613982 - Crash [@ libdvm.so@0x48c42 ] in sa_stream_write when closing a tab playing audio

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Matt Brubeck (:mbrubeck)]

Steps to reproduce:
1. Open http://html5zombo.com/ in a new tab
2. After the page loads and starts playing audio, close the tab.

Results:
http://crash-stats.mozilla.com/report/index/bp-a91578b1-913f-4f48-bd9d-c56ac2101122

Reproducible in the 2010-11-22-04-mozilla-central-android-r7 nightly.

Comment 1

[Matt Brubeck (:mbrubeck)]

Looks like this crash [@ libdvm.so@0x5b3de ] is the same thing:
http://crash-stats.mozilla.com/report/index/175554dc-4b07-45ab-a71e-6f0422101117

Comment 2

[Doug Turner (:dougt)]

Attachment: patch v.1

part of this should have been done in the remote audio bug.

Comment 3

[Doug Turner (:dougt)]

http://hg.mozilla.org/mozilla-central/rev/7fa56227251a

Comment 4

[Matthew Gregan [:kinetik]]

Oh crud, this isn't right.  nsAudioStream's dtor wasn't made virtual when it was refactored for IPC, so this code is never going to run.  That's probably why the crash stopped--the root cause is still present.

Comment 5

[Matthew Gregan [:kinetik]]

The good news is, I'm wrong.  NS_DECL_ISUPPORTS in each of the nsAudioStream subclasses has a virtual Release(), which is ultimately responsible for deleting the object, so the correct dtor is called due to that.

Comment 6

[Aakash Desai [:aakashd]]

Re-opening based on comment #4 and that there is no follow-up bug. Also, the crash is still occurring on build:

Mozilla/5.0 (Android; Linux armv71; rv:2.0b8pre) Gecko/20101123 Namoroka/4.0b8pre Fennec/4.0b3pre


It's not on crash-stats, but the signature on my device was: 3ffa037-5eca-13fb-158fdd83-00cf8049

Comment 7

[Doug Turner (:dougt)]

did you read comment #5?

Comment 8

[Aakash Desai [:aakashd]]

sigh, i need my morning tea.

Comment 9

[Aakash Desai [:aakashd]]

verified FIXED on build:

Mozilla/5.0 (Android; Linux armv71; rv:2.0b8pre) Gecko/20101123 Namoroka/4.0b8pre Fennec/4.0b3pre


follow-up crasher filed: https://bugzilla.mozilla.org/show_bug.cgi?id=614267