[Bug report] - b2g process crash on Android when Click Select UI

[ittat]

** Environment **

• Device

To Reproduce
Steps to reproduce the behavior:

1. Go to UI Test App.
2. Click on Select.
3. b2g crash and Nutria restart

Additional context

Gecko version is 112.

logs:

08-21 23:49:29.342  1689  1689 I Gecko   : console.log: "ActionsDispatcher::dispatch ime-focus-changed"
08-21 23:49:29.359  1242  1271 W ServiceManagement: Waited one second for [email protected]::ISensorManager/default. Waiting another...
08-21 23:49:29.375  1689  1892 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x38 in tid 1892 (Renderer), pid 1689 (b2g)
08-21 23:49:29.475  2309  2309 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
08-21 23:49:29.477   811   811 I tombstoned: received crash request for pid 1892
08-21 23:49:29.482  2309  2309 I crash_dump64: performing dump of process 1689 (target tid = 1892)
08-21 23:49:29.494  2309  2309 E DEBUG   : failed to read process info: failed to open /proc/1689
08-21 23:49:29.728  2309  2309 I crash_dump64: type=1400 audit(0.0:3415): avc: denied { open } for path="/data/local/webapps/installed/system/application.zip" dev="sda15" ino=3279230 scontext=u:r:crash_dump:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
08-21 23:49:29.728  2309  2309 I crash_dump64: type=1400 audit(0.0:3416): avc: denied { getattr } for path="/data/local/webapps/installed/system/application.zip" dev="sda15" ino=3279230 scontext=u:r:crash_dump:s0 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=1
02-14 08:36:05.050     0     0 I init    : starting service 'ipfsd'...
02-14 08:36:05.053     0     0 E libprocessgroup: Failed to make and chown /sys/fs/cgroup/uid_0: Operation not permitted
02-14 08:36:05.053     0     0 E init    : createProcessGroup(0, 2312) failed for service 'ipfsd': Operation not permitted
02-14 08:36:05.126     0     0 I init    : Service 'ipfsd' (pid 2312) exited with status 2
02-14 08:36:05.126     0     0 I init    : Sending signal 9 to service 'ipfsd' (pid 2312) process group...
02-14 08:36:05.126     0     0 I libprocessgroup: Successfully killed process cgroup uid 0 pid 2312 in 0ms
02-14 08:36:05.155     0     0 I logd    : logdr: UID=0 GID=0 PID=2309 n tail=0 logMask=8 pid=1689 start=0ns deadline=0ns
02-14 08:36:05.156     0     0 I logd    : logdr: UID=0 GID=0 PID=2309 n tail=0 logMask=1 pid=1689 start=0ns deadline=0ns
08-21 23:49:29.886  2309  2309 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-21 23:49:29.886  2309  2309 F DEBUG   : Build fingerprint: 'google/treble_arm64_bvN/tdgsi_arm64_ab:13/TP1A.220905.004.A2/eng.qwe.20230227.110906:eng/test-keys'
08-21 23:49:29.886  2309  2309 F DEBUG   : Revision: '0'
08-21 23:49:29.886  2309  2309 F DEBUG   : ABI: 'arm64'
08-21 23:49:29.886  2309  2309 F DEBUG   : Timestamp: 2022-08-21 23:49:29.494037534+0800
08-21 23:49:29.886  2309  2309 F DEBUG   : Process uptime: 0s
08-21 23:49:29.886  2309  2309 F DEBUG   : Cmdline: /system/b2g/b2g
08-21 23:49:29.886  2309  2309 F DEBUG   : pid: 1689, tid: 1892, name: Renderer  >>> /system/b2g/b2g <<<
08-21 23:49:29.886  2309  2309 F DEBUG   : uid: 0
08-21 23:49:29.886  2309  2309 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000038
08-21 23:49:29.886  2309  2309 F DEBUG   : Cause: null pointer dereference
08-21 23:49:29.886  2309  2309 F DEBUG   :     x0  0000000000000000  x1  0000007cf8200018  x2  0000000000000010  x3  ffffffffc4653600
08-21 23:49:29.886  2309  2309 F DEBUG   :     x4  0000007b55713840  x5  000000000000003e  x6  0000007bb2c26860  x7  00000000000077de
08-21 23:49:29.886  2309  2309 F DEBUG   :     x8  1afbdeb3576c4598  x9  1afbdeb3576c4598  x10 00000000000000fd  x11 0000000000000001
08-21 23:49:29.886  2309  2309 F DEBUG   :     x12 0000000000000010  x13 000000000000006c  x14 0000007c708374b8  x15 0000000000000000
08-21 23:49:29.886  2309  2309 F DEBUG   :     x16 0000000000000000  x17 0000000000000000  x18 1afbdeb3576c4598  x19 0000007bb2c267a0
08-21 23:49:29.886  2309  2309 F DEBUG   :     x20 0000007b55713830  x21 0000000000000001  x22 0000000000000000  x23 0000007b550263d8
08-21 23:49:29.886  2309  2309 F DEBUG   :     x24 0000007c7083a000  x25 0000000100000004  x26 0000000000000000  x27 0000000000000000
08-21 23:49:29.887  2309  2309 F DEBUG   :     x28 0000007c7083a000  x29 0000007c70837f20
08-21 23:49:29.887  2309  2309 F DEBUG   :     lr  0000007c49848f98  sp  0000007c70837f00  pc  0000007c49848fa0  pst 0000000060000000
08-21 23:49:29.887  2309  2309 F DEBUG   : backtrace:
08-21 23:49:29.887  2309  2309 F DEBUG   :       #00 pc 0000000005d42fa0  /system/b2g/libxul.so (nsScreenGonk::StartRemoteDrawing()+140) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #01 pc 0000000005d60984  /system/b2g/libxul.so (nsWindow::StartRemoteDrawing()+32) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #02 pc 0000000004727718  /system/b2g/libxul.so (mozilla::wr::RenderCompositorSWGL::StartCompositing(mozilla::wr::ColorF, mozilla::wr::Box2D<int, mozilla::wr::DevicePixel> const*, unsigned long, mozilla::wr::Box2D<int, mozilla::wr::DevicePixel> const*, unsigned long)+304) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #03 pc 0000000003836260  /system/b2g/libxul.so (_$LT$webrender..compositor..sw_compositor..SwCompositor$u20$as$u20$webrender..composite..Compositor$GT$::start_compositing::h1c3ad690be15e774+500) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #04 pc 0000000003a14b30  /system/b2g/libxul.so (webrender::renderer::Renderer::draw_frame::hfb84891c48cb9309+6840) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #05 pc 0000000003a04d40  /system/b2g/libxul.so (webrender::renderer::Renderer::render_impl::hfb07832b5c3f3c3a+6456) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #06 pc 0000000003a3ec48  /system/b2g/libxul.so (wr_renderer_render+288) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #07 pc 000000000472bbb4  /system/b2g/libxul.so (mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*)+1540) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #08 pc 000000000472b2ec  /system/b2g/libxul.so (mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool, bool)+500) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #09 pc 0000000004730328  /system/b2g/libxul.so (mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, bool, bool>::Run()+52) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #10 pc 0000000003ea82a0  /system/b2g/libxul.so (nsThread::ProcessNextEvent(bool, bool*)+1016) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #11 pc 0000000003eaac8c  /system/b2g/libxul.so (NS_ProcessNextEvent(nsIThread*, bool)+60) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #12 pc 0000000004366220  /system/b2g/libxul.so (mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)+252) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #13 pc 000000000432e50c  /system/b2g/libxul.so (MessageLoop::Run()+88) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #14 pc 0000000003ea65d0  /system/b2g/libxul.so (nsThread::ThreadFunc(void*)+168) (BuildId: ed2ade93753e49bfb5666da07ac327f0fbde3361)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #15 pc 0000000000142844  /system/b2g/libnss3.so (_pt_root+244) (BuildId: 55bc81d05d0c12986b534b193d14e9c71364b4a1)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #16 pc 00000000000b6588  /apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+208) (BuildId: dc25a1fa649e413a2ab985d69456bdc9)
08-21 23:49:29.887  2309  2309 F DEBUG   :       #17 pc 0000000000053294  /apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+64) (BuildId: dc25a1fa649e413a2ab985d69456bdc9)