670773 - Crash when switching orientation repeatedly; Crash [@ GetElement]

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: General, defect)

Description

[(inactive) Jim Chen [:jchen] [:darchons]]

Started as IRC discussion with Cwiiis:

Sometimes when switching orientation, a NullPointerException occurs:

> W/System.err( 7214): java.lang.NullPointerException
> W/System.err( 7214):  at org.mozilla.gecko.GeckoSurfaceView.draw(GeckoSurfaceView.java:157)
> W/System.err( 7214):  at org.mozilla.gecko.GeckoSurfaceView.draw2D(GeckoSurfaceView.java:379)
> W/System.err( 7214):  at org.mozilla.gecko.GeckoAppShell.nativeRun(Native Method)
> W/System.err( 7214):  at org.mozilla.gecko.GeckoAppShell.nativeRun(Native Method)
> W/System.err( 7214):  at org.mozilla.gecko.GeckoAppShell.runGecko(GeckoAppShell.java:395)
> W/System.err( 7214):  at org.mozilla.gecko.GeckoApp$2.run(GeckoApp.java:170)
> I/GeckoAppJava( 7214): surface created
> I/GeckoAppJava( 7214): surfaceChanged: fmt: 4 dim: 480 762

However I now see that this does not crash Fennec. Rather, after repeatedly switching orientation, eventually a StackOverflowError occurs which does crash Fennec:
 
> E/AndroidRuntime( 7214): FATAL EXCEPTION: main
> E/AndroidRuntime( 7214): java.lang.StackOverflowError
> E/AndroidRuntime( 7214):      at java.lang.Thread.currentThread(Thread.java:557)
> E/AndroidRuntime( 7214):      at java.lang.LangAccessImpl.parkFor(LangAccessImpl.java:48)
> E/AndroidRuntime( 7214):      at sun.misc.Unsafe.park(Unsafe.java:337)
> E/AndroidRuntime( 7214):      at java.util.concurrent.locks.LockSupport.park(LockSupport.java:157)
> E/AndroidRuntime( 7214):      at java.util.concurrent.SynchronousQueue$TransferStack.awaitFulfill(SynchronousQueue.java:427)
> E/AndroidRuntime( 7214):      at java.util.concurrent.SynchronousQueue$TransferStack.transfer(SynchronousQueue.java:328)
> E/AndroidRuntime( 7214):      at java.util.concurrent.SynchronousQueue.take(SynchronousQueue.java:862)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoSurfaceView.surfaceChanged(GeckoSurfaceView.java:226)
> E/AndroidRuntime( 7214):      at android.view.SurfaceView.updateWindow(SurfaceView.java:549)
> E/AndroidRuntime( 7214):      at android.view.SurfaceView.dispatchDraw(SurfaceView.java:348)
> E/AndroidRuntime( 7214):      at android.view.ViewGroup.drawChild(ViewGroup.java:1644)
> E/AndroidRuntime( 7214):      at android.view.ViewGroup.dispatchDraw(ViewGroup.java:1373)
> E/AndroidRuntime( 7214):      at android.view.ViewGroup.drawChild(ViewGroup.java:1644)
> E/AndroidRuntime( 7214):      at android.view.ViewGroup.dispatchDraw(ViewGroup.java:1373)
> E/AndroidRuntime( 7214):      at android.view.View.draw(View.java:6900)
> E/AndroidRuntime( 7214):      at android.widget.FrameLayout.draw(FrameLayout.java:357)
> E/AndroidRuntime( 7214):      at android.view.ViewGroup.drawChild(ViewGroup.java:1646)
> E/AndroidRuntime( 7214):      at android.view.ViewGroup.dispatchDraw(ViewGroup.java:1373)
> E/AndroidRuntime( 7214):      at android.view.View.draw(View.java:6900)
> E/AndroidRuntime( 7214):      at android.widget.FrameLayout.draw(FrameLayout.java:357)
> E/AndroidRuntime( 7214):      at com.android.internal.policy.impl.PhoneWindow$DecorView.draw(PhoneWindow.java:1885)
> E/AndroidRuntime( 7214):      at android.view.ViewRoot.draw(ViewRoot.java:1523)
> E/AndroidRuntime( 7214):      at android.view.ViewRoot.performTraversals(ViewRoot.java:1259)
> E/AndroidRuntime( 7214):      at android.view.ViewRoot.handleMessage(ViewRoot.java:1860)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:99)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at android.os.Handler.handleCallback(Handler.java:587)
> E/AndroidRuntime( 7214):      at android.os.Handler.dispatchMessage(Handler.java:92)
> E/AndroidRuntime( 7214):      at android.os.Looper.loop(Looper.java:123)
> E/AndroidRuntime( 7214):      at org.mozilla.gecko.GeckoApp$3.run(GeckoApp.java:194)
> E/AndroidRuntime( 7214):      at

Comment 1

[(inactive) Jim Chen [:jchen] [:darchons]]

Cwiiis said to assign to him.

Comment 2

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

I ran into the same thing Jim did.

https://crash-stats.mozilla.com/report/index/bp-94d010cd-dc99-46a8-baec-de7102110629

Frame 	Module 	Signature [Expand] 	Source
0 	libxul.so 	GetElement 	js/src/jsarray.cpp:354
1 	libxul.so 	array_indexOf 	js/src/jsarray.cpp:2727
2 	libxul.so 	libxul.so@0xbdfc92 	
3 	libxul.so 	array_indexOf 	js/src/jsarray.cpp:2752
4 	libxul.so 	js::mjit::EnterMethodJIT 	js/src/vm/Stack.h:1257
5 	libxul.so 	array_extra 	js/src/jsinterpinlines.h:146
6 	libxul.so 	array_filter 	js/src/jsarray.cpp:2982
7 	libxul.so 	libxul.so@0xbdfc92 	
8 	libxul.so 	array_filter 	js/src/jsarray.cpp:2980
9 	libxul.so 	js::mjit::JaegerShot 	js/src/jscntxt.h:2203
10 	libxul.so 	js::Interpret 	js/src/jsinterp.cpp:4629
11 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:613
12 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5088
13 	libxul.so 	nsJSContext::CallEventHandler 	dom/base/nsJSEnvironment.cpp:1901
14 	libxul.so 	nsGlobalWindow::RunTimeout 	nsCOMPtr.h:888
15 	libxul.so 	nsGlobalWindow::TimerCallback 	dom/base/nsGlobalWindow.cpp:9585
16 	libxul.so 	nsTimerImpl::Fire 	xpcom/threads/nsTimerImpl.cpp:425
17 	libxul.so 	nsTimerEvent::Run 	nsAutoPtr.h:969
18 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:618
19 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:245
20 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:134
21 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:219
22 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:511
23 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:191
24 	libxul.so 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:223
25 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp:3702
26 	libxul.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	toolkit/xre/nsAndroidStartup.cpp:132
27 	libmozutils.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	other-licenses/android/APKOpen.cpp:234
28 	libdvm.so 	libdvm.so@0x171b7 	
29 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x2396ab 	
30 	2 (deleted) 	2 @0x10b4b7 	
31 	libdvm.so 	libdvm.so@0x1737f 	
32 	libdvm.so 	libdvm.so@0x45a22 	
33 	data@[e-mail]@classes.dex 	data@[e-mail]@classes.dex@0xf82f 	
34 	libmozutils.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	other-licenses/android/APKOpen.cpp:234
35 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x2396ab 	
36 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x2396ab 	
37 	libdvm.so 	libdvm.so@0xa3447 	
38 	2 (deleted) 	2 @0x10b4b7 	
39 	libmozutils.so 	Java_org_mozilla_gecko_GeckoAppShell_nativeRun 	other-licenses/android/APKOpen.cpp:234
40 	libdvm.so 	libdvm.so@0x4b16c 	
41 	core.odex 	core.odex@0xe6343 	
42 	data@[e-mail]@classes.dex 	data@[e-mail]@classes.dex@0x99c5 	
43 	2 (deleted) 	2 @0x10b4b7 	
44 	libdvm.so 	libdvm.so@0x1c123 	
45 	libdvm.so 	libdvm.so@0xa3333 	
46 	libdvm.so 	libdvm.so@0xa7f67 	
47 	libdvm.so 	libdvm.so@0x22e97 	
48 	libdvm.so 	libdvm.so@0x22e17 	
49 	libdvm.so 	libdvm.so@0x21d33 	
50 	core.odex 	core.odex@0x143c0f 	
51 	2 (deleted) 	2 @0x23402f 	
52 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0x239a53 	
53 	libdvm.so 	libdvm.so@0x1be67 	
54 	libdvm.so 	libdvm.so@0x1bea7 	
55 	libdvm.so 	libdvm.so@0x1bd87 	
56 	libdvm.so 	libdvm.so@0x1bdaf 	
57 	libdvm.so 	libdvm.so@0x1bddf 	
58 	libdvm.so 	libdvm.so@0x1be03 	
59 	libdvm.so 	libdvm.so@0x7ca04 	
60 	core.odex 	core.odex@0x143c07 	
61 	core.odex 	core.odex@0x143c07 	
62 	core.odex 	core.odex@0x143c0f

Comment 3

[Chris Lord [:cwiiis]]

The NULL pointer exception happens because I didn't wrap the synchronise block in a try/except (no use to just check if it's NULL as the code can run from a thread), but I'm not sure about the stack overflow though, I'll have a look.

Comment 4

[Chris Lord [:cwiiis]]

Attachment: Fix crash when draw is called without a surface allocated

Jim, could you check out this patch and see if it fixes it for you? I don't have any problems with it, but would like to make sure.

Comment 5

[(inactive) Jim Chen [:jchen] [:darchons]]

(In reply to comment #4)
> Created attachment 548408 [details] [diff] [review] [review]
> Fix crash when draw is called without a surface allocated
> 
> Jim, could you check out this patch and see if it fixes it for you? I don't
> have any problems with it, but would like to make sure.

No NullPointerException, but still stack overflow with same stacktrace. I should have clarified, I'm changing orientation by repeatedly opening and closing the hardware keyboard on the T-mobile G2.

Comment 6

[Brad Lassey [:blassey] (use needinfo?)]

(In reply to comment #5)
> (In reply to comment #4)
> No NullPointerException, but still stack overflow with same stacktrace. I
> should have clarified, I'm changing orientation by repeatedly opening and
> closing the hardware keyboard on the T-mobile G2.

bug 674245 has a fix for the stack overflow crash. Let's use this bug (and the patch on this bug) to clear up the null pointer exception.

Comment 7

[Chris Lord [:cwiiis]]

This is a xul-fennec bug and I'm concentrating on native fennec at the moment. The patch I've attached here looks sound, but needs testing/review.

Unassigning, hopefully someone experiencing the issue can pick this up and test to see if this patch helps.

Comment 8

[(inactive) Jim Chen [:jchen] [:darchons]]

Closing old XUL Fennec bug