From Socorro: https://crash-stats.mozilla.com/report/index/20e3aa63-95cd-4a98-a588-cee4d2111226 Build ID 20111226031002 AdapterVendorID: olympus, AdapterDeviceID: MB860. AdapterDescription: 'Android, Model: 'MB860', Product: 'olyatt', Manufacturer: 'motorola', Hardware: 'olympus''. java.lang.ArrayIndexOutOfBoundsException at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.advanceBounce(PanZoomController.java:626) at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.run(PanZoomController.java:613) at android.os.Handler.handleCallback(Handler.java:587) at android.os.Handler.dispatchMessage(Handler.java:92) at android.os.Looper.loop(Looper.java:130) at org.mozilla.gecko.GeckoApp$33.run(GeckoApp.java:1517) at android.os.Handler.handleCallback(Handler.java:587) at android.os.Handler.dispatchMessage(Handler.java:92) at android.os.Looper.loop(Looper.java:130) at android.app.ActivityThread.main(ActivityThread.java:3806) at java.lang.reflect.Method.invokeNative(Native Method) at java.lang.reflect.Method.invoke(Method.java:507) at com.android.internal.os.ZygoteInit$MethodAndArgsCa
Created attachment 584976 [details] [diff] [review] Move fields into BounceRunnable This bug can only happen if there are two BounceRunnables going concurrently and interfering with each other. The root cause is probably the same as bug 713011, but this patch will robustify the code so that it doesn't die with an exception. It's also better to encapsulate these variables in general.
Comment on attachment 584976 [details] [diff] [review] Move fields into BounceRunnable Review of attachment 584976 [details] [diff] [review]: ----------------------------------------------------------------- This is fine, as long as we make sure that the Runnable is not created anew for each frame of the bounce animation. (IIRC it used to be, but it was changed.)
Comment on attachment 584976 [details] [diff] [review] Move fields into BounceRunnable [Approval Request Comment] Regression caused by (bug #): none User impact if declined: Exceptions that kill the browser. Also the patch for 715164 depends on this one going in first. Testing completed (on m-c, etc.): Been sitting on m-c for a few days Risk to taking this patch (and alternatives if risky): Not high risk, change is fairly straightforward. Low chance of introducing other regressions.
I can reproduce this on the 01/05/2012 build; https://crash-stats.mozilla.com/report/index/bp-f00780aa-db9e-4389-9e87-805ef2120105 0. turn on plugins (yes to enable plugins in settings) 1. go to http://www.narutoget.com/watch/879-naruto-shippuden-episode-243-english-subbed/ 2. pan up and zoom in 3. pan down and zoom out 4. repeat 2 and 3 until crash Note: opening a new copy of this in a new tab can cause the crash to occur faster.
6 years ago
This crash was fixed by the patch on bug 715164 (which is also about this exception). That patch is not in the January 5th build, but I believe will be in today's nightly.
verified fix 20120106, nexus S