Last Comment Bug 749917 - crash in mozilla::AndroidBridge::CheckURIVisited
: crash in mozilla::AndroidBridge::CheckURIVisited
: crash, intermittent-failure, qawanted
Product: Core
Classification: Components
Component: Widget: Android (show other bugs)
: Trunk
: ARM Android
-- critical (vote)
: mozilla16
Assigned To: Brad Lassey [:blassey] (use needinfo?)
: Jim Chen [:jchen] [:darchons]
Depends on: 741222 741315 748531
Blocks: 438871 747787
  Show dependency treegraph
Reported: 2012-04-28 01:09 PDT by Scoobidiver (away)
Modified: 2013-12-10 10:00 PST (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch to check for the exception (911 bytes, patch)
2012-07-02 10:55 PDT, Brad Lassey [:blassey] (use needinfo?)
bugmail: review+
Details | Diff | Splinter Review

Description User image Scoobidiver (away) 2012-04-28 01:09:24 PDT
There's one crash in 15.0a1/20120427.

Signature 	_JNIEnv::NewString More Reports Search
UUID	f0505ef0-67c8-4796-8a08-801202120428
Date Processed	2012-04-28 07:39:04
Uptime	3125
Last Crash	52.1 minutes before submission
Install Age	1.0 hours since version was first installed.
Install Time	2012-04-28 06:33:40
Product	FennecAndroid
Version	15.0a1
Build ID	20120427030500
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux #1 SMP PREEMPT Thu Dec 1 06:02:53 KST 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0xdeadd00d
App Notes 	
EGL? EGL+ AdapterVendorID: lu6500, AdapterDeviceID: LG-LU6500.
AdapterDescription: 'Android, Model: 'LG-LU6500', Product: 'lge_bssq', Manufacturer: 'LGE', Hardware: 'lu6500''.
GL Context? GL Context+ GL Layers? GL Layers+ 
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
1 	dalvik-heap (deleted) 	dalvik-heap @0x54eae6 	
3 	dalvik-heap (deleted) 	dalvik-heap @0x54eae6 	
5 	_JNIEnv::NewString 	jni.h:828
6 	mozilla::AndroidBridge::CheckURIVisited 	widget/android/AndroidBridge.cpp:1551
7 	nsAndroidHistory::RegisterVisitedCallback 	toolkit/components/places/nsAndroidHistory.cpp:86
8 	mozilla::dom::Link::LinkState 	content/base/src/Link.cpp:127
9 	EnumeratePendingLinkUpdates 	content/base/src/nsDocument.cpp:8087
10 	nsTHashtable<nsPtrHashKey<mozilla::dom::Link> >::s_EnumStub 	nsTHashtable.h:500
11 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.cpp:750
12 	nsIDocument::FlushPendingLinkUpdates 	nsTHashtable.h:251
13 	nsCSSFrameConstructor::ResolveStyleContext 	layout/base/nsCSSFrameConstructor.cpp:4551
14 	nsCSSFrameConstructor::ResolveStyleContext 	layout/base/nsCSSFrameConstructor.cpp:4542
15 	nsCSSFrameConstructor::AddFrameConstructionItems 	layout/base/nsCSSFrameConstructor.cpp:4995
16 	nsCSSFrameConstructor::ContentAppended 	layout/base/nsCSSFrameConstructor.cpp:6581
17 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6272
18 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
19 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
20 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
21 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
22 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
23 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
24 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
25 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
26 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6282
27 	nsCSSFrameConstructor::CreateNeededFrames 	layout/base/nsCSSFrameConstructor.cpp:6297
28 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:3969
29 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6383
30 	nsGenericElement::GetPrimaryFrame 	content/base/src/nsGenericElement.cpp:3963
31 	nsGenericElement::GetStyledFrame 	content/base/src/nsGenericElement.cpp:2047
32 	nsGenericElement::GetScrollFrame 	content/base/src/nsGenericElement.cpp:2087
33 	nsGenericElement::GetScrollTop 	content/base/src/nsGenericElement.cpp:2123
34 	nsIDOMElement_GetScrollTop 	obj-firefox/js/xpconnect/src/dom_quickstubs.cpp:4443
35 	js_GetProperty 	js/src/jscntxtinlines.h:364
36 	JSObject::getGeneric 	js/src/jsobjinlines.h:194
37 	js::Interpret 	js/src/jsobjinlines.h:209
38 	js::RunScript 	js/src/jsinterp.cpp:475
39 	js::InvokeKernel 	js/src/jsinterp.cpp:535
40 	js_fun_apply 	js/src/jsinterp.h:172
41 	js::Interpret 	js/src/jscntxtinlines.h:314
42 	js::RunScript 	js/src/jsinterp.cpp:475
43 	js::Invoke 	js/src/jsinterp.cpp:535
44 	JS_CallFunctionValue 	js/src/jsapi.cpp:5416

More reports at:
Comment 1 User image Scoobidiver (away) 2012-05-18 03:39:16 PDT
Those crashes appeared again in 15.0a1/20120517. The related regression range is:
Comment 2 User image Kartikaya Gupta ( 2012-05-18 13:14:56 PDT
This appears to be the same issue as bug 749687, even though the crash stack is slightly different. In both cases it's the call to JNIEnv::NewString that's failing, and in both cases there's a URI stored in the JSON-serialized data. I looked at the nsPromiseFlatString stuff and it looks ok to me, so I don't think that's the problem. My guess is that perhaps the actual string data sent by gecko doesn't line up with the version of unicode that dalvik is using.

qawanted to try to reliably reproduce this problem. My guess is that it may happen if you visit pages with weird unicode characters in the URL. It may also depend on the version of android being used, so best to try reproducing on the same device/version that these crashes were seen on.
Comment 8 User image Brad Lassey [:blassey] (use needinfo?) 2012-07-02 10:47:43 PDT
Relevant part of the log:
06-26 04:38:44.206 E/dalvikvm-heap( 1952): Out of memory on a 924472-byte allocation.
06-26 04:38:44.206 W/GeckoGlobalHistory( 1952): Rebuilding visited link set...
06-26 04:38:44.206 W/dalvikvm( 1952): JNI WARNING: JNI method called with exception raised
06-26 04:38:44.206 W/dalvikvm( 1952):              in Lorg/mozilla/gecko/GeckoAppShell;.nativeRun (Ljava/lang/String;)V (CallStaticVoidMethodV)
06-26 04:38:44.206 W/dalvikvm( 1952): Pending exception is:
06-26 04:38:44.206 E/dalvikvm( 1952): VM aborting
Comment 9 User image Brad Lassey [:blassey] (use needinfo?) 2012-07-02 10:55:32 PDT
Created attachment 638416 [details] [diff] [review]
patch to check for the exception
Comment 10 User image Brad Lassey [:blassey] (use needinfo?) 2012-07-03 11:06:53 PDT
Comment 11 User image Ryan VanderMeulen [:RyanVM] 2012-07-03 16:07:02 PDT

Note You need to log in before you can comment on or make changes to this bug.