crash in _JNIEnv::CallStaticVoidMethod | mozilla::AndroidBridge::SendThumbnail

RESOLVED FIXED in Firefox 25

Status

()

Core
Widget: Android
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Assigned: bnicholson)

Tracking

(4 keywords)

25 Branch
mozilla25
ARM
Android
crash, regression, reproducible, topcrash
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox24 unaffected, firefox25+ fixed, fennec25+)

Details

(Whiteboard: [native-crash], crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
There are five crashes in 25.0a1/20130705. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=dcbbfcdf7bb4&tochange=17fe59f6c54a
I suspect bug 803299 in this range.

Signature 	arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) More Reports Search
UUID 	4b09d4db-add4-47f0-be30-d157e2130705
Date Processed	2013-07-05 18:56:46.437126
Uptime	2115
Install Age 	2115 since version was first installed.
Install Time 	2013-07-05 18:21:23
Product 	FennecAndroid
Version 	25.0a1
Build ID 	20130705031151
Release Channel 	nightly
OS 	Android
OS Version 	0.0.0 Linux 3.4.10-g4c37954 #1 SMP PREEMPT Sat May 4 14:17:28 CST 2013 armv7l brightstarus_wwe/m7/m7
Build Architecture 	arm
Build Architecture Info 	ARMv0 | None
Crash Reason 	SIGSEGV
Crash Address 	0x0
App Notes 	
AdapterDescription: 'Qualcomm -- Adreno (TM) 320 -- OpenGL ES 2.0 V@4.1 AU@3.04.01.01.13.018 (CL@) -- Model: HTC One, Product: m7, Manufacturer: HTC, Hardware: m7'
GL Layers! EGL? EGL+ GL Context? GL Context+ GL Layers+ 
HTC HTC One
brightstarus_wwe/m7/m7:4.1.2/JZO54K/164689.16:user/release-keys
Processor Notes 	sp-processor08_phx1_mozilla_com_12337:2012; non-integer value of "SecondsSinceLastCrash"; exploitability tool: ERROR: unable to analyze dump
Adapter Vendor ID 	Qualcomm
Adapter Device ID 	Adreno (TM) 320
Android CPU ABI 	armeabi-v7a
Android Manufacturer 	HTC
Android Model 	HTC One
Android Version 	16 (REL)

Frame 	Module 	Signature 	Source
0 	libandroid_runtime.so 	libandroid_runtime.so@0x75c7e 	
...
27 	libdvm.so 	libdvm.so@0x4f383 	
28 	libxul.so 	_JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) 	android-ndk/platforms/android-9/arch-arm/usr/include/jni.h
29 	libxul.so 	mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) 	widget/android/AndroidBridge.cpp
30 	libxul.so 	ThumbnailRunnable::Run() 	widget/android/nsAppShell.cpp
31 	libxul.so 	RunnableMethod<IPC::ChannelProxy::Context, void (IPC::ChannelProxy::Context::*)(), Tuple0>::Run() 	ipc/chromium/src/base/tuple.h
32 	libxul.so 	MessageLoop::RunTask(Task*) 	ipc/chromium/src/base/message_loop.cc
33 	libxul.so 	MessageLoop::ProcessNextDelayedNonNestableTask() 	ipc/chromium/src/base/message_loop.cc
34 	libxul.so 	MessageLoop::DoIdleWork() 	ipc/chromium/src/base/message_loop.cc
35 	libxul.so 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
36 	libxul.so 	MessageLoop::RunInternal() 	ipc/chromium/src/base/message_loop.cc
37 	libxul.so 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
38 	libxul.so 	nsBaseAppShell::Run() 	widget/xpwidgets/nsBaseAppShell.cpp
39 	libxul.so 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
40 	libxul.so 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
41 	libxul.so 	XREMain::XRE_main(int, char**, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
42 	libxul.so 	XRE_main 	toolkit/xre/nsAppRunner.cpp

More reports at:
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=arena_malloc+|+arena_dalloc+|+_JNIEnv%3A%3ACallStaticVoidMethod%28_jclass*%2C+_jmethodID*%2C+...%29+|+mozilla%3A%3AAndroidBridge%3A%3ASendThumbnail%28_jobject*%2C+int%2C+bool%29
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=arena_malloc
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=libc+malloc+%28deleted%29%400x4e826
(Reporter)

Comment 1

5 years ago
Three more crashes found: https://crash-stats.mozilla.com/report/list?product=FennecAndroid&signature=_ZN17AutoDecoderCancel13RequestCancelEP8_jobject
tracking-fennec: --- → ?
Crash Signature: [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool)] [@ arena_malloc ] [@ libc malloc (deleted)@0x4e826 ] [@ system@framework@framework.jar@classes.dex… → [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool)] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject ] [@ arena_malloc ] [@ libc malloc (deleted)@0…
tracking-firefox25: --- → ?
Keywords: topcrash
(Reporter)

Comment 2

5 years ago
Silly bug 865146.
Crash Signature: [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool)] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject ] [@ arena_malloc ] [@ libc malloc (deleted)@0… → [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc] [@ libc malloc (deleted)@0x…
(Reporter)

Updated

5 years ago
Crash Signature: [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc] [@ libc malloc (deleted)@0x… → [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc | arena_dalloc | nsTArray_Imp…
(Reporter)

Updated

5 years ago
Crash Signature: [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc | arena_dalloc | nsTArray_Imp… → [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc | arena_dalloc | nsTArray_Imp…
(Reporter)

Updated

5 years ago
Duplicate of this bug: 891458
Assignee: nobody → bnicholson
tracking-fennec: ? → 25+

Updated

5 years ago
tracking-firefox25: ? → +
(Assignee)

Comment 4

5 years ago
Looking through the crash reports, this only appears to be a problem on Nexus 4/7.
Summary: crash in _JNIEnv::CallStaticVoidMethod | mozilla::AndroidBridge::SendThumbnail → crash in _JNIEnv::CallStaticVoidMethod | mozilla::AndroidBridge::SendThumbnail on Nexus 4/7
(Assignee)

Comment 5

5 years ago
I've had no luck reproducing this on a Nexus 4. Some STR would be helpful.
Keywords: steps-wanted
(Reporter)

Comment 6

5 years ago
(In reply to Brian Nicholson (:bnicholson) from comment #4)
> Looking through the crash reports, this only appears to be a problem on
> Nexus 4/7.
I disagree. There is bunch of signatures (more than the links in comment 0 and comment 1).
It would be easier to aggregate them if bug 764756 and bug 893585 were fixed.
Crash Signature: [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc | arena_dalloc | nsTArray_Imp… → [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc | arena_dalloc | nsTArray_Imp…
Depends on: 893585
Summary: crash in _JNIEnv::CallStaticVoidMethod | mozilla::AndroidBridge::SendThumbnail on Nexus 4/7 → crash in _JNIEnv::CallStaticVoidMethod | mozilla::AndroidBridge::SendThumbnail
I am able to reproduce this with some regularity by 
* setting Firefox to restore tabs on restart
* quitting Firefox
* starting Firefox
* clicking on the tab switcher button quickly

Not 100% but often this works.
Keywords: steps-wanted
(Reporter)

Updated

5 years ago
Keywords: reproducible
(Assignee)

Comment 8

5 years ago
Created attachment 779534 [details] [diff] [review]
Don't reuse tab's bitmap when updating thumbnail

It looks like the crash here is actually happening in Java. I found that the crash was always happening during the BGRA->ARGB conversion in processThumbnailData(), which was added as part of the 24-bit color support. Since we're holding onto the actual bitmap used in the BitmapDrawable shown in the tabs tray, I assume we're running into problems when updating the bitmap while it's simultaneously being shown in the UI.

Rather than reusing the tab's existing bitmap, this patch creates a new one whenever we update the thumbnail. This seems to fix the crash for me, although I can't be completely sure since the crash is intermittent with the STR.
Attachment #779534 - Flags: review?(bugmail.mozilla)
(Assignee)

Updated

5 years ago
Status: NEW → ASSIGNED
(Assignee)

Comment 9

5 years ago
Comment on attachment 779534 [details] [diff] [review]
Don't reuse tab's bitmap when updating thumbnail

After spending all day debugging this, Chris just posted a patch that removes the BGRA->ARGB code from Java altogether and moves the logic to Gecko. So much for this patch.
Attachment #779534 - Flags: review?(bugmail.mozilla)
(Assignee)

Comment 10

5 years ago
I think bug 896822 will fix this, but leaving open for now to be sure the crash disappears.
Depends on: 896822
(Reporter)

Updated

5 years ago
Blocks: 803299
(Reporter)

Updated

5 years ago
Crash Signature: [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ _ZN17AutoDecoderCancel13RequestCancelEP8_jobject] [@ arena_malloc | arena_dalloc | nsTArray_Imp… → [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) | mozilla::AndroidBridge::SendThumbnail(_jobject*, int, bool) ] [@ arena_malloc | arena_dalloc | _JNIEnv::CallStaticVoidMethod(_jclass*, _jmethodID*, ...) ] [@ _Z…
(Reporter)

Comment 11

5 years ago
(In reply to Brian Nicholson (:bnicholson) from comment #10)
> I think bug 896822 will fix this, but leaving open for now to be sure the
> crash disappears.
There have been no crashes since 25.0a1/20130725 so it's indeed fixed by that patch.
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
status-firefox25: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.