib64/libart.so (artQuickToInterpreterBridge+1032)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #123 pc 0000000000565cfc /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #124 pc 0000000000038fa0 /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.Handler.handleCallback+64)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #125 pc 000000000000cfdc /dev/ashmem/dalvik-jit-code-cache (deleted) (android.os.Handler.dispatchMessage+60)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #126 pc 000000000055cb88 /system/lib64/libart.so (art_quick_invoke_stub+584)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #127 pc 00000000000cf740 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #128 pc 00000000002823b0 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #129 pc 000000000027c36c /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+948)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #130 pc 000000000052c418 /system/lib64/libart.so (MterpInvokeVirtual+584)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #131 pc 000000000054f114 /system/lib64/libart.so (ExecuteMterpImpl+14228)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #132 pc 0000000000aecb18 /system/framework/boot-framework.vdex (android.os.Looper.loop+404)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #133 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #134 pc 000000000025b9e8 /system/lib64/libart.so (art::interpreter::ArtInterpreterToInterpreterBridge(art::Thread*, art::CodeItemDataAccessor const&, art::ShadowFrame*, art::JValue*)+216)
06-09 10:31:30.570: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #135 pc 000000000027c350 /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+920)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #136 pc 000000000052d91c /system/lib64/libart.so (MterpInvokeStatic+204)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #137 pc 000000000054f294 /system/lib64/libart.so (ExecuteMterpImpl+14612)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #138 pc 0000000000385b8a /system/framework/boot-framework.vdex (android.app.ActivityThread.main+214)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #139 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #140 pc 000000000051cb58 /system/lib64/libart.so (artQuickToInterpreterBridge+1032)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #141 pc 0000000000565cfc /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #142 pc 000000000055ce4c /system/lib64/libart.so (art_quick_invoke_static_stub+604)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #143 pc 00000000000cf760 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #144 pc 00000000004633b8 /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #145 pc 0000000000464e10 /system/lib64/libart.so (art::InvokeMethod(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jobject*, _jobject*, unsigned long)+1440)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #146 pc 00000000003f43b0 /system/lib64/libart.so (art::Method_invoke(_JNIEnv*, _jobject*, _jobject*, _jobjectArray*)+48)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #147 pc 000000000011e6d4 /system/framework/arm64/boot.oat (offset 114000) (java.lang.Class.getDeclaredMethodInternal [DEDUPED]+180)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #148 pc 000000000055cb88 /system/lib64/libart.so (art_quick_invoke_stub+584)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #149 pc 00000000000cf740 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+200)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #150 pc 00000000002823b0 /system/lib64/libart.so (art::interpreter::ArtInterpreterToCompiledCodeBridge(art::Thread*, art::ArtMethod*, art::ShadowFrame*, unsigned short, art::JValue*)+344)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #151 pc 000000000027c36c /system/lib64/libart.so (bool art::interpreter::DoCall<false, false>(art::ArtMethod*, art::Thread*, art::ShadowFrame&, art::Instruction const*, unsigned short, art::JValue*)+948)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #152 pc 000000000052c418 /system/lib64/libart.so (MterpInvokeVirtual+584)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #153 pc 000000000054f114 /system/lib64/libart.so (ExecuteMterpImpl+14228)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #154 pc 0000000000c0db2e /system/framework/boot-framework.vdex (com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run+22)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #155 pc 0000000000255e68 /system/lib64/libart.so (_ZN3art11interpreterL7ExecuteEPNS_6ThreadERKNS_20CodeItemDataAccessorERNS_11ShadowFrameENS_6JValueEb.llvm.2088410233+496)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #156 pc 000000000051cb58 /system/lib64/libart.so (artQuickToInterpreterBridge+1032)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #157 pc 0000000000565cfc /system/lib64/libart.so (art_quick_to_interpreter_bridge+92)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #158 pc 0000000000beb480 /system/framework/arm64/boot-framework.oat (offset 3cd000) (com.android.internal.os.ZygoteInit.main+3088)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #159 pc 000000000055ce4c /system/lib64/libart.so (art_quick_invoke_static_stub+604)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #160 pc 00000000000cf760 /system/lib64/libart.so (art::ArtMethod::Invoke(art::Thread*, unsigned int*, unsigned int, art::JValue*, char const*)+232)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #161 pc 00000000004633b8 /system/lib64/libart.so (art::(anonymous namespace)::InvokeWithArgArray(art::ScopedObjectAccessAlreadyRunnable const&, art::ArtMethod*, art::(anonymous namespace)::ArgArray*, art::JValue*, char const*)+104)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #162 pc 0000000000463010 /system/lib64/libart.so (art::InvokeWithVarArgs(art::ScopedObjectAccessAlreadyRunnable const&, _jobject*, _jmethodID*, std::__va_list)+416)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #163 pc 0000000000366854 /system/lib64/libart.so (art::JNI::CallStaticVoidMethodV(_JNIEnv*, _jclass*, _jmethodID*, std::__va_list)+644)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #164 pc 00000000000b1f30 /system/lib64/libandroid_runtime.so (_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...)+120)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #165 pc 00000000000b48b0 /system/lib64/libandroid_runtime.so (android::AndroidRuntime::start(char const*, android::Vector<android::String8> const&, bool)+760)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #166 pc 00000000000021a0 /system/bin/app_process64 (main+1200)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] native: #167 pc 00000000000ae760 /system/lib64/libc.so (__libc_init+88)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at org.mozilla.gecko.GeckoThread.runUiThreadCallback(Native method)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at org.mozilla.gecko.GeckoThread$1.run(GeckoThread.java:117)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at android.os.Handler.handleCallback(Handler.java:873)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at android.os.Handler.dispatchMessage(Handler.java:99)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.base.Interrogator.loopAndInterrogate(Interrogator.java:148)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.base.UiControllerImpl.loopUntil(UiControllerImpl.java:519)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.base.UiControllerImpl.loopUntil(UiControllerImpl.java:478)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.base.UiControllerImpl.injectMotionEvent(UiControllerImpl.java:235)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.action.MotionEvents.sendUp(MotionEvents.java:160)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.action.MotionEvents.sendUp(MotionEvents.java:137)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.action.Tap.sendSingleTap(Tap.java:170)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.action.Tap.access$100(Tap.java:31)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.action.Tap$1.sendTap(Tap.java:47)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.action.GeneralClickAction.perform(GeneralClickAction.java:136)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.ViewInteraction$SingleExecutionViewAction.perform(ViewInteraction.java:356)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.ViewInteraction.doPerform(ViewInteraction.java:248)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.ViewInteraction.access$100(ViewInteraction.java:63)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.ViewInteraction$1.call(ViewInteraction.java:153)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at androidx.test.espresso.ViewInteraction$1.call(ViewInteraction.java:150)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at java.util.concurrent.FutureTask.run(FutureTask.java:266)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at android.os.Handler.handleCallback(Handler.java:873)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at android.os.Handler.dispatchMessage(Handler.java:99)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at android.os.Looper.loop(Looper.java:193)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at android.app.ActivityThread.main(ActivityThread.java:6718)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at java.lang.reflect.Method.invoke(Native method)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
06-09 10:31:30.571: A/e.browser.debu(13253): java_vm_ext.cc:542] at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:858)

Group: core-security → mobile-core-security
Keywords: sec-high

Hi Snorp, can you please help find an assignee for this bug?

Flags: needinfo?(snorp)

It looks to me like nsWindow::RecvScreenPixels() is being called on a dead instance. That's not good.

Severity: -- → S2
Flags: needinfo?(snorp)
Priority: -- → P1
Whiteboard: [geckoview:m79]

Similar signature in https://github.com/mozilla-mobile/fenix/issues/11685 (closing/opening extension page): JNI ERROR (app bug): accessed stale local reference 0xe5e5e5e5 (index 31097 in a table of size 6)

Thanks for CC'ing me. Yes, similar JNI Error is surfacing in our UI x86 test-runs.

First 20 frames

06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] JNI DETECTED ERROR IN APPLICATION: use of deleted local reference 0xe5e5e5e5
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] from long org.mozilla.gecko.GeckoThread.runUiThreadCallback()
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] "main" prio=5 tid=1 Runnable
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] | group="main" sCount=0 dsCount=0 flags=0 obj=0x74571ee0 self=0xe54e2000
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] | sysTid=10168 nice=-10 cgrp=default sched=0/0 handle=0xea11d494
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] | state=R schedstat=( 7459577644 3443665154 5045 ) utm=724 stm=21 core=0 HZ=100
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] | stack=0xff4a2000-0xff4a4000 stackSize=8MB
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] | held mutexes= "mutator lock"(shared held)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #00 pc 004152f6 /system/lib/libart.so (art::DumpNativeStack(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, int, BacktraceMap*, char const*, art::ArtMethod*, void*, bool)+198)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #1 pc 0051048e /system/lib/libart.so (art::Thread::DumpStack(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, bool, BacktraceMap*, bool) const+382)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #2 pc 0050b743 /system/lib/libart.so (art::Thread::Dump(std::__1::basic_ostream<char, std::__1::char_traits<char>>&, bool, BacktraceMap*, bool) const+83)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #3 pc 0031a8b0 /system/lib/libart.so (art::JavaVMExt::JniAbort(char const*, char const*)+1088)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #4 pc 0031adc5 /system/lib/libart.so (art::JavaVMExt::JniAbortF(char const*, char const*, ...)+117)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #5 pc 00516c77 /system/lib/libart.so (art::Thread::DecodeJObject(_jobject*) const+871)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #6 pc 000d5559 /system/lib/libart.so (art::(anonymous namespace)::ScopedCheck::CheckInstance(art::ScopedObjectAccess&, art::(anonymous namespace)::ScopedCheck::InstanceKind, _jobject*, bool)+153)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #7 pc 000d47b7 /system/lib/libart.so (art::(anonymous namespace)::ScopedCheck::CheckPossibleHeapValue(art::ScopedObjectAccess&, char, art::(anonymous namespace)::JniValueType)+551)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #8 pc 000d3bdb /system/lib/libart.so (art::(anonymous namespace)::ScopedCheck::Check(art::ScopedObjectAccess&, bool, char const*, art::(anonymous namespace)::JniValueType*)+811)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #9 pc 000d6fa7 /system/lib/libart.so (art::(anonymous namespace)::CheckJNI::NewRef(char const*, _JNIEnv*, _jobject*, art::IndirectRefKind)+903)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #10 pc 000c030b /system/lib/libart.so (art::(anonymous namespace)::CheckJNI::NewGlobalRef(_JNIEnv*, _jobject*)+43)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #11 pc 0286e70d /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (txXSLKey::testNode(txXPathNode const&, txKeyValueHashKey&, nsTHashtable<txKeyValueHashEntry>&, txExecutionState&)+285)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #12 pc 0286e645 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (txXSLKey::testNode(txXPathNode const&, txKeyValueHashKey&, nsTHashtable<txKeyValueHashEntry>&, txExecutionState&)+85)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #13 pc 00fea712 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (mozilla::gfx::DuplicateEdges(mozilla::gfx::DataSourceSurface*, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)+1170)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #14 pc 009bfe69 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (void mozilla::ipc::WriteIPDLParam<mozilla::dom::HeadersGuardEnum const&>(IPC::Message*, mozilla::ipc::IProtocol*, mozilla::dom::HeadersGuardEnum const&&&)+25)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #15 pc 00783a3a /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (non-virtual thunk to nsFtpState::QueryInterface(nsID const&, void**)+26)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #16 pc 007828f0 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (nsFtpChannel::OpenContentStream(bool, nsIInputStream**, nsIChannel**)+64)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #17 pc 00783044 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (nsFtpChannel::GetStatusArg(nsresult, nsTString<char16_t>&)+20)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #18 pc 00783383 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (nsFtpChannel::Suspend()+163)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #19 pc 0283e86a /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (mozilla::dom::AndroidWebAuthnResult::~AndroidWebAuthnResult()+234)
06-13 14:27:43.734: A/lla.fenix.debu(10168): java_vm_ext.cc:542] native: #20 pc 0285dcb8 /data/app/org.mozilla.fenix.debug-crc_zILjlgZ8dhHr3XDXSQ==/lib/x86/libxul.so (offset fb000) (txNodeSet::copyElements(txXPathNode*, txXPathNode const*, txXPathNode const*)+56)

Happy to provide any more details if need be from the Firebase buckets, but I think you got the gist above.

Assignee: nobody → agi

Comment on attachment 9158719 [details]
Bug 1644561 - Verify that mCapturePixelsResults is not empty.

Security Approval Request

  • How easily could an exploit be constructed based on the patch?: Understanding what the problem is from the patch is really easy. We're accessing the front of a queue without checking if it's empty or not.
  • Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
  • Which older supported branches are affected by this flaw?: All (68+)
  • If not all supported branches, which bug introduced the flaw?: None
  • Do you have backports for the affected branches?: No
  • If not, how different, hard to create, and risky will they be?: Probably very similar
  • How likely is this patch to cause regressions; how much testing does it need?: Not very likely to cause regressions, we're crashing in a code path that should already be a failure case. Worst case scenario screenshots stop working in GV apps.
Attachment #9158719 - Flags: sec-approval?
Attachment #9158721 - Flags: sec-approval?
Whiteboard: [geckoview:m79] → [geckoview:m79][geckoview:m80]
Whiteboard: [geckoview:m79][geckoview:m80] → [geckoview:m79][geckoview:m80][fxr:p1]

This is blocking the FxR release.

Comment on attachment 9158719 [details]
Bug 1644561 - Verify that mCapturePixelsResults is not empty.

Approved to land; but land the test 45 days after the last product containing the fix has shipped.

Attachment #9158719 - Flags: sec-approval? → sec-approval+

Comment on attachment 9158721 [details]
Bug 1644561 - Add stress test for capturePixels().

Approved to land 45 days after the last product containing the fix has shipped.

Attachment #9158721 - Flags: sec-approval? → sec-approval+

https://hg.mozilla.org/integration/autoland/rev/d8c1bf3fd700
https://hg.mozilla.org/mozilla-central/rev/d8c1bf3fd700

Group: mobile-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 4 years ago
status-firefox79: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla79
Whiteboard: [geckoview:m79][geckoview:m80][fxr:p1] → [geckoview:m79][fxr:p1]

ni to land the test in 45 days.

Flags: needinfo?(agi)
Flags: in-testsuite?
Has Regression Range: --- → yes
Keywords: regression
Flags: qe-verify-
Whiteboard: [geckoview:m79][fxr:p1] → [geckoview:m79][fxr:p1][post-critsmash-triage]

Code has been in production for a while, landed the patch.

Flags: needinfo?(agi)
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: