Closed Bug 804885 Opened 12 years ago Closed 12 years ago

Frequent crash in Android tests [@ fast_path_fill [pixman-fast-path.c : 2316 + 0x0]]

Categories

(Core :: Graphics, defect)

Product:
Core
Component:
Graphics
Platform:
ARM
Android
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: philor, Unassigned)

References

Details

(Keywords: crash, intermittent-failure)

Crash Data

https://tbpl.mozilla.org/php/getParsedLog.php?id=16396331&tree=Mozilla-Inbound
Android Tegra 250 mozilla-inbound opt test mochitest-4 on 2012-10-23 16:45:11 PDT for push efb52cbc71e5
slave: tegra-055

INFO | runtests.py | Running tests: start.

FIRE PROC: '"MOZ_CRASHREPORTER=1,XPCOM_DEBUG_BREAK=stack,MOZ_CRASHREPORTER_NO_REPORT=1,NO_EM_RESTART=1,MOZ_PROCESS_LOG=/tmp/tmpm02Z8jpidlog,XPCOM_MEM_BLOAT_LOG=/tmp/tmpwiJ33G/runtests_leaks.log" org.mozilla.fennec -no-remote -profile /mnt/sdcard/tests/profile/ http://mochi.test:8888/tests/?autorun=1&closeWhenDone=1&logFile=%2Fmnt%2Fsdcard%2Ftests%2Flogs%2Fmochitest.log&fileLevel=INFO&consoleLevel=INFO&totalChunks=8&thisChunk=4&testManifest=android.json&runOnly=true'
INFO | automation.py | Application pid: 1792

INFO | automation.py | Application ran for: 0:00:22.410769
INFO | automation.py | Reading PID log: /tmp/tmpm02Z8jpidlog
getting files in '/mnt/sdcard/tests/profile/minidumps/'
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/mobile/tinderbox-builds/mozilla-inbound-android/1351032436/fennec-19.0a1.en-US.android-arm.crashreporter-symbols.zip
PROCESS-CRASH | automation.py | application crashed (minidump found)
Crash dump filename: /tmp/tmpP_x1mS/1048f4c8-2d30-7d00-590f75ef-6a4e30ba.dmp
Operating system: Android
                  0.0.0 Linux 2.6.32.9-00002-gd8084dc-dirty #1 SMP PREEMPT Wed Feb 2 11:32:06 PST 2011 armv7l nvidia/harmony/harmony/harmony:2.2/FRF91/20110202.102810:eng/test-keys
CPU: arm
     0 CPUs

Crash reason:  SIGSEGV
Crash address: 0x58a00000

Thread 4 (crashed)
 0  libxul.so!fast_path_fill [pixman-fast-path.c : 2316 + 0x0]
     r4 = 0x00000400    r5 = 0x00000080    r6 = 0x0000ffff    r7 = 0x00000000
     r8 = 0x00000000    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b06440    lr = 0x5520a40d    pc = 0x5520943e
    Found by: given as instruction pointer in context
 1  libxul.so!_pixman_implementation_fill [pixman-implementation.c : 182 + 0x17]
     r4 = 0x552093b1    r5 = 0x00000200    r6 = 0x58a00000    r7 = 0x55a7e1cc
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b06490    pc = 0x5520a40d
    Found by: call frame info
 2  libxul.so!delegate_fill [pixman-implementation.c : 62 + 0x19]
     r4 = 0x0000ffff    r5 = 0x00000200    r6 = 0x58a00000    r7 = 0x55a7e1cc
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b064b0    pc = 0x5520a42f
    Found by: call frame info
 3  libxul.so!_pixman_implementation_fill [pixman-implementation.c : 182 + 0x17]
     r4 = 0x5520a411    r5 = 0x00000200    r6 = 0x58a00000    r7 = 0x55a7e1cc
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b064d0    pc = 0x5520a40d
    Found by: call frame info
 4  libxul.so!delegate_fill [pixman-implementation.c : 62 + 0x19]
     r4 = 0x0000ffff    r5 = 0x00000200    r6 = 0x58a00000    r7 = 0x55a7e1cc
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b064f0    pc = 0x5520a42f
    Found by: call frame info
 5  libxul.so!_pixman_implementation_fill [pixman-implementation.c : 182 + 0x17]
     r4 = 0x5520a411    r5 = 0x00000200    r6 = 0x58a00000    r7 = 0x55a7e1cc
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b06510    pc = 0x5520a40d
    Found by: call frame info
 6  libxul.so!_moz_pixman_fill [pixman.c : 772 + 0x1b]
     r4 = 0x00000010    r5 = 0x00000200    r6 = 0x58a00000    r7 = 0x55a7e1cc
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b06530    pc = 0x551def13
    Found by: call frame info
 7  libxul.so!_clip_and_composite_boxes [cairo-image-surface.c : 2938 + 0x2a]
     r4 = 0x44b07f8c    r5 = 0x00000001    r6 = 0x44b07f78    r7 = 0x4eb78da0
     r8 = 0x00000080    r9 = 0x00000400   r10 = 0x0000ffff    fp = 0x44b08480
     sp = 0x44b06568    pc = 0x55192f94

Nothing's ever easy with intermittent, could have started from bug 795259/bug 803013, or bug 797942, or some non-mobile-specific gfx push, or some non-gfx push, or infra (for all I know, it's bug 722166 suddenly having stacks).

From the frequency so far, figure that if we were still starring android test failures, we be swinging by here 10 or so times a day.
Crash Signature: [@ fast_path_fill]
Component: Graphics, Panning and Zooming → Graphics
Product: Firefox for Android → Core
Because I don't paste logs here, you'll need to look at https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=804885&entireHistory=true&tree=trunk to see frequency and instances.
And because that will give you a totally bogus idea of the actually frequency, I'm back to pasting.

https://tbpl.mozilla.org/php/getParsedLog.php?id=16608324&tree=Mozilla-Inbound
Looks to be screenshot related. I see this in most of the logs:

12  libxul.so!gfxContext::Fill() [gfxContext.cpp : 310 + 0x3]
     r4 = 0x56d58a90    r5 = 0x4e70d628    r6 = 0x00000000    r7 = 0x00000022
     r8 = 0x4e70d704    r9 = 0x00000000   r10 = 0x00000000    fp = 0xffffffff
     sp = 0x4e70d5a8    pc = 0x55134ec7
    Found by: call frame info
13  libxul.so!PresShell::RenderDocument(nsRect const&, unsigned int, unsigned int, gfxContext*) [nsPresShell.cpp : 4315 + 0x5]
     r4 = 0x56d58a90    r5 = 0x4e70d628    r6 = 0x00000000    r7 = 0x00000022
     r8 = 0x4e70d704    r9 = 0x00000000   r10 = 0x00000000    fp = 0xffffffff
     sp = 0x4e70d5b8    pc = 0x5498a9bd
    Found by: call frame info
14  libxul.so!mozilla::AndroidBridge::TakeScreenshot(nsIDOMWindow*, int, int, int, int, int, int, int, int, int, int, int, int, _jobject*) [AndroidBridge.cpp : 2501 + 0x11]
     r4 = 0x56d58a90    r5 = 0x57546cd0    r6 = 0x0011f0b8    r7 = 0x5498a911
     r8 = 0x00000400    r9 = 0x48413820   r10 = 0x00000000    fp = 0x00000000
     sp = 0x4e70d6c8    pc = 0x54f4f161
    Found by: call frame info
Depends on: 805355
This has the same signature as bug 805355. This bug is basically a dup of 805355, but from the tbpl perspective.
Hopefully fixed by bug 805355.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Whiteboard: [orange]
You need to log in before you can comment on or make changes to this bug.