1026404 - crash in libsrv_um.so@0xa820

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Toolbar, defect)

Description

[Flaviu Cos]

This bug was filed from the Socorro interface and is 
report bp-1f460e09-235c-4511-951f-8f9062140617.
=============================================================
Environment: 
Device: Lenovo Yoga Tab 10 (Android 4.4.2);
Build: Nightly 33.0a1 (2014-06-16);

Steps to reproduce:
1. Launch Fennec;
2. Go to youtube.com

Expected result:
The page is successfully loaded.

Actual result:
Firefox crashes.

Comment 1

[Flaviu Cos]

I found this exception in logcat when Firefox has crashed:

W/InputMethodManagerService(663): Got RemoteException sending setActive(false) notification to pid 3077 uid 10103
W/Binder(858): Caught a RuntimeException from the binder stub implementation.
W/Binder(858): java.lang.NullPointerException
W/Binder(858): 	at android.inputmethodservice.IInputMethodWrapper.setSessionEnabled(IInputMethodWrapper.java:280)
W/Binder(858): 	at com.android.internal.view.IInputMethod$Stub.onTransact(IInputMethod.java:129)
W/Binder(858): 	at android.os.Binder.execTransact(Binder.java:404)
W/Binder(858): 	at dalvik.system.NativeStart.run(Native Method)
W/System.err(858): java.lang.NullPointerException
W/System.err(858): 	at android.inputmethodservice.IInputMethodWrapper.setSessionEnabled(IInputMethodWrapper.java:280)
W/System.err(858): 	at com.android.internal.view.IInputMethod$Stub.onTransact(IInputMethod.java:129)
W/System.err(858): 	at android.os.Binder.execTransact(Binder.java:404)
W/System.err(858): 	at dalvik.system.NativeStart.run(Native Method)

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Anything simple here, or would a device be required?

Comment 3

[(inactive) Jim Chen [:jchen] [:darchons]]

Looks like a graphics crash. The stack looks okay but I think a device would be needed.

Comment 4

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

Ordered a device (RITM0047770) for the London office.

Comment 5

[Jamie Nicol [:jnicol]]

This is an 100% reproducible crash on SGX544MP KitKat devices by opening youtube. The driver crashes in EGLImageTargetTexture2D(), called from EGLImageTextureSource::BindTexture().

This is similar to bug 1264505, except we crash whether target is GL_TEXTURE_2D or GL_TEXTURE_EXTERNAL. This crash is preventable by disabling the extensions OES_EGL_image AND OES_EGL_image_external on this GPU.

Comment 6

[Jamie Nicol [:jnicol]]

Actually, while the crash signature linked to in the report only has Kit Kat devices, it is possible Lollipop and onwards also don't support these extensions, but crash with a different signature. Unfortunately the Lenovo Yoga 10 we have in london never got a lollipop upgrade so I cannot confirm

Comment 7

[Jamie Nicol [:jnicol]]

Attachment: Bug 1026404 - Disable OES_EGL_image and OES_EGL_image_external on SGX 544 MP devices.

EGLImageTargetTexture2D crashes on SGX 544 MP GPUs on Kit Kat with
either GL_TEXTURE_2D or GL_TEXTURE_EXTERNAL as the texture target. This
means that both OES_EGL_image and OES_EGL_image_external extensions do
not work and must be avoided.

Review commit: https://reviewboard.mozilla.org/r/88676/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/88676/

Comment 8

[Jamie Nicol [:jnicol]]

Looking through SGX 544 crashes I cannot see one which looks like the same root cause but with a different signature, so it's safe to apply this workaround only on Kit Kat and below.

https://treeherder.mozilla.org/#/jobs?repo=try&author=[e-mail]&selectedJob=29943872

Comment 9

[Jamie Nicol [:jnicol]]

oops wrong link - https://treeherder.mozilla.org/#/jobs?repo=try&revision=d308452b74bcb26c7f45ae735d31616151904a82

Comment 10

[Edwin Flores [inactive from 2016-12-01] [:eflores] [:edwin]]

Comment on attachment 8804790 [details]
Bug 1026404 - Disable OES_EGL_image and OES_EGL_image_external on SGX 544 MP devices.

https://reviewboard.mozilla.org/r/88676/#review88048

Comment 11

[Jamie Nicol [:jnicol]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d308452b74bcb26c7f45ae735d31616151904a82

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1ba26e18f7ca
Disable OES_EGL_image and OES_EGL_image_external on SGX 544 MP devices. r=eflores

Comment 13

[Jamie Nicol [:jnicol]]

Comment on attachment 8804790 [details]
Bug 1026404 - Disable OES_EGL_image and OES_EGL_image_external on SGX 544 MP devices.

I realise we are late in the cycle but this is a fairly common crash and is safe.

Approval Request Comment
[Feature/regressing bug #]: Bug 956993 (2.5 years ago)
[User impact if declined]: Guaranteed crash on youtube and other sites, on SGX 544MP devices
[Describe test coverage new/current, TreeHerder]: Try run above. This makes us use existing and tested fallback path, nothing new.
[Risks and why]: Very low - makes us use fallback path instead, and only on devices which definitely would have crashed otherwise
[String/UUID change made/needed]: N/A

Comment 14

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8804790 [details]
Bug 1026404 - Disable OES_EGL_image and OES_EGL_image_external on SGX 544 MP devices.

Fixes a crash that seems medium volume on 49.0.2 and could be a problem when 50 goes to release, taking it. Aurora51+, Beta50+

Comment 15

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/fccdd9ae8dd76af003b80a8c9e0cd035a1848842
https://hg.mozilla.org/releases/mozilla-beta/rev/829a3f99f2606759305e3db204185242566a4ca6

Comment 16

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/1ba26e18f7ca