721654 - Crash in mozilla::AndroidBridge::HandleGeckoMessage

Status: VERIFIED FIXED

(Core Graveyard :: Widget: Android, defect, P1)

Description

[Scoobidiver (away)]

It first appeared in 12.0a1/20120117 and 11.0a2/20120121.
It's #17 top crasher in 11.0a2 and #26 in 12.0a1.

bp-803f9ce1-9362-4161-8fc0-0c1522120126

Frame 	Module 	Signature 	Source
0 	libdvm.so 	dvmStringLen 	
1 	libdvm.so 	JNI_CreateJavaVM 	
2 	libxul.so 	mozilla::nsJNIString::nsJNIString 	jni.h:834
3 	libxul.so 	mozilla::AndroidBridge::HandleGeckoMessage 	widget/android/AndroidBridge.cpp:1309
4 	libxul.so 	nsAndroidBridge::HandleGeckoMessage 	widget/android/AndroidBridge.cpp:1605
5 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:194
6 	libxul.so 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2895
7 	libxul.so 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1539
8 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:311
9 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:475
10 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:538
11 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5460
12 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1510
13 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:617
14 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:138
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=dvmStringLen%20|%20JNI_CreateJavaVM%20|%20mozilla%3A%3AnsJNIString%3A%3AnsJNIString

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

https://crash-stats.mozilla.com/report/index/6d7f2ddf-a726-4288-ac72-0225f2120128 shows a crash on HTC Desire w/ web page : URL	http://www.4players.de/ w/ 20120126031113 nightly

https://crash-stats.mozilla.com/report/index/8dc0e5c8-682e-4815-b041-dd55f2120124
http://www.shakespearetavern.com/ with build : aurora 20120123042009 on a droid x

Earliest I see this crash in Soccoro: 20120111031049

Comment 3

[Martijn Wargers (dead)]

I got this crash twice now after a while with this testcase:
http://people.mozilla.com/~mwargers/tests/videos/interrogation_winopenclose.htm
Tap on the button, it opens a bunch of windows.
After 10 seconds, Fennec will block the windows, make sure that you choose "Always show" to let the testcase run indefinetely.
Then, reload the page and tap on the button again.

After 5 minutes or so, I got a crash.
https://crash-stats.mozilla.com/report/index/bp-74329974-1413-4428-8e35-638432120416
This was on the HTC Desire HD.

Comment 4

[Martijn Wargers (dead)]

Perhaps, with the str it might be possible to get this fixed (if it reproduces for others too).

Comment 5

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: patch

Comment 6

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: follow up patch

this generally makes me not want to allow creating an nsJNIString without passing a JNIEnv, here's a patch to remove that possibility.

Comment 7

[Brad Lassey [:blassey] (use needinfo?)]

Attachment: new OOM crash

with this patch, these STR still crash the browser, but now it is fairly strait forward OOM it look like we're leaking ReadWriteDirectByteBuffers, which are a subclass of ByteBuffer

Comment 8

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/8c3acc122469
https://hg.mozilla.org/mozilla-central/rev/fbcc959f5616

Comment 10

[Martijn Wargers (dead)]

(In reply to Brad Lassey [:blassey] from comment #7)
> Created attachment 615595 [details]
> new OOM crash
> 
> with this patch, these STR still crash the browser, but now it is fairly
> strait forward OOM it look like we're leaking ReadWriteDirectByteBuffers,
> which are a subclass of ByteBuffer

I filed bug 751588 for this.

Comment 11

[Cristian Nicolae (:xti)]

This crash doesn't occur anymore on the latest Nightly and Aurora builds, if suggestions from comment #3 are followed. 
Closing bug as verified fixed on:

Firefox 15.0a1 (2012-05-29)
Firefox 14.0a2 (2012-05-29)

Device: Galaxy Nexus
OS: Android 4.0.2