Description: When user trying to add picture from gallery to contact or as an attachment to email device crashes and reboots. Repro Steps: 1) Updated Unagi to Build ID: 20130805070203 2) Tap on contacts app 3) Tap on a "plus" Icon to create new contact fill in first/last name and phone number fields. 4) Tap on "add picture" in contact details and select Gallery option 5) Select picture from gallery by tapping on it 6) Tap on check-mark button to confirm picture selection OR 1) Set up email account on a device 2) Open email app and tap on Iconto compose new email 3) Enter email address to "To" field 4) Tap on "paper clip" button to add an attachment and select "Gallery" option 5) Select picture from Gallery that you want to attach so it opens up in single picture view window. 6) Tap on check-mark button on a top, to confirm picture selection Actual: Device crashes and reboots Expected: User should be able to add picture in contact details or as an attachment to email. Environmental Variables Build ID: 20130805070203 Gecko: http://hg.mozilla.org/mozilla-central/rev/ad0ae007aa9e Gaia: 0ca0dba246d1372eb815772c8108395ab0abd0a4 Platform Version: 25.0a1 Notes: Repro frequency: 100%, See attached: logcat, Optional extra notes: I was able to add pic to contacts using camera app.

This is crash log when user trying to add picture to contact detailes.

Device also crash when user trying to select wallpaper picture from Gallery app. Repro steps: 1) Long tap on a home screen till you will see pop up menu 2) Select Gallery from a menu 3) Tap on a picture you want to set as a wallpaper. 4) Tap on a check-mark button on a top to select this picture for the wallpaper 5) Observe device crashing...

I think I hit this one ysterday on Inari with current master build. From what I've been able to document so far, it looks like Gallery app gets OOM-killed.

See my comments in bug 900387, I'll check if the present bug is the same as what I got in bug 900387.

I'm reproducing this on Inari too, picking a small picture from Gallery to send a MMS

\o/ https://crash-stats.mozilla.com/report/index/38b8b102-ea47-41bd-aebc-1742e2130806

(In reply to Alexandre LISSY :gerard-majax from comment #6) > https://crash-stats.mozilla.com/report/index/38b8b102-ea47-41bd-aebc- > 1742e2130806 Debug symbols are missing so not exploitable easily.

Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 114.242] 0x412ad14a in nsXPConnect::XPConnect () at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/xpcprivate.h:458 458 MOZ_CRASH(); (gdb) bt #0 0x412ad14a in nsXPConnect::XPConnect () at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/xpcprivate.h:458 #1 0x413ac5aa in XPCJSRuntime::Get () at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/xpcprivate.h:616 #2 0x413c4c90 in ~XPCJSObjectHolder (this=0x0, __in_chrg=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/XPCWrappedNative.cpp:3410 #3 0x413c4cac in ~XPCJSObjectHolder (this=0x0, __in_chrg=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/js/xpconnect/src/XPCWrappedNative.cpp:3411 #4 0x417b5ce0 in mozilla::layers::GrallocBufferActor::ActorDestroy (this=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp:257 #5 0x4150d4dc in mozilla::dom::bluetooth::PBluetoothRequestChild::DestroySubtree (this=0x4729607c, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::AbnormalShutdown) at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PBluetoothRequestChild.cpp:340 #6 0x4157ee28 in mozilla::layers::PLayerTransactionParent::DestroySubtree (this=0x436b9a10, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::AbnormalShutdown) at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PLayerTransactionParent.cpp:873 #7 0x415727c2 in mozilla::layers::PCompositorParent::DestroySubtree (this=0x47837200, why=mozilla::ipc::IProtocolManager<mozilla::ipc::RPCChannel::RPCListener>::AbnormalShutdown) at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PCompositorParent.cpp:863 #8 0x415727ee in mozilla::layers::PCompositorParent::OnChannelError (this=0x47837200) at /media/alex/FirefoxOS/Inari/B2G/objdir-gecko/ipc/ipdl/PCompositorParent.cpp:726 #9 0x414fe532 in mozilla::ipc::AsyncChannel::NotifyMaybeChannelError (this=0x4783720c) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/glue/AsyncChannel.cpp:582 #10 0x414fe7ea in mozilla::ipc::AsyncChannel::OnNotifyMaybeChannelError (this=0x4783720c) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/glue/AsyncChannel.cpp:547 #11 0x411781ee in DispatchToMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)()> (this=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/tuple.h:383 #12 RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run (this=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/task.h:307 #13 0x41788c78 in MessageLoop::RunTask (this=0x45de3dec, task=0x0) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:338 #14 0x417899da in MessageLoop::DeferOrRunPendingTask (this=0x4783720c, pending_task=<value optimized out>) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:346 #15 0x4178a598 in MessageLoop::DoWork (this=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:446 #16 0x4178a824 in base::MessagePumpDefault::Run (this=0x455d0f20, delegate=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_pump_default.cc:23 #17 0x41788c44 in MessageLoop::RunInternal (this=0x0) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:220 #18 0x41788cba in MessageLoop::RunHandler (this=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:213 #19 MessageLoop::Run (this=0x45de3dec) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/message_loop.cc:187 #20 0x4178b7f6 in base::Thread::ThreadMain (this=0x451a38b0) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/thread.cc:160 #21 0x4178c3e8 in ThreadFunc (closure=0x1) at /media/alex/FirefoxOS/Inari/B2G/gecko/ipc/chromium/src/base/platform_thread_posix.cc:39 #22 0x4005ae18 in __thread_entry (func=0x4178c3e1 <ThreadFunc>, arg=0x451a38b0, tls=<value optimized out>) at bionic/libc/bionic/pthread.c:217 #23 0x4005a96c in pthread_create (thread_out=<value optimized out>, attr=0xbe8b93a8, start_routine=0x4178c3e1 <ThreadFunc>, arg=0x451a38b0) at bionic/libc/bionic/pthread.c:357 #24 0x00000000 in ?? ()

I just tried > Repro Steps: > 1) Updated Unagi to Build ID: 20130805070203 > 2) Tap on contacts app > 3) Tap on a "plus" Icon to create new contact fill in first/last name and > phone number fields. > 4) Tap on "add picture" in contact details and select Gallery option > 5) Select picture from gallery by tapping on it > 6) Tap on check-mark button to confirm picture selection and > Repro steps: > 1) Long tap on a home screen till you will see pop up menu > 2) Select Gallery from a menu > 3) Tap on a picture you want to set as a wallpaper. > 4) Tap on a check-mark button on a top to select this picture for the > wallpaper > 5) Observe device crashing... On my unagi from just after the path for Bug 900012 landed and it did not crash

Issue still repro on Unagi v 1.2 Build ID: 20130806070205 Gecko: http://hg.mozilla.org/mozilla-central/rev/a0dd80f800e2 Gaia: 49b1f68b0e2152557bb7c2defb2a5f9d7a0648c6 Platform Version: 26.0a1 here is YouTube video of issue repro: http://youtu.be/DIjPw7oZtZ4

I'm going to bisect this one.

Milan - We're seeing this OS restart crash consistently on trunk right now. Can you help find an assignee to investigate this?

Jeff is looking at all of these under 902643 first.

I can't reproduce this on trunk on my unagi device. I just used both of the steps to reproduce. Is there anything special that needs to be done to seed the gallery app with photos?

(In reply to George Wright (:gw280 PTO until 26/08/2013) from comment #15) > I can't reproduce this on trunk on my unagi device. I just used both of the > steps to reproduce. Is there anything special that needs to be done to seed > the gallery app with photos? I don't think so, though I'm reproducing this on Inari. Maybe there's something to do with device or their blobs.

Marking this one as dup of bug 901705, no need to leave a koi? for triage when there's already a koi+.

HI David/ Dylan, The email/ contacts functionality seems to have broken in 1.2. Please reassign appropriately

(In reply to Preeti Raghunath(:Preeti) from comment #18) > HI David/ Dylan, > > The email/ contacts functionality seems to have broken in 1.2. Please > reassign appropriately The root cause that is causing this bug is graphics, which Milan's team is already looking into this.