809459 - SIGSEGV on startup in ClearOnShutdown<mozilla::StaticAutoPtr<nsTArray<nsCOMPtr<nsISmsRequest> > > >

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Gian-Carlo Pascutto [:gcp]]

Android 3.2, Galaxy Tab 10.1

Current m-c is unusable due to a startup crash:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 4173]
Background-loading /system/vendor/lib/egl/libsurfaceflinger_client.so.
Background-loading /system/vendor/lib/drm/libquramimagecodec.so.
Background-loading /system/vendor/lib/drm/libjpeg.so.
0x644bc2a4 in ?? ()
Waiting for libraries from device... Done
Loading symbols... Done
(gdb) bt
#0  0x644bc2a4 in ClearOnShutdown<mozilla::StaticAutoPtr<nsTArray<nsCOMPtr<nsISmsRequest> > > > (
    aPtr=<optimized out>) at ../../dist/include/mozilla/ClearOnShutdown.h:77
#1  mozilla::AndroidBridge::ConstructBridge (jEnv=0x38e590, jGeckoAppShellClass=0x40864c80)
    at /home/morbo/hg/mozilla-central/widget/android/AndroidBridge.cpp:86
#2  0x644c2f34 in Java_org_mozilla_gecko_GeckoAppShell_nativeInit (jenv=0x68, jc=0x5d5896c8)
    at /home/morbo/hg/mozilla-central/widget/android/AndroidJNI.cpp:55
#3  0x80b17cb0 in Java_org_mozilla_gecko_GeckoAppShell_nativeInit (jenv=0x68, jc=0x5d5896c8)
    at /home/morbo/hg/mozilla-central/mozglue/android/APKOpen.cpp:309
#4  0xaca11d38 in ?? ()
#5  0xaca11d38 in ?? ()

Comment 1

[Gian-Carlo Pascutto [:gcp]]

Note the assertion failure here in the same function here:

I/Gecko   ( 3982): WARNING: XPCOM objects created/destroyed from static ctor/dtor: file /home/morbo/hg/mozilla-central/xpcom/base/nsTraceRefcntImpl.cpp, line 141
F/MOZ_Assert( 3982): Assertion failure: NS_IsMainThread_P(), at ../../dist/include/mozilla/ClearOnShutdown.h:77
I/DEBUG   ( 3847): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   ( 3847): Build fingerprint: 'samsung/GT-P7510/GT-P7510:3.2/HTJ85B/UEKMP:user/release-keys'
I/DEBUG   ( 3847): pid: 3982, tid: 4011  >>> org.mozilla.fennec_morbo <<<
I/DEBUG   ( 3847): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000000
I/DEBUG   ( 3847):  r0 00000068  r1 5c7446c8  r2 0000007b  r3 00000000
I/DEBUG   ( 3847):  r4 5ca480a8  r5 6571b544  r6 002de630  r7 5c744b20
I/DEBUG   ( 3847):  r8 40882cf8  r9 40122f8c  10 40122f78  fp fffffe90
I/DEBUG   ( 3847):  ip afc03108  sp 5c744b18  lr 63fff29d  pc 63fff2a4  cpsr 60000030
I/DEBUG   ( 3847):  d0  000000a043200000  d1  0000000043200000
I/DEBUG   ( 3847):  d2  000000ff00000099  d3  4200000042300000
I/DEBUG   ( 3847):  d4  0000000041380000  d5  0000000041380000
I/DEBUG   ( 3847):  d6  c3e0000000000000  d7  41adcd6500000000
I/DEBUG   ( 3847):  d8  3f00000000000000  d9  0000000000000000
I/DEBUG   ( 3847):  d10 0000000000000000  d11 0000000000000000
I/DEBUG   ( 3847):  d12 0000000000000000  d13 0000000000000000
I/DEBUG   ( 3847):  d14 0000000000000000  d15 0000000000000000
I/DEBUG   ( 3847):  scr 60000013
I/DEBUG   ( 3847):

Comment 2

[Justin Lebar (not reading bugmail)]

> #0  0x644bc2a4 in ClearOnShutdown<mozilla::StaticAutoPtr<nsTArray<nsCOMPtr<nsISmsRequest> > > > (
>     aPtr=<optimized out>) at ../../dist/include/mozilla/ClearOnShutdown.h:77

This line is

  MOZ_ASSERT(NS_IsMainThread());

which is a pretty strong hint, assuming this is a debug build...

Comment 3

[Doug Turner (:dougt)]

can we use this bug to remove sms support on android?

Comment 4

[Gian-Carlo Pascutto [:gcp]]

justin: Yes, the code is fiddling with COMPtr's off the main thread.

dougt: I have no idea what exactly what that entails. What I do know is that this bug completely blocks debugging on Android... Remove everything that is inside MOZ_WEBSMS_BACKEND right now?

I complained in the other bug because I saw no point in #ifdef'ing the crashing code out if we *know* it can never work as written.

Comment 5

[Gian-Carlo Pascutto [:gcp]]

>Remove everything that is inside MOZ_WEBSMS_BACKEND right now?

A quick inspection shows that there is WebSMS code scattered throughout the Android sources, so no, that isn't going to work.

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Fixed in bug 775997. Will take the question of what to do with the code to another bug as it was obvious on IRC there are more serious issues than just this crash.

Comment 7

[Gian-Carlo Pascutto [:gcp]]

Bug 809916 for discussion on how to proceed.