[Bug report] - b2g process crash on Android when Click Select UI #62
Description
** Environment **
- Device
To Reproduce
Steps to reproduce the behavior:
- Go to
UI TestApp. - Click on
Select. b2gcrash andNutriarestart
Additional context
Gecko version is 112.
logs:
08-21 23:49:29.342 1689 1689 I Gecko : console.log: "ActionsDispatcher::dispatch ime-focus-changed"
08-21 23:49:29.359 1242 1271 W ServiceManagement: Waited one second for android.frameworks.sensorservice@1.0::ISensorManager/default. Waiting another...
08-21 23:49:29.375 1689 1892 F libc : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x38 in tid 1892 (Renderer), pid 1689 (b2g)
08-21 23:49:29.475 2309 2309 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
08-21 23:49:29.477 811 811 I tombstoned: received crash request for pid 1892
08-21 23:49:29.482 2309 2309 I crash_dump64: performing dump of process 1689 (target tid = 1892)
08-21 23:49:29.494 2309 2309 E DEBUG : failed to read process info: failed to open /proc/1689
08-21 23:49:29.728 2309 2309 I crash_dump64: type=1400 audit(0.0:3415): avc: denied { open } for path="/data/local/webapps/installed/system/application.zip" dev="sda15" ino=3279230 scontext=u:r:crash_dump:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
08-21 23:49:29.728 2309 2309 I crash_dump64: type=1400 audit(0.0:3416): avc: denied { getattr } for path="/data/local/webapps/installed/system/application.zip" dev="sda15" ino=3279230 scontext=u:r:crash_dump:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
02-14 08:36:05.050 0 0 I init : starting service 'ipfsd'...
02-14 08:36:05.053 0 0 E libprocessgroup: Failed to make and chown /sys/fs/cgroup/uid_0: Operation not permitted
02-14 08:36:05.053 0 0 E init : createProcessGroup(0, 2312) failed for service 'ipfsd': Operation not permitted
02-14 08:36:05.126 0 0 I init : Service 'ipfsd' (pid 2312) exited with status 2
02-14 08:36:05.126 0 0 I init : Sending signal 9 to service 'ipfsd' (pid 2312) process group...
02-14 08:36:05.126 0 0 I libprocessgroup: Successfully killed process cgroup uid 0 pid 2312 in 0ms
02-14 08:36:05.155 0 0 I logd : logdr: UID=0 GID=0 PID=2309 n tail=0 logMask=8 pid=1689 start=0ns deadline=0ns
02-14 08:36:05.156 0 0 I logd : logdr: UID=0 GID=0 PID=2309 n tail=0 logMask=1 pid=1689 start=0ns deadline=0ns
08-21 23:49:29.886 2309 2309 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-21 23:49:29.886 2309 2309 F DEBUG : Build fingerprint: 'google/treble_arm64_bvN/tdgsi_arm64_ab:13/TP1A.220905.004.A2/eng.qwe.20230227.110906:eng/test-keys'
08-21 23:49:29.886 2309 2309 F DEBUG : Revision: '0'
08-21 23:49:29.886 2309 2309 F DEBUG : ABI: 'arm64'
08-21 23:49:29.886 2309 2309 F DEBUG : Timestamp: 2022-08-21 23:49:29.494037534+0800
08-21 23:49:29.886 2309 2309 F DEBUG : Process uptime: 0s
08-21 23:49:29.886 2309 2309 F DEBUG : Cmdline: /system/b2g/b2g
08-21 23:49:29.886 2309 2309 F DEBUG : pid: 1689, tid: 1892, name: Renderer >>> /system/b2g/b2g <<<
08-21 23:49:29.886 2309 2309 F DEBUG : uid: 0
08-21 23:49:29.886 2309 2309 F DEBUG : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000038
08-21 23:49:29.886 2309 2309 F DEBUG : Cause: null pointer dereference
08-21 23:49:29.886 2309 2309 F DEBUG : x0 0000000000000000 x1 0000007cf8200018 x2 0000000000000010 x3 ffffffffc4653600
08-21 23:49:29.886 2309 2309 F DEBUG : x4 0000007b55713840 x5 000000000000003e x6 0000007bb2c26860 x7 00000000000077de
08-21 23:49:29.886 2309 2309 F DEBUG : x8 1afbdeb3576c4598 x9 1afbdeb3576c4598 x10 00000000000000fd x11 0000000000000001
08-21 23:49:29.886 2309 2309 F DEBUG : x12 0000000000000010 x13 000000000000006c x14 0000007c708374b8 x15 0000000000000000
08-21 23:49:29.886 2309 2309 F DEBUG : x16 0000000000000000 x17 0000000000000000 x18 1afbdeb3576c4598 x19 0000007bb2c267a0
08-21 23:49:29.886 2309 2309 F DEBUG : x20 0000007b55713830 x21 0000000000000001 x22 0000000000000000 x23 0000007b550263d8
08-21 23:49:29.886 2309 2309 F DEBUG : x24 0000007c7083a000 x25 0000000100000004 x26 0000000000000000 x27 0000000000000000
08-21 23:49:29.887 2309 2309 F DEBUG : x28 0000007c7083a000 x29 0000007c70837f20
08-21 23:49:29.887 2309 2309 F DEBUG : lr 0000007c49848f98 sp 0000007c70837f00 pc 0000007c49848fa0 pst 0000000060000000
08-21 23:49:29.887 2309 2309 F DEBUG : backtrace:
08-21 23:49:29.887 2309 2309 F DEBUG : #00 pc 0000000005d42fa0 /system/b2g/libxul.so (nsScreenGonk::StartRemoteDrawing()+140) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #01 pc 0000000005d60984 /system/b2g/libxul.so (nsWindow::StartRemoteDrawing()+32) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #02 pc 0000000004727718 /system/b2g/libxul.so (mozilla::wr::RenderCompositorSWGL::StartCompositing(mozilla::wr::ColorF, mozilla::wr::Box2D<int, mozilla::wr::DevicePixel> const*, unsigned long, mozilla::wr::Box2D<int, mozilla::wr::DevicePixel> const*, unsigned long)+304) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #03 pc 0000000003836260 /system/b2g/libxul.so (_$LT$webrender..compositor..sw_compositor..SwCompositor$u20$as$u20$webrender..composite..Compositor$GT$::start_compositing::h1c3ad690be15e774+500) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #04 pc 0000000003a14b30 /system/b2g/libxul.so (webrender::renderer::Renderer::draw_frame::hfb84891c48cb9309+6840) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #05 pc 0000000003a04d40 /system/b2g/libxul.so (webrender::renderer::Renderer::render_impl::hfb07832b5c3f3c3a+6456) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #06 pc 0000000003a3ec48 /system/b2g/libxul.so (wr_renderer_render+288) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #07 pc 000000000472bbb4 /system/b2g/libxul.so (mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*)+1540) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #08 pc 000000000472b2ec /system/b2g/libxul.so (mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool, bool)+500) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #09 pc 0000000004730328 /system/b2g/libxul.so (mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, bool, bool>::Run()+52) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #10 pc 0000000003ea82a0 /system/b2g/libxul.so (nsThread::ProcessNextEvent(bool, bool*)+1016) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #11 pc 0000000003eaac8c /system/b2g/libxul.so (NS_ProcessNextEvent(nsIThread*, bool)+60) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #12 pc 0000000004366220 /system/b2g/libxul.so (mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)+252) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #13 pc 000000000432e50c /system/b2g/libxul.so (MessageLoop::Run()+88) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #14 pc 0000000003ea65d0 /system/b2g/libxul.so (nsThread::ThreadFunc(void*)+168) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887 2309 2309 F DEBUG : #15 pc 0000000000142844 /system/b2g/libnss3.so (_pt_root+244) (BuildId: 55bc81d05d0c12986b534b193d14e9c71364b4a1)
08-21 23:49:29.887 2309 2309 F DEBUG : #16 pc 00000000000b6588 /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: dc25a1fa649e413a2ab985d69456bdc9)
08-21 23:49:29.887 2309 2309 F DEBUG : #17 pc 0000000000053294 /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: dc25a1fa649e413a2ab985d69456bdc9)