692961 - Capturing image on camera api crashes [@ mozalloc_abort | __swrite | dexDataMapAlloc]

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Tony Chung [:tchung]]

Crashed on Fennec nightly while trying to capture an image using the test URL.

See crash report: https://crash-stats.mozilla.com/report/index/bp-3da9e805-5342-47bc-9b09-ea7fd2111007

Repro:
1) install nightly on Android 2.3.3, Samsung Galaxy S 2: Nightly: Mozilla/5.0 (Android; Linux armv7l; rv:10.0a1) Gecko/201101007 Firefox/9.0a1 Fennec/9.0a1
2) visit the test URL for camera API
3)_ click capture, verify crash and crash reporter appears with java errors.  
4) i'll try and reproduce with a logcat now.

Expected:
- no Crashers

Actual: 
- crash on [@ mozalloc_abort | __swrite] camera capture


Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:66
1 	libc.so 	__swrite 	
2 		@0x3e 	
3 	libdvm.so 	dexDataMapAlloc 	
4 	libmozutils.so 	Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash 	other-licenses/android/APKOpen.cpp:241
5 	libmozutils.so 	Java_org_mozilla_gecko_GeckoAppShell_reportJavaCrash 	other-licenses/android/APKOpen.cpp:241
6 	libdvm.so 	dvmPlatformInvoke 	
7 	libdvm.so 	dvmCallJNIMethod_general 	
8 	libdvm.so 	dvmResolveNativeMethod 	
9 	libdvm.so 	dvmAsmSisterStart 	
10 	libdvm.so 	dvmMterpStd 	
11 	libdvm.so 	dvmInterpret 	
12 	libdvm.so 	dvmInvokeMethod 	
13 	libdvm.so 	dvmFreeDexOrJar 	
14 	libdvm.so 	dvmAsmSisterStart 	
15 	libdvm.so 	dvmMterpStd 	
16 	libdvm.so 	dvmInterpret 	
17 	libdvm.so 	dvmCallMethodV 	
18 	libdvm.so 	JNI_CreateJavaVM 	
19 	libandroid_runtime.so 	_ZN7android14AndroidRuntime6onExitEi 	
20 	libandroid_runtime.so 	_ZN7android14AndroidRuntime5startEPKcb 	
21 	app_process 	app_process@0xccc 	
22 	app_process 	app_process@0x1027 	
23 	libandroid_runtime.so 	InitPassFilter 	
24 	app_process 	app_process@0xb33 	
25 	app_process 	app_process@0xb33 	
26 	libc.so 	__libc_init 	
27 		@0xffffffe3 	
28 	app_process 	app_process@0x33 	
29 	app_process 	app_process@0xb1f

Comment 1

[Tony Chung [:tchung]]

Attachment: logcat of crash

Comment 2

[Josh Matthews [:jdm]]

Comment on attachment 565674 [details]
logcat of crash

Something wacky is going on in this log where exception stack traces start halfway through and don't show the exception that was thrown.

Comment 3

[[:fabrice] Fabrice Desré]

Attachment: fix

Protecting against frames send after we closed the camera.

Comment 4

[[:fabrice] Fabrice Desré]

pushed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6d2612f17530

Comment 5

[Matt Brubeck (:mbrubeck)]

Does this affect Firefox 9?  Should we request approval for Aurora?

Comment 6

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/6d2612f17530

Comment 7

[[:fabrice] Fabrice Desré]

Comment on attachment 565986 [details] [diff] [review]
fix

No-risk crasher fix that gives us camera support on the Galaxy S2 for instance.

Comment 8

[Tony Chung [:tchung]]

Verified fix on Nightly Fennec: Mozilla/5.0 (Android; Linux armv7l; rv:10.0a1) Gecko/201101013 Firefox/10.0a1 Fennec/10.0a1

No more crash.  Need verification on aurora landing.

Comment 9

[[:fabrice] Fabrice Desré]

pushed to aurora:
https://hg.mozilla.org/releases/mozilla-aurora/rev/a6f988cf4111

Comment 10

[Catalin Suciu [:csuciu]]

This is not reproducible on the latest Aurora build(30/10)
Mozilla/5.0 (Android; Linux armv7l; rv:9.0a2) Gecko/20111030 Firefox/9.0a2 Fennec/9.0a2
Device: Samsung Galaxy S2