717932 - Crash @ mozalloc_abort | __swrite | dlfree | dlfree | loadLibs

Status: RESOLVED DUPLICATE of bug 720092

(Firefox for Android Graveyard :: General, defect, P2)

Description

[Scoobidiver (away)]

It first appeared in 12.0a1/20110112 from 3 different users.
The regression range might be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e79ef0ffcb09&tochange=8ffdb4c7404a

Signature 	mozalloc_abort | __swrite | dlfree | dlfree | loadLibs More Reports Search
UUID	438a8460-ffd4-44a9-b34c-f00fb2120113
Date Processed	2012-01-13 01:56:43.148497
Uptime	5720
Last Crash	19.9 hours before submission
Install Age	3.0 hours since version was first installed.
Install Time	2012-01-13 07:57:44
Product	FennecAndroid
Version	12.0a1
Build ID	20120112031044
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux 2.6.32.9 #1 PREEMPT Mon Mar 21 10:45:51 KST 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
EGL? EGL+
AdapterVendorID: latona, AdapterDeviceID: GT-I9003.
AdapterDescription: 'Android, Model: 'GT-I9003', Product: 'GT-I9003', Manufacturer: 'samsung', Hardware: 'latona''.

java.lang.IndexOutOfBoundsException: getChars (0 ... 3192) ends beyond length 0
	at android.text.SpannableStringBuilder.checkRange(SpannableStringBuilder.java:943)
	at android.text.SpannableStringBuilder.getChars(SpannableStringBuilder.java:847)
	at android.text.SpannableStringBuilder.toString(SpannableStringBuilder.java:869)
	at org.mozilla.gecko.GeckoInputConnection.getExtractedText(GeckoInputConnection.java:198)
	at com.android.internal.view.IInputConnectionWrapper.executeMessage(IInputConnectionWrapper.java:244)
	at com.android.internal.view.IInputConnectionWrapper$MyHandler.handleMessage(IInputConnectionWrapper.java:77)
	at android.os.Handler.dispatchMessage(Handler.java:99)
	at android.os.Looper.loop(Looper.java:123)
	at org.mozilla.gecko.GeckoApp$32.run(GeckoApp.java:1550)
	at android.os.Handler.handleCa
Processor Notes 	This dump is too long and has triggered the automatic truncation routine
EMCheckCompatibility	True

Frame 	Module 	Signature [Expand] 	Source
0 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:66
1 	libc.so 	__swrite 	
2 		@0x3d 	
3 	libc.so 	dlfree 	
4 	libc.so 	dlfree 	
5 		@0xbebe13ce 	
6 	libmozglue.so 	loadLibs 	mozglue/android/APKOpen.cpp:724
7 		@0x10da4bc 	
8 	libdvm.so 	libdvm.so@0xa23fe 	
9 	2 (deleted) 	2 @0x6606 	
10 	libdvm.so 	libdvm.so@0x5079d 	
11 	2 (deleted) 	2 @0x6606 	
12 	libdvm.so 	libdvm.so@0xa6eee 	
...

More report at:
https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%20|%20__swrite%20|%20dlfree%20|%20dlfree%20|%20loadLibs

Comment 1

[Doug Turner (:dougt)]

alex, can you dig into this?

Comment 2

[Scoobidiver (away)]

It happened only in 12.0a1/20120112 and 20120113 so far.

Comment 3

[Alex Pakhotin (:alexp)]

(In reply to Scoobidiver from comment #2)
> It happened only in 12.0a1/20120112 and 20120113 so far.

Seems like you could reproduce it. Can you provide any steps?

Comment 4

[Scoobidiver (away)]

(In reply to Scoobidiver from comment #2)
> It happened only in 12.0a1/20120112 and 20120113 so far.
This assertion is based on crash stats (see the link in comment 0).

Comment 5

[Alex Pakhotin (:alexp)]

(In reply to Scoobidiver from comment #4)
> This assertion is based on crash stats (see the link in comment 0).

Ah, right, I missed that half of the line mentioning 3 users. I don't see 20120112 in those reports though. Looks like just one user with build 20120113125827 installed on the 14th.

Got a bunch of similar crash reports recently, but I couldn't reproduce myself so far. :(

Comment 6

[Scoobidiver (away)]

(In reply to Alex Pakhotin (:alexp) from comment #5)
> (In reply to Scoobidiver from comment #4)
> I don't see 20120112 in those reports though. 
By default, the period is set to 1 week. Click on the 4 weeks button.

Comment 7

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

seems like bug 720085 is similar and has STRs.  Tried to repro previously but could not.  Will try to repro on an older build.

Comment 8

[Alex Pakhotin (:alexp)]

Duping to bug 720092, which is about the actual exception in Java code, causing the crash.