Last Comment Bug 721654 - Crash in mozilla::AndroidBridge::HandleGeckoMessage
: Crash in mozilla::AndroidBridge::HandleGeckoMessage
Status: VERIFIED FIXED
[native-crash]
: crash, reproducible
Product: Core
Classification: Components
Component: Widget: Android (show other bugs)
: Trunk
: ARM Android
: P1 critical (vote)
: mozilla14
Assigned To: Brad Lassey [:blassey] (use needinfo?)
:
Mentors:
: 722770 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-01-27 00:23 PST by Scoobidiver (away)
Modified: 2012-05-30 02:12 PDT (History)
8 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
verified
verified
+


Attachments
patch (676 bytes, patch)
2012-04-16 14:26 PDT, Brad Lassey [:blassey] (use needinfo?)
bugmail: review+
Details | Diff | Splinter Review
follow up patch (3.82 KB, patch)
2012-04-16 15:32 PDT, Brad Lassey [:blassey] (use needinfo?)
bugmail: review+
Details | Diff | Splinter Review
new OOM crash (16.74 KB, text/plain)
2012-04-16 19:36 PDT, Brad Lassey [:blassey] (use needinfo?)
no flags Details

Description Scoobidiver (away) 2012-01-27 00:23:57 PST
It first appeared in 12.0a1/20120117 and 11.0a2/20120121.
It's #17 top crasher in 11.0a2 and #26 in 12.0a1.

bp-803f9ce1-9362-4161-8fc0-0c1522120126

Frame 	Module 	Signature 	Source
0 	libdvm.so 	dvmStringLen 	
1 	libdvm.so 	JNI_CreateJavaVM 	
2 	libxul.so 	mozilla::nsJNIString::nsJNIString 	jni.h:834
3 	libxul.so 	mozilla::AndroidBridge::HandleGeckoMessage 	widget/android/AndroidBridge.cpp:1309
4 	libxul.so 	nsAndroidBridge::HandleGeckoMessage 	widget/android/AndroidBridge.cpp:1605
5 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:194
6 	libxul.so 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2895
7 	libxul.so 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1539
8 	libxul.so 	js::Interpret 	js/src/jscntxtinlines.h:311
9 	libxul.so 	js::RunScript 	js/src/jsinterp.cpp:475
10 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:538
11 	libxul.so 	JS_CallFunctionValue 	js/src/jsapi.cpp:5460
12 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1510
13 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:617
14 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:138
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=dvmStringLen%20|%20JNI_CreateJavaVM%20|%20mozilla%3A%3AnsJNIString%3A%3AnsJNIString
Comment 1 Naoki Hirata :nhirata (please use needinfo instead of cc) 2012-01-30 12:07:19 PST
https://crash-stats.mozilla.com/report/index/6d7f2ddf-a726-4288-ac72-0225f2120128 shows a crash on HTC Desire w/ web page : URL	http://www.4players.de/ w/ 20120126031113 nightly

https://crash-stats.mozilla.com/report/index/8dc0e5c8-682e-4815-b041-dd55f2120124
http://www.shakespearetavern.com/ with build : aurora 20120123042009 on a droid x

Earliest I see this crash in Soccoro: 20120111031049
Comment 2 Scoobidiver (away) 2012-03-29 06:48:00 PDT
*** Bug 722770 has been marked as a duplicate of this bug. ***
Comment 3 Martijn Wargers [:mwargers] (not working for Mozilla) 2012-04-16 09:52:15 PDT
I got this crash twice now after a while with this testcase:
http://people.mozilla.com/~mwargers/tests/videos/interrogation_winopenclose.htm
Tap on the button, it opens a bunch of windows.
After 10 seconds, Fennec will block the windows, make sure that you choose "Always show" to let the testcase run indefinetely.
Then, reload the page and tap on the button again.

After 5 minutes or so, I got a crash.
https://crash-stats.mozilla.com/report/index/bp-74329974-1413-4428-8e35-638432120416
This was on the HTC Desire HD.
Comment 4 Martijn Wargers [:mwargers] (not working for Mozilla) 2012-04-16 09:56:21 PDT
Perhaps, with the str it might be possible to get this fixed (if it reproduces for others too).
Comment 5 Brad Lassey [:blassey] (use needinfo?) 2012-04-16 14:26:42 PDT
Created attachment 615470 [details] [diff] [review]
patch
Comment 6 Brad Lassey [:blassey] (use needinfo?) 2012-04-16 15:32:57 PDT
Created attachment 615500 [details] [diff] [review]
follow up patch

this generally makes me not want to allow creating an nsJNIString without passing a JNIEnv, here's a patch to remove that possibility.
Comment 7 Brad Lassey [:blassey] (use needinfo?) 2012-04-16 19:36:23 PDT
Created attachment 615595 [details]
new OOM crash

with this patch, these STR still crash the browser, but now it is fairly strait forward OOM it look like we're leaking ReadWriteDirectByteBuffers, which are a subclass of ByteBuffer
Comment 9 Chris Peterson [:cpeterson] 2012-04-20 10:26:28 PDT
*** Bug 746926 has been marked as a duplicate of this bug. ***
Comment 10 Martijn Wargers [:mwargers] (not working for Mozilla) 2012-05-03 08:55:44 PDT
(In reply to Brad Lassey [:blassey] from comment #7)
> Created attachment 615595 [details]
> new OOM crash
> 
> with this patch, these STR still crash the browser, but now it is fairly
> strait forward OOM it look like we're leaking ReadWriteDirectByteBuffers,
> which are a subclass of ByteBuffer

I filed bug 751588 for this.
Comment 11 Cristian Nicolae (:xti) 2012-05-30 02:12:42 PDT
This crash doesn't occur anymore on the latest Nightly and Aurora builds, if suggestions from comment #3 are followed. 
Closing bug as verified fixed on:

Firefox 15.0a1 (2012-05-29)
Firefox 14.0a2 (2012-05-29)

Device: Galaxy Nexus
OS: Android 4.0.2

Note You need to log in before you can comment on or make changes to this bug.