612546 - crash [@ nsWindow::OnDraw ]

Status: RESOLVED WORKSFORME

(Core Graveyard :: Widget: Android, defect)

Description

[Scoobidiver (away)]

It is #30 top crasher in Fennec 4.0b3pre for the last week.

Signature	nsWindow::OnDraw
UUID	3ec68c58-0f01-4ae5-8d3a-7d4da2101114
Time 	2010-11-14 15:16:38.339706
Uptime	237
Install Age	97809 seconds (1.1 days) since version was first installed.
Product	Fennec
Version	4.0b3pre
Build ID	20101113041939
Branch	2.0
OS	Linux
OS Version	0.0.0 Linux 2.6.32.9-ga42712e #1 PREEMPT Wed Sep 1 20:47:21 CDT 2010 armv7l
CPU	arm
CPU Info	
Crash Reason	SIGSEGV
Crash Address	0xf4
User Comments	
App Notes 	motorola DROIDX
verizon/shadow_vzw/cdma_shadow/shadow:2.2/VZW/23.15:user/ota-rel-keys,release-keys
Processor Notes 	
EMCheckCompatibility	False
Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	nsWindow::OnDraw 	widget/src/android/nsWindow.cpp:890
1 	libxul.so 	nsWindow::OnAndroidEvent 	widget/src/android/nsWindow.cpp:770
2 	libxul.so 	nsAppShell::ProcessNextNativeEvent 	widget/src/android/nsAppShell.cpp:286
3 	libxul.so 	nsBaseAppShell::DoProcessNextNativeEvent 	widget/src/xpwidgets/nsBaseAppShell.cpp:163
4 	libxul.so 	nsBaseAppShell::OnProcessNextEvent 	widget/src/xpwidgets/nsBaseAppShell.cpp:309
5 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:578
6 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
7 	libxul.so 	nsThread::Shutdown 	xpcom/threads/nsThread.cpp:490
8 	libxul.so 	nsCacheService::Shutdown 	nsCOMPtr.h:492
9 	libxul.so 	nsCacheProfilePrefObserver::Observe 	netwerk/cache/nsCacheService.cpp:364
10 	libxul.so 	nsObserverList::NotifyObservers 	nsVoidArray.h:63
11 	libxul.so 	nsObserverService::NotifyObservers 	nsTHashtable.h:170
12 	libxul.so 	mozilla::ShutdownXPCOM 	xpcom/glue/nsCOMPtr.h:492
13 	libxul.so 	NS_ShutdownXPCOM_P 	xpcom/build/nsXPComInit.cpp:595
14 	libxul.so 	ScopedXPCOMStartup::~ScopedXPCOMStartup 	toolkit/xre/nsAppRunner.cpp:1118
15 	libxul.so 	XRE_main 	nsCOMPtr.h:800
16 	libxul.so 	GeckoStart 	toolkit/xre/nsAndroidStartup.cpp:131
17 	libc.so 	libc.so@0x10f27 	
18 	libc.so 	libc.so@0x10a13 

More reports at:
http://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsWindow%3A%3AOnDraw&version=Fennec%3A4.0b3pre

Comment 1

[Josh Matthews [:jdm]]

So apparently we're crashing here:

>    AndroidBridge::Bridge()->HideProgressDialogOnce();

But AnddroidBridge::Bridge() is null-checked in OnAndroidEvent in the previous frame, and there's nowhere that modifies the static bridge pointer outside of AndroidBridge::ConstructBridge, not even to delete it.

Comment 2

[Scoobidiver (away)]

It is #5 top crasher in 4.0b3pre for the last 3 days.

Comment 3

[Scoobidiver (away)]

The last crash happened in 7.0.1:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=nsWindow%3A%3AOnDraw
I close it as WFM.