764392 - crash [@ TouchBadMemory | mozalloc_abort | org.mozilla.firefox_beta-1.apk@0x77682e ]

Status: RESOLVED DUPLICATE of bug 746730

(Firefox for Android Graveyard :: General, defect)

Description

[Cristian Nicolae (:xti)]

This bug was filed from the Socorro interface and is 
report bp-9b452efb-ec43-4894-ad4b-773d62120613 .
============================================================= 

Frame 	Module 	Signature 	Source
0 	libmozalloc.so 	TouchBadMemory 	memory/mozalloc/mozalloc_abort.cpp:68
1 	libmozalloc.so 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:89
2 	dalvik-heap (deleted) 	dalvik-heap @0x7aa11f 	
3 	dalvik-mark-stack (deleted) 	dalvik-mark-stack @0x31a8f40 	
4 	org.mozilla.firefox_beta-1.apk 	org.mozilla.firefox_beta-1.apk@0x77682e 	
5 	dalvik-heap (deleted) 	dalvik-heap @0xe9cc66b 	
6 	dalvik-mark-stack (deleted) 	dalvik-mark-stack @0x32db273 	
7 	libflashplayer.so 	libflashplayer.so@0x45682c 	
8 	libflashplayer.so 	libflashplayer.so@0x462038 	
9 	dalvik-heap (deleted) 	dalvik-heap @0xccce577 	
10 	dalvik-heap (deleted) 	dalvik-heap @0x6a9f263 	
11 	libxul.so 	nsACString_internal::AppendFunc 	nsTSubstring.h:388
12 	libnspr4.so 	FuncStuff 	nsprpub/pr/src/io/prprf.c:1075
13 	libnspr4.so 	fill_n 	nsprpub/pr/src/io/prprf.c:237
14 		@0x64 	
15 	libxul.so 	nsACString_internal::ReplaceASCII 	xpcom/string/src/nsTSubstring.cpp:503
16 	libxul.so 	nsACString_internal::AppendFunc 	nsTSubstring.h:388
17 	libnspr4.so 	FuncStuff 	nsprpub/pr/src/io/prprf.c:1075
18 	libnspr4.so 	dosprintf 	nsprpub/pr/src/io/prprf.c:1060
19 	libnspr4.so 	PR_vsxprintf 	nsprpub/pr/src/io/prprf.c:1105
20 		@0x610dba5e 	
21 	app_process 	app_process@0xcd4 	
22 	libxul.so 	mozilla::layers::LayerManagerOGL::CreateFBOWithTexture 	gfx/layers/opengl/LayerManagerOGL.cpp:1251
23 	libxul.so 	mozilla::layers::ShadowContainerLayerOGL::RenderLayer 	gfx/layers/opengl/ContainerLayerOGL.cpp:215
24 	libxul.so 	mozilla::layers::ShadowContainerLayerOGL::RenderLayer 	gfx/layers/opengl/ContainerLayerOGL.cpp:252
25 	libxul.so 	mozilla::layers::ShadowContainerLayerOGL::RenderLayer 	gfx/layers/opengl/ContainerLayerOGL.cpp:252
26 	libxul.so 	mozilla::layers::ShadowContainerLayerOGL::RenderLayer 	gfx/layers/opengl/ContainerLayerOGL.cpp:252
27 	libxul.so 	mozilla::layers::LayerManagerOGL::Render 	gfx/layers/opengl/LayerManagerOGL.cpp:833
28 	libxul.so 	mozilla::layers::LayerManagerOGL::EndTransaction 	gfx/layers/opengl/LayerManagerOGL.cpp:468
29 	libxul.so 	mozilla::layers::LayerManagerOGL::EndEmptyTransaction 	gfx/layers/opengl/LayerManagerOGL.cpp:441
30 	libxul.so 	mozilla::layers::CompositorParent::Composite 	gfx/layers/ipc/CompositorParent.cpp:259
31 	libxul.so 	RunnableMethod<mozilla::layers::CompositorParent, void , Tuple0>::Run 	ipc/chromium/src/base/tuple.h:383
32 	libxul.so 	MessageLoop::RunTask 	ipc/chromium/src/base/message_loop.cc:318
33 	libxul.so 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/message_loop.cc:326
34 	libxul.so 	MessageLoop::DoWork 	ipc/chromium/src/base/message_loop.cc:426
35 	libxul.so 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/message_pump_default.cc:23
36 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:208
37 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:201
38 	libxul.so 	base::Thread::ThreadMain 	ipc/chromium/src/base/thread.cc:156
39 	libxul.so 	ThreadFunc 	ipc/chromium/src/base/platform_thread_posix.cc:26
40 	libc.so 	libc.so@0x12c1e 	
41 	libc.so 	libc.so@0x12772

Steps to reproduce:
1. Open Fennec
2. Browse to http://www.infoturism.ro/litoral//oferte-cazare-sejur/ (desktop version)
3. On the top-left side of the page, from "Destinatie" tap on a drop down list ("Alege Tara" or "Alege Orasul")
4. Tap on the first option from the drop down list (the first option name is set between " --    -- "

Expected result:
No crash occurs after step 4.

Actual result:
Fennec crashes after step 4.

--
Firefox 14.0b7 (2012-06-13)
Device: Galaxy Nexus
OS: Android 4.0.2