Note: There are a few cases of duplicates in user autocompletion which are being worked on.

Attempt to use JS function on a different thread calling nsIWebProgressListener.onStateChange & nsIDOMEventListener.handleEvent results in crash

RESOLVED FIXED

Status

()

Firefox for Android
General
P2
critical
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: aaronmt, Assigned: sriram)

Tracking

({crash, reproducible})

unspecified
ARM
Android
crash, reproducible
Points:
---

Firefox Tracking Flags

(firefox11 fixed, fennec11+)

Details

(Whiteboard: [native-crash:P1], crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
E/GeckoConsole( 2909): Attempt to use JS function on a different thread calling nsIWebProgressListener.onStateChange. JS objects may not be shared across threads.
E/GeckoConsole( 2909): Attempt to use JS function on a different thread calling nsIDOMEventListener.handleEvent. JS objects may not be shared across threads.
W/InputConnectionWrapper.ICC(  188): Timed out waiting on IInputContextCallback
I/ActivityManager(  110): Process org.mozilla.fennec (pid 2909) has died.
D/Zygote  (   75): Process 2909 exited cleanly (1)
I/WindowManager(  110): WIN DEATH: Window{40b89098 SurfaceView paused=false}
I/WindowManager(  110): WIN DEATH: Window{40553400 org.mozilla.fennec/org.mozilla.fennec.App paused=false}
I/InputDispatcher(  110): Dropping event because there is no touched window or focused application.
I/WindowManager(  110): WIN DEATH: Window{408f9440 org.mozilla.fennec/org.mozilla.gecko.TabsTray paused=false}


STR: 

1. Open two tabs with different pages
2. Reload a single tab, and during reload switch to the other tab

--
Samsung Nexus S (Android 2.3.6)
20111118040220
http://hg.mozilla.org/projects/birch/rev/9999a423d8ab
(Reporter)

Comment 1

6 years ago
bp-f16bca24-7e06-4de5-960a-b09302111118
Crash Signature: __futex_syscall3
Assignee: nobody → sriram
similar steps to bug 702619?
(Reporter)

Comment 3

6 years ago
(In reply to Naoki Hirata :nhirata from comment #2)
> similar steps to bug 702619?

Nope, much simpler ala comment #0.

Updated

6 years ago
Priority: -- → P2
Duplicate of this bug: 704232
Setting to end user priority P1; STR available
Whiteboard: [native-crash] → [native-crash:P1]

Updated

6 years ago
Crash Signature: __futex_syscall3 → [@ __futex_syscall3 ]
(Assignee)

Comment 6

6 years ago
Created attachment 576229 [details] [diff] [review]
Patch

The problem is not with "JS objects accessed in wrong thread" or "TabsTray". I narrowed down the problem to allocation of "ArrayListIterator" and "Rect" in TileLayer.java. The number of objects created for tab switching increases very fast, causing all background processes to be killed by android one by one. This can be seen in the logs. Once android runs out of heap (even after killing background processes), it eventually kills the Fennec application. The GL layer needs to be optimized to fix this issue.

Also, I've optimized TabsTray to use less memory when shown. The OnClickListeners are reused between each row in the list. To ensure the selected tab is in bold, the view needs to be read from XML every time a row is created. This is a bottleneck. Though this can cause memory issues, I didn't find any with it in AllocationTracker in DDMS tool -- mostly because the number of list entries is minimal and the lifespan of TabsTray is small (also GC is called once activity finishes).

Bug 704162, bug 704232 are all related to the same issue of "switching tabs".
Bug 704575 is tracking the dirty rectangle problem.
Attachment #576229 - Flags: review?(mark.finkle)
Comment on attachment 576229 [details] [diff] [review]
Patch

These changes look good and if they save some memory, we should do it. The changes are not insane.
Attachment #576229 - Flags: review?(mark.finkle) → review+
https://hg.mozilla.org/projects/birch/rev/fd9726529749
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
tracking-fennec: --- → 11+
status-firefox11: --- → fixed
You need to log in before you can comment on or make changes to this bug.