Last Comment Bug 715164 - ArrayIndexOutOfBoundsException in advanceBounce()
: ArrayIndexOutOfBoundsException in advanceBounce()
Status: VERIFIED FIXED
:
Product: Firefox for Android
Classification: Client Software
Component: General (show other bugs)
: unspecified
: All Android
: P1 normal (vote)
: Firefox 12
Assigned To: (Back on May31) Kartikaya Gupta (email:kats@mozilla.com)
:
Mentors:
Depends on: 713586
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-04 09:04 PST by (Back on May31) Kartikaya Gupta (email:kats@mozilla.com)
Modified: 2012-01-06 15:55 PST (History)
8 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
fixed
11+


Attachments
Guard against yet another possible race (1.67 KB, patch)
2012-01-04 09:15 PST, (Back on May31) Kartikaya Gupta (email:kats@mozilla.com)
no flags Details | Diff | Review
Stop queued runnables from running after animation timer is cancelled (5.60 KB, patch)
2012-01-04 11:29 PST, (Back on May31) Kartikaya Gupta (email:kats@mozilla.com)
pwalton: review+
akeybl: approval‑mozilla‑aurora+
Details | Diff | Review

Description (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-04 09:04:05 PST
From a build that already has cset 08599b3e8590

E/GeckoApp(10888): java.lang.ArrayIndexOutOfBoundsException: length=16; index=-1
E/GeckoApp(10888):      at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.advanceBounce(PanZoomController.java:629)
E/GeckoApp(10888):      at org.mozilla.gecko.ui.PanZoomController$BounceRunnable.run(PanZoomController.java:616)
E/GeckoApp(10888):      at android.os.Handler.handleCallback(Handler.java:605)
E/GeckoApp(10888):      at android.os.Handler.dispatchMessage(Handler.java:92)
E/GeckoApp(10888):      at android.os.Looper.loop(Looper.java:137)
E/GeckoApp(10888):      at org.mozilla.gecko.GeckoApp$33.run(GeckoApp.java:1526)
E/GeckoApp(10888):      at android.os.Handler.handleCallback(Handler.java:605)
E/GeckoApp(10888):      at android.os.Handler.dispatchMessage(Handler.java:92)
E/GeckoApp(10888):      at android.os.Looper.loop(Looper.java:137)
E/GeckoApp(10888):      at android.app.ActivityThread.main(ActivityThread.java:4424)
E/GeckoApp(10888):      at java.lang.reflect.Method.invokeNative(Native Method)
E/GeckoApp(10888):      at java.lang.reflect.Method.invoke(Method.java:511)
E/GeckoApp(10888):      at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:784)
E/GeckoApp(10888):      at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:551)
E/GeckoApp(10888):      at dalvik.system.NativeStart.main(Native Method)
Comment 1 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-04 09:15:05 PST
Created attachment 585780 [details] [diff] [review]
Guard against yet another possible race

This race is a product of the animation timer turning around and posting things to the UI thread. This means that even if the animation timer is cancelled, there may be a runnable already scheduled on the UI thread.
Comment 2 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-04 09:19:21 PST
Comment on attachment 585780 [details] [diff] [review]
Guard against yet another possible race

Actually the FlingRunnable suffers from this too. I'll have a more generic patch up shortly.
Comment 3 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-04 11:29:39 PST
Created attachment 585820 [details] [diff] [review]
Stop queued runnables from running after animation timer is cancelled
Comment 4 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-04 21:09:31 PST
Try run was green: https://tbpl.mozilla.org/?tree=Try&rev=a39024138e30

I'm also seeing this exception come up pretty often while hammering on robotium stuff, so it would be good to get this in before robotium is hooked up.
Comment 5 Patrick Walton (:pcwalton) 2012-01-05 16:39:11 PST
Comment on attachment 585820 [details] [diff] [review]
Stop queued runnables from running after animation timer is cancelled

Review of attachment 585820 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good.
Comment 6 Patrick Walton (:pcwalton) 2012-01-05 18:28:58 PST
http://hg.mozilla.org/integration/mozilla-inbound/rev/91a8e4c55adb
Comment 7 Patrick Walton (:pcwalton) 2012-01-05 18:47:15 PST
Merged to mozilla-central early per QA request. This is crashing several devices on startup.

Note to sheriff: This will possibly cause a conflict; the inbound patch is identical to this one and can be dropped.

http://hg.mozilla.org/mozilla-central/rev/c7e27452a143
Comment 8 Naoki Hirata :nhirata (please use needinfo instead of cc) 2012-01-06 10:14:10 PST
Nexus S, 20120106, Flash 11
Comment 9 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-06 10:21:40 PST
Comment on attachment 585820 [details] [diff] [review]
Stop queued runnables from running after animation timer is cancelled

[Approval Request Comment]
Regression caused by (bug #): none
User impact if declined: Fennec crashes with ArrayIndexOutOfBoundsException
Testing completed (on m-c, etc.): m-c
Risk to taking this patch (and alternatives if risky): Other regressions with pan/zoom behaviour. I wouldn't consider it high risk since the change is mostly rearranging code and adding guards.
Comment 10 Alex Keybl [:akeybl] 2012-01-06 11:28:01 PST
Comment on attachment 585820 [details] [diff] [review]
Stop queued runnables from running after animation timer is cancelled

[Triage Comment]
Mobile only - approved for Aurora
Comment 11 (Back on May31) Kartikaya Gupta (email:kats@mozilla.com) 2012-01-06 11:50:14 PST
https://hg.mozilla.org/releases/mozilla-aurora/rev/77855ed1e430

Note You need to log in before you can comment on or make changes to this bug.