901705 - [B2G][Unagi][v1.2][Gallery][Contacts][Email] Gallery app crash if user tries to add picture to contact or as an attachment to email.

Status: RESOLVED DUPLICATE of bug 901559

(Core :: Graphics: Layers, defect)

Description

[Nick Davidson]

Attachment: Email-Gallery-Crashlog.txt

Description: When user trying to add picture from gallery to contact or as an attachment to email device crashes and reboots.


Repro Steps:
1) Updated Unagi to Build ID: 20130805070203
2) Tap on contacts app
3) Tap on a "plus" Icon to create new contact fill in first/last name and phone number fields.
4) Tap on "add picture" in contact details and select Gallery option
5) Select picture from gallery by tapping on it
6) Tap on check-mark button to confirm picture selection
OR 
1) Set up email account on a device
2) Open email app and tap on Iconto compose new email
3) Enter email address to "To" field
4) Tap on "paper clip" button to add an attachment and select "Gallery" option
5) Select picture from Gallery that you want to attach so it opens up in single picture view window.
6) Tap on check-mark button on a top, to confirm picture selection

Actual:
Device crashes and reboots

Expected:
User should be able to add picture in contact details or as an attachment to email.

Environmental Variables
Build ID: 20130805070203
Gecko: http://hg.mozilla.org/mozilla-central/rev/ad0ae007aa9e
Gaia: 0ca0dba246d1372eb815772c8108395ab0abd0a4
Platform Version: 25.0a1

Notes:
Repro frequency: 100%, 
See attached: logcat, 
Optional extra notes: I was able to add pic to contacts using camera app.

Comment 1

[Nick Davidson]

Attachment: Contacts-Gallery-Crash-Log.txt

This is crash log when user trying to add picture to contact detailes.

Comment 2

[Nick Davidson]

Device also crash when user trying to select wallpaper picture from Gallery app.

Repro steps:
1) Long tap on a home screen till you will see pop up menu
2) Select Gallery from a menu
3) Tap on a picture you want to set as a wallpaper.
4) Tap on a check-mark button on a top to select this picture for the wallpaper
5) Observe device crashing...

Comment 3

[:gerard-majax]

I think I hit this one ysterday on Inari with current master build. From what I've been able to document so far, it looks like Gallery app gets OOM-killed.

Comment 4

[:gerard-majax]

See my comments in bug 900387, I'll check if the present bug is the same as what I got in bug 900387.

Comment 5

[:gerard-majax]

I'm reproducing this on Inari too, picking a small picture from Gallery to send a MMS

Comment 6

[:gerard-majax]

\o/ https://crash-stats.mozilla.com/report/index/38b8b102-ea47-41bd-aebc-1742e2130806

Comment 7

[Scoobidiver (away)]

(In reply to Alexandre LISSY :gerard-majax from comment #6)
> https://crash-stats.mozilla.com/report/index/38b8b102-ea47-41bd-aebc-
> 1742e2130806
Debug symbols are missing so not exploitable easily.

Comment 8

[:gerard-majax]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 114.242]
0x412ad14a in nsXPConnect::XPConnect () at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/xpcprivate.h:458
458	            MOZ_CRASH();
(gdb) bt
#0  0x412ad14a in nsXPConnect::XPConnect () at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/xpcprivate.h:458
#1  0x413ac5aa in XPCJSRuntime::Get () at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/xpcprivate.h:616
#2  0x413c4c90 in ~XPCJSObjectHolder (this=0x0, __in_chrg=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/XPCWrappedNative.cpp:3410
#3  0x413c4cac in ~XPCJSObjectHolder (this=0x0, __in_chrg=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/XPCWrappedNative.cpp:3411
#4  0x417b5ce0 in mozilla::layers::GrallocBufferActor::ActorDestroy (this=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:257
#5  0x4150d4dc in mozilla::dom::bluetooth::PBluetoothRequestChild::DestroySubtree (this=0x4729607c, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::AbnormalShutdown)
    at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PBluetoothRequestChild.cpp:340
#6  0x4157ee28 in mozilla::layers::PLayerTransactionParent::DestroySubtree (this=0x436b9a10, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::AbnormalShutdown)
    at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PLayerTransactionParent.cpp:873
#7  0x415727c2 in mozilla::layers::PCompositorParent::DestroySubtree (this=0x47837200, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::AbnormalShutdown)
    at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PCompositorParent.cpp:863
#8  0x415727ee in mozilla::layers::PCompositorParent::OnChannelError (this=0x47837200) at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PCompositorParent.cpp:726
#9  0x414fe532 in mozilla::ipc::AsyncChannel::NotifyMaybeChannelError (this=0x4783720c) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/glue/AsyncChannel.cpp:582
#10 0x414fe7ea in mozilla::ipc::AsyncChannel::OnNotifyMaybeChannelError (this=0x4783720c) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/glue/AsyncChannel.cpp:547
#11 0x411781ee in DispatchToMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)()> (this=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/tuple.h:383
#12 RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run (this=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/task.h:307
#13 0x41788c78 in MessageLoop::RunTask (this=0x45de3dec, task=0x0) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:338
#14 0x417899da in MessageLoop::DeferOrRunPendingTask (this=0x4783720c, pending_task=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:346
#15 0x4178a598 in MessageLoop::DoWork (this=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:446
#16 0x4178a824 in base::MessagePumpDefault::Run (this=0x455d0f20, delegate=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_pump_default.cc:23
#17 0x41788c44 in MessageLoop::RunInternal (this=0x0) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:220
#18 0x41788cba in MessageLoop::RunHandler (this=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:213
#19 MessageLoop::Run (this=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:187
#20 0x4178b7f6 in base::Thread::ThreadMain (this=0x451a38b0) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/thread.cc:160
#21 0x4178c3e8 in ThreadFunc (closure=0x1) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/platform_thread_posix.cc:39
#22 0x4005ae18 in __thread_entry (func=0x4178c3e1 <ThreadFunc>, arg=0x451a38b0, tls=<value optimized out>) at bionic/libc/bionic/pthread.c:217
#23 0x4005a96c in pthread_create (thread_out=<value optimized out>, attr=0xbe8b93a8, start_routine=0x4178c3e1 <ThreadFunc>, arg=0x451a38b0) at bionic/libc/bionic/pthread.c:357
#24 0x00000000 in ?? ()

Comment 9

[Nicolas Silva [:nical]]

I just tried 

> Repro Steps:
> 1) Updated Unagi to Build ID: 20130805070203
> 2) Tap on contacts app
> 3) Tap on a "plus" Icon to create new contact fill in first/last name and
> phone number fields.
> 4) Tap on "add picture" in contact details and select Gallery option
> 5) Select picture from gallery by tapping on it
> 6) Tap on check-mark button to confirm picture selection

and

> Repro steps:
> 1) Long tap on a home screen till you will see pop up menu
> 2) Select Gallery from a menu
> 3) Tap on a picture you want to set as a wallpaper.
> 4) Tap on a check-mark button on a top to select this picture for the
> wallpaper
> 5) Observe device crashing...

On my unagi from just after the path for Bug 900012 landed and it did not crash

Comment 10

[Nick Davidson]

Issue still repro on Unagi v 1.2 Build ID: 20130806070205
Gecko: http://hg.mozilla.org/mozilla-central/rev/a0dd80f800e2
Gaia: 49b1f68b0e2152557bb7c2defb2a5f9d7a0648c6
Platform Version: 26.0a1
here is YouTube video of issue repro: http://youtu.be/DIjPw7oZtZ4

Comment 11

[:gerard-majax]

I'm going to bisect this one.

Comment 12

[Jason Smith [:jsmith]]

Milan - We're seeing this OS restart crash consistently on trunk right now. Can you help find an assignee to investigate this?

Comment 13

[Milan Sreckovic [:milan] (needinfo for best results)]

Jeff is looking at all of these under 902643 first.

Comment 15

[George Wright (:gw280) (needinfo me!)]

I can't reproduce this on trunk on my unagi device. I just used both of the steps to reproduce. Is there anything special that needs to be done to seed the gallery app with photos?

Comment 16

[:gerard-majax]

(In reply to George Wright (:gw280 PTO until 26/08/2013) from comment #15)
> I can't reproduce this on trunk on my unagi device. I just used both of the
> steps to reproduce. Is there anything special that needs to be done to seed
> the gallery app with photos?

I don't think so, though I'm reproducing this on Inari. Maybe there's something to do with device or their blobs.

Comment 17

[:gerard-majax]

Marking this one as dup of bug 901705, no need to leave a koi? for triage when there's already a koi+.

Comment 18

[Preeti Raghunath(:Preeti)]

HI David/ Dylan,

The email/ contacts functionality seems to have broken in 1.2. Please reassign appropriately

Comment 19

[Jason Smith [:jsmith]]

(In reply to Preeti Raghunath(:Preeti) from comment #18)
> HI David/ Dylan,
> 
> The email/ contacts functionality seems to have broken in 1.2. Please
> reassign appropriately

The root cause that is causing this bug is graphics, which Milan's team is already looking into this.