I can reliably reproduce a crash on my Samsung Galaxy S (GT-i9000) by rotating from portrait to landscape. I do not see this crash when rotating from landscape to portrait. https://crash-stats.mozilla.com/report/index/bp-1bb6b1de-e0c0-4a25-8175-9902f2111223 this is what I see on the logcat from just before the rotation to after the crash http://pastebin.mozilla.org/1418121

Getting this on my Nexus S with ICS. Crash report below https://crash-stats.mozilla.com/report/index/fe2688b8-0797-4d46-9441-9a5cd2111223

I crash with this signature with the 12/23* build bug not with the 12/22** build so, the regression range is from ed47a41ba26a to c5b90ea7e475: 83196 Myk Melez <myk@mozilla.org> no bug - update revision of Add-on SDK being tested; test-only 83197 Pranav Ravichandran <prp.1111@gmail.com> Bug 710997 - Fix incorrect assignment in PuppetWidget::DispatchPaintEvent(). r=cjones 83198 Steffen Wilberg <steffen.wilberg@web.de> Bug 712614: extensions.js never stops observing extensions.update.enabled. r=mossop 83199 James Willcox <jwillcox@mozilla.com> Bug 670930 - Add Android direct texture implementation 83200 James Willcox <jwillcox@mozilla.com> Bug 670930 - Use asynchronous direct texturing on Android when available 83201 Matt Brubeck <mbrubeck@mozilla.com> Bug 709921 - (followup) Update strings about:config to say "Settings" instead of "Preferences" [r=mfinkle] 83202 Matt Brubeck <mbrubeck@mozilla.com> Bug 710960 - Make runtests.py work out of the box with MOZ_BUILD_APP=mobile/xul [r=ctalbert] 83203 Gregory Szorc <gps@mozilla.com> Bug 710961 - Carry over syncGUID generated when install is staged; r=Mossop 83204 Margaret Leibovic <margaret.leibovic@gmail.com> backout 243520b7d8c3 because it broke the autocomplete popup text 83205 Ed Morley <bmo@edmorley.co.uk> Merge mozilla-central to mozilla-inbound 83206 Wes Johnston <wjohnston@mozilla.com> Bug 700527 - Master password support for native fennec. r=mfinkle 83207 Mark Finkle <mfinkle@mozilla.com> Bug 712414 - Throbber does not stop after running on pages that use document.write without document.close [r=mbrubeck] 83208 Sriram Ramasubramanian <sriram@mozilla.com> Bug 712477: Landscape specific resources should be used in Android [r=mfinkle] 83209 Boris Zbarsky <bzbarsky@mit.edu> Bug 710917. Moving hover from a button to text in the label containing the button should keep the button's hover state. r=dbaron 83210 Boris Zbarsky <bzbarsky@mit.edu> Bug 302566. Show canvas fallback content when script is disabled. r=tnikkel 83211 aceman <acelists@atlas.sk> Bug 711721 - merge nsIScriptError and nsIScriptError2 interfaces; r=neil, sr=bzbarsky 83212 Boris Zbarsky <bzbarsky@mit.edu> Bug 711557. Expose js::ObjectClass via friendapi. r=waldo 83213 Boris Zbarsky <bzbarsky@mit.edu> Bug 700221. Don't pay attention to whether author color are allowed when deciding whether a change to a non-color property should drop native theming. r=dbaron 83214 Rafael Ávila de Espíndola <respindola@mozilla.com> Bug 711447 - Close connection in nsPermissionManager. r=dwitte. 83215 Steven Michaud <smichaud@pobox.com> Bug 356742 - Implement nsCocoaWindow::ConstrainPosition(). r=mnyromyr 83216 Steffen Wilberg <steffen.wilberg@web.de> Bug 712766: Replace the buildid by an easily readable build date in about:. r=mfinkle 83217 Frédéric Wang <fred.wang@free.fr> Add a directionality flag on MathML frames (bug 534963). r=karlt 83218 Frédéric Wang <fred.wang@free.fr> Overall Directionality of formulas (bug 534963). r=karlt 83219 Frédéric Wang <fred.wang@free.fr> Add MathML reftests for dir=rtl (bug 534963). r=karlt 83220 Frédéric Wang <fred.wang@free.fr> Make lspace/rspace in mo behave as leading/trailing spaces (bug 534963). r=karlt 83221 Frédéric Wang <fred.wang@free.fr> Add MathML reftests for lspace/rspace in dir=rtl (bug 534963). r=karlt 83222 Frédéric Wang <fred.wang@free.fr> Mirroring of operators for arabic math (Bug 208309) - part 1. r=karlt 83223 Frédéric Wang <fred.wang@free.fr> Mirroring of operators for arabic math (Bug 208309) - part 2. r=karlt 83224 Frédéric Wang <fred.wang@free.fr> Reftests for bug 208309: mirroring of some mo characters in MathML. r=karlt 83225 Chris Pearce <chris@pearce.org.nz> Bug 712134 - Log media load algorithm failures to web console. r=roc 83226 David Mandelin <dmandelin@mozilla.com> Bug 710970: remove never-failed null check found by PVS-Studio, r=dvander 83227 David Mandelin <dmandelin@mozilla.com> Bug 711480: remove stray semicolon from conditional, rs=dvander 83228 Brad Lassey <blassey@mozilla.com> bug 712719 - NullPointerException at org.mozilla.gecko.GeckoAppShell.notifyIMEEnabled r=dougt 83229 Makoto Kato <m_kato@ga2.so-net.ne.jp> bug 693280 - Android DNS lookup port is incorrect usage for external function defines. r=glandium 83230 Terrence Cole <terrence@mozilla.com> Bug 712488 - Add missing barrier in jsfunction clone; r=billm 83231 Justin Lebar <justin.lebar@gmail.com> Bug 694862 - Implement navigator.mozVibrate for Gonk, r=cjones 83232 Chris Jones <jones.chris.g@gmail.com> Bug 712226 - Crash when fclose(NULL)'ing a battery-status FILE*, r=mwu 83233 Justin Lebar <justin.lebar@gmail.com> Bug 712665 - Fix GonkHal.cpp debug compile errors. r=mwu 83234 Terrence Cole <terrence@mozilla.com> Bug 712793 - Add browserIsRemote to test condition testing code; r=jwalden 83235 Jeff Walden <jwalden@mit.edu> Bug 711647 - Add MOZ_DELETE to a bunch of deliberately-not-implemented methods across the tree. r=dbaron 83236 Jeff Walden <jwalden@mit.edu> Bug 704687 - Mark final classes as MOZ_FINAL, now that nsDerivedSafe no longer exists again. r=dbaron 83237 Jeff Walden <jwalden@mit.edu> Bug 712129 - Move assertion code into a new mfbt/Assertions.h header. r=luke 83238 Jeff Walden <jwalden@mit.edu> Bug 712129 - Move MOZ*INLINE macros from Util.h into Attributes.h, where they make more sense. r=luke 83239 Jeff Walden <jwalden@mit.edu> Bug 712129 - Add more assertion macro flavors to mfbt, and make the JS engine use mfbt's implementations where appropriate. r=cjones 83240 Jeff Walden <jwalden@mit.edu> Bug 712129 - Implement MOZ_STATIC_ASSERT and MOZ_STATIC_ASSERT_IF. r=luke 83241 Brad Lassey <blassey@mozilla.com> bug 712787 - remove showScreenshot (dead code) r=dougt 83242 Ed Morley <bmo@edmorley.co.uk> Merge last PGO-green changeset from mozilla-inbound to mozilla-central of those, bug 670930 is the most likely, so I'm marking this blocking that and assigning to snorp *https://ftp.mozilla.org/pub/mozilla.org/mobile/nightly/2011-12-23-03-21-07-mozilla-central-android/fennec-12.0a1.multi.android-arm.apk built from http://hg.mozilla.org/mozilla-central/rev/ed47a41ba26a **https://ftp.mozilla.org/pub/mozilla.org/mobile/nightly/2011-12-22-03-10-55-mozilla-central-android/fennec-12.0a1.multi.android-arm.apk built from http://hg.mozilla.org/mozilla-central/rev/c5b90ea7e475

Looks like maybe the buffer is too small? Chris, weren't you trying to track down an issue related to this? Is there any way gAndroidBounds could be smaller than mBounds? Because DrawTo uses mBounds when we don't pass a rect (as we do currently, but I have a patch to fix that), and we reallocate the buffer based on gAndroidBounds. I don't really see how this could be a gralloc-specific issue unless Reallocate() silently fails (unlikely). Regardless, I can try to look into it soonish.

is bug 711853 a duplicate of this bug?

Wondering why https://crash-stats.mozilla.com/report/index/2d5a69a8-e3b7-4c32-9359-fe1cc2111228 isn't showing this bug in the socorro interface.