Last Comment Bug 713586 - java.lang.ArrayIndexOutOfBoundsException at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.advanceBounce(PanZoomController.java:626)
: java.lang.ArrayIndexOutOfBoundsException at org.mozilla.gecko.ui.PanZoomContr...
Status: VERIFIED FIXED
[native-crash]
: crash, reproducible
Product: Firefox for Android
Classification: Client Software
Component: General (show other bugs)
: 12 Branch
: ARM Android
: P3 critical (vote)
: Firefox 12
Assigned To: (Back on May31) Kartikaya Gupta (email:kats@mozilla.com)
:
Mentors:
Depends on:
Blocks: 715164
  Show dependency treegraph
 
Reported: 2011-12-26 17:45 PST by Naoki Hirata :nhirata (please use needinfo instead of cc)
Modified: 2012-01-06 15:45 PST (History)
5 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
fixed
11+


Attachments
Move fields into BounceRunnable (4.29 KB, patch)
2011-12-30 09:51 PST, (Back on May31) Kartikaya Gupta (email:kats@mozilla.com)
pwalton: review+
dougt: approval‑mozilla‑aurora+
Details | Diff | Review

Description Naoki Hirata :nhirata (please use needinfo instead of cc) 2011-12-26 17:45:21 PST
From Socorro: https://crash-stats.mozilla.com/report/index/20e3aa63-95cd-4a98-a588-cee4d2111226

Build ID	20111226031002

AdapterVendorID: olympus, AdapterDeviceID: MB860.
AdapterDescription: 'Android, Model: 'MB860', Product: 'olyatt', Manufacturer: 'motorola', Hardware: 'olympus''.

java.lang.ArrayIndexOutOfBoundsException at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.advanceBounce(PanZoomController.java:626)

	at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.run(PanZoomController.java:613)

	at android.os.Handler.handleCallback(Handler.java:587)
	at android.os.Handler.dispatchMessage(Handler.java:92)
	at android.os.Looper.loop(Looper.java:130)
	at org.mozilla.gecko.GeckoApp$33.run(GeckoApp.java:1517)
	at android.os.Handler.handleCallback(Handler.java:587)
	at android.os.Handler.dispatchMessage(Handler.java:92)
	at android.os.Looper.loop(Looper.java:130)
	at android.app.ActivityThread.main(ActivityThread.java:3806)
	at java.lang.reflect.Method.invokeNative(Native Method)
	at java.lang.reflect.Method.invoke(Method.java:507)
	at com.android.internal.os.ZygoteInit$MethodAndArgsCa
Comment 1 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2011-12-30 09:51:13 PST
Created attachment 584976 [details] [diff] [review]
Move fields into BounceRunnable

This bug can only happen if there are two BounceRunnables going concurrently and interfering with each other. The root cause is probably the same as bug 713011, but this patch will robustify the code so that it doesn't die with an exception. It's also better to encapsulate these variables in general.
Comment 2 Patrick Walton (:pcwalton) 2012-01-01 12:44:49 PST
Comment on attachment 584976 [details] [diff] [review]
Move fields into BounceRunnable

Review of attachment 584976 [details] [diff] [review]:
-----------------------------------------------------------------

This is fine, as long as we make sure that the Runnable is not created anew for each frame of the bounce animation. (IIRC it used to be, but it was changed.)
Comment 3 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-02 16:13:00 PST
https://hg.mozilla.org/integration/mozilla-inbound/rev/08599b3e8590
Comment 4 Marco Bonardo [::mak] 2012-01-03 03:44:20 PST
https://hg.mozilla.org/mozilla-central/rev/08599b3e8590
Comment 5 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-05 19:25:17 PST
Comment on attachment 584976 [details] [diff] [review]
Move fields into BounceRunnable

[Approval Request Comment]
Regression caused by (bug #): none
User impact if declined: Exceptions that kill the browser. Also the patch for 715164 depends on this one going in first.
Testing completed (on m-c, etc.): Been sitting on m-c for a few days
Risk to taking this patch (and alternatives if risky): Not high risk, change is fairly straightforward. Low chance of introducing other regressions.
Comment 6 Naoki Hirata :nhirata (please use needinfo instead of cc) 2012-01-05 22:52:13 PST
I can reproduce this on the 01/05/2012 build; https://crash-stats.mozilla.com/report/index/bp-f00780aa-db9e-4389-9e87-805ef2120105

0. turn on plugins (yes to enable plugins in settings)
1. go to http://www.narutoget.com/watch/879-naruto-shippuden-episode-243-english-subbed/
2. pan up and zoom in
3. pan down and zoom out
4. repeat 2 and 3 until crash

Note: opening a new copy of this in a new tab can cause the crash to occur faster.
Comment 7 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-06 06:11:29 PST
This crash was fixed by the patch on bug 715164 (which is also about this exception). That patch is not in the January 5th build, but I believe will be in today's nightly.
Comment 8 Naoki Hirata :nhirata (please use needinfo instead of cc) 2012-01-06 10:15:05 PST
verified fix 20120106, nexus S
Comment 9 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-06 11:49:15 PST
https://hg.mozilla.org/releases/mozilla-aurora/rev/3f9f2c5f316f

Note You need to log in before you can comment on or make changes to this bug.