745782 - Flash plugin crashing on ICS with checkJNI

Status: RESOLVED WONTFIX

(Firefox for Android Graveyard :: Plugins, defect)

Description

[Nathan Toone [:toonetown]]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/535.18.5 (KHTML, like Gecko) Version/5.2 Safari/535.18.5

Steps to reproduce:

Running fennec (built with android:debuggable=true) on ICS crashes whenever loading the flash plugin.


Actual results:

The crash looks like:  
JNI ERROR (app bug): accessed stale local reference 0x27100065 (index 25 in a table of size 24)


Expected results:

According to the documentation at http://android-developers.blogspot.com/2011/11/jni-local-reference-changes-in-ics.html, ICS was updated to catch some common bug practices.  This one appears to be happening in the section called "Bug: Calling PopLocalFrame() and continuing to use a popped reference".

It appears that using the AutoLocalJNIFrame in the CreateSurface function of widget/android/AndroidBridge.cpp, the deconstructor is being called (which calls PopLocalFrame) and then we are returning a jobject - which is likely to be used in other locations.  This is what appears to be causing the crash.

This seems to happen when running with android:debuggable=true - but in "release" mode, it just has a bug where the object could possibly be garbage collected, and then we try to use it.

As I am not terribly familiar with JNI (or c++, for that matter), I don't know the best way to address this issue, or I would create a patch.  :)

Comment 1

[Nathan Toone [:toonetown]]

The full log (with surrounding messages) is:

I/GeckoAppShell(15427): createSurface
E/dalvikvm(15427): JNI ERROR (app bug): accessed stale local reference 0x27100065 (index 25 in a table of size 24)
E/dalvikvm(15427): VM aborting
F/libc    (15427): Fatal signal 11 (SIGSEGV) at 0xdeadd00d (code=1)

Again - this is when I run the nightly built with debuggable=true - when I run the nightly available for download, I get these log entries:


I/GeckoAppShell(15467): createSurface
I/GeckoAppShell(15467): showSurface:Surface(name=null, identity=0) @ x:20 y:54 w:438 h:267 inverted: false blend: true metadata: {"width":480,"height":690,"pageWidth":480,"pageHeight":690.1224489795918,"zoom":0.4897959183673469,"x":0,"y":0}

(The showSurface call is never made in debuggable=true case)

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Is flash working on debug builds for others?

Comment 3

[Jan Henning [:JanH]]

Flash is going away: bug 1381916.