Closed Bug 749184 Opened 13 years ago Closed 12 years ago

Crash with INVALID HEAP ADDRESS IN dlfree

Categories

(Firefox for Android Graveyard :: General, defect)

ARM
Android
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: kats, Unassigned)

References

Details

(Keywords: crash, reproducible, Whiteboard: [native-crash])

Loading http://www.cnn.com/2012/04/25/health/kidney-transplanted-twice/index.html?hpt=hp_c1 seems to reliably crash Fennec. I'm running a build of 83ef3c9a64b5 from m-c plus a Java-only local change on the Galaxy Nexus. Full logcat attached, relevant bit is at the end: 04-26 14:19:55.411 F/libc ( 5987): @@@ ABORTING: INVALID HEAP ADDRESS IN dlfree 04-26 14:19:55.411 F/libc ( 5987): Fatal signal 11 (SIGSEGV) at 0xdeadbaad (code=1) 04-26 14:19:55.778 I/WindowManager( 191): WIN DEATH: Window{417d9ed8 org.mozilla.fennec_kats/org.mozilla.fennec_kats.App paused=false} 04-26 14:19:55.778 I/ActivityManager( 191): Process org.mozilla.fennec_kats (pid 5987) has died. Attaching gdb didn't provide any useful stack info. I also updated ICS to 4.0.4 yesterday, so that might be a factor.
Severity: normal → critical
Keywords: crash
Hardware: All → ARM
Whiteboard: [native-crash]
I now strongly suspect this is because I started using the modified r7 NDKs listed at https://wiki.mozilla.org/Mobile/Fennec/Android#Using_mozilla-repackaged_NDKs - if I switch back to r5c and build with that I can't reproduce the problem. Also I was seeing other strange behaviour with the repackaged NDKs; specifically loading https://bugzilla.mozilla.org/show_bug.cgi?id=747493 in the browser would leave most of the page unpainted, and that problem also goes away when I rebuild with the r5c NDK.
I wonder if something there broke jemalloc wrapping?
Just in case, did you check with a try build using the r7 ndk ? (ask some build person its location on the build slaves)
[cltbld@mv-moz2-linux-ix-slave01 ~]$ ls /tools/android-ndk-r7b/ build docs documentation.html GNUmakefile ndk-build ndk-build.cmd ndk-gdb ndk-stack platforms prebuilt README.TXT RELEASE.TXT samples sources tests toolchains [cltbld@mv-moz2-linux-ix-slave01 ~]$ ls /tools/android-ndk-r7b/toolchains/ arm-linux-androideabi-4.4.3 arm-linux-androideabi-4.6.3 x86-4.4.3 [cltbld@mv-moz2-linux-ix-slave01 ~]$
(In reply to Kartikaya Gupta (:kats) from comment #5) > Loading > http://www.cnn.com/2012/04/25/health/kidney-transplanted-twice/index. > html?hpt=hp_c1 seems to reliably crash Fennec. I'm running a build of > 83ef3c9a64b5 from m-c plus a Java-only local change on the Galaxy Nexus. On this same URL, I can reproduce this crash, using clean build of http://hg.mozilla.org/mozilla-central/rev/c24b721ca5c9, with no local changes, on my Android 2.3 LG g2x phone. I *am* using the new ndk r7b, and gold linker, as doc'd here: https://wiki.mozilla.org/Mobile/Fennec/Android#Using_mozilla-repackaged_NDKs. I note that this build will also consistently crash on http://www.washingtonpost.com/national/for-the-chronically-unemployed-in-calif-another-blow-ahead-as-federal-benefits-come-to-end/2012/05/06/gIQARQwn5T_story.html. All other pages so far seem to work fine.
Keywords: reproducible
Ping. Is anything going to be done here? It would be nice to upgrade to r7b+gold as the default supported NDK.
Blocks: 769099
Is this still reproducible? For me, the CNN page seems to work and the Bugzilla page renders. The Washington Post page has been taken down. I'm using r7b+gold and running on Gingerbread.
I rebuilt again using the r7b+gold prepackaged NDK linked to in comment #1 and it seems to work fine with latest m-c. Tested on both Galaxy Nexus running Jelly Bean and a Galaxy Tab 10.1 running Honeycomb.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → WORKSFORME
Note that I tested this using a build on Linux. I just realized the Linux NDK tarball is version r7b whereas the Mac OS X one is r7c, so it may not work on OS X.
The r7c NDK on mac os x also seems to work ok.
Product: Firefox for Android → Firefox for Android Graveyard
You need to log in before you can comment on or make changes to this bug.