1754781 - Crash on debug assertion when capturing a profile from Android

Status: RESOLVED FIXED

(Core :: Gecko Profiler, defect, P2)

Description

[Nazım Can Altınova [:canova][:canaltinova on phabricator]]

When user capture a profile, the following assertion is being hit and android app crashes:

02-10 13:47:44.657  2341  2801 F MOZ_Assert: Assertion failure: aThreadId.IsSpecified() || (processedCount == 1 && aReadThreadId.IsSpecified()) (Unspecified aThreadId should only be used with 1-sample buffer), at /home/canova/projects/gecko-android/tools/profiler/core/ProfileBufferEntry.cpp:1346

This is the assertion: https://searchfox.org/mozilla-central/rev/38652b98c6dd3bf42403eeb8c5305902b9a6e938/tools/profiler/core/ProfileBufferEntry.cpp#1343-1346

This is the full crash output but unfortunately I couldn't get a symbolicated crash report:

02-10 13:47:44.658  2341  2801 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 2801 (Thread-5), pid 2341 (iew_example:gpu)
02-10 13:47:44.789  2860  2860 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-10 13:47:44.789  2860  2860 F DEBUG   : Build fingerprint: 'samsung/a51nsxx/a51:11/RP1A.200720.012/A515FXXU5EUJ4:user/release-keys'
02-10 13:47:44.789  2860  2860 F DEBUG   : Revision: '9'
02-10 13:47:44.789  2860  2860 F DEBUG   : ABI: 'arm'
02-10 13:47:44.790  2860  2860 F DEBUG   : Timestamp: 2022-02-10 13:47:44+0100
02-10 13:47:44.790  2860  2860 F DEBUG   : pid: 2341, tid: 2801, name: Thread-5  >>> org.mozilla.geckoview_example:gpu <<<
02-10 13:47:44.790  2860  2860 F DEBUG   : uid: 10309
02-10 13:47:44.790  2860  2860 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
02-10 13:47:44.790  2860  2860 F DEBUG   : Cause: null pointer dereference
02-10 13:47:44.790  2860  2860 F DEBUG   : Abort message: 'Assertion failure: aThreadId.IsSpecified() || (processedCount == 1 && aReadThreadId.IsSpecified()) (Unspecified aThreadId should only be used with 1-sample buffer), at /home/canova/projects/gecko-android/tools/profiler/core/ProfileBufferEntry.cpp:1346
02-10 13:47:44.790  2860  2860 F DEBUG   : '
02-10 13:47:44.790  2860  2860 F DEBUG   :     r0  00000542  r1  00000000  r2  464f8ecb  r3  464f8ecb
02-10 13:47:44.790  2860  2860 F DEBUG   :     r4  bf3a6d88  r5  a3387988  r6  a3387320  r7  a3386b48
02-10 13:47:44.790  2860  2860 F DEBUG   :     r8  a338730c  r9  a519e830  r10 a3387420  r11 f334825c
02-10 13:47:44.790  2860  2860 F DEBUG   :     ip  eee62b08  sp  a3386b20  lr  bb5c2335  pc  bb5c233c
02-10 13:47:44.859  2860  2860 F DEBUG   : backtrace:
02-10 13:47:44.859  2860  2860 F DEBUG   :       #00 pc 0cfb933c  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #01 pc 0cfb8c63  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #02 pc 0cfb9fed  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #03 pc 0cfb9265  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #04 pc 0cfb8abb  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #05 pc 0cf9d83f  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #06 pc 0cf9d7b7  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #07 pc 0cfbd68b  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #08 pc 0cf9efb5  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #09 pc 0cf9e7ad  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #10 pc 0cf9e5f7  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #11 pc 0cfa3f21  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #12 pc 0cfa2c41  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #13 pc 0cfa4407  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #14 pc 0cfaa49d  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #15 pc 0cfaa621  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #16 pc 0cfae3b7  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.861  2860  2860 F DEBUG   :       #17 pc 001b042f  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libnss3.so (BuildId: b05c9fc69d226c56599b12b69282813047dd4e0e)
02-10 13:47:44.861  2860  2860 F DEBUG   :       #18 pc 000ab7eb  /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+40) (BuildId: b3b27b88dfad1a88f83c4380d3183302)
02-10 13:47:44.861  2860  2860 F DEBUG   :       #19 pc 00063dcf  /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30) (BuildId: b3b27b88dfad1a88f83c4380d3183302)
02-10 13:47:45.652  5201  2865 I DropBoxManagerService: add tag=data_app_native_crash isTagEnabled=true flags=0x2

I think this is most likely a refression from Bug 1721110 but this assertion is actually newer than this bug. It's introduced in Bug 1577658, so I'm adding both just in case.

Comment 1

[Nazım Can Altınova [:canova][:canaltinova on phabricator]]

I'm pretty sure this assertion should be like this instead:

MOZ_ASSERT(
            aThreadId.IsSpecified() ||
                (processedCount == 1 && !aReadThreadId.IsSpecified()),
            "Unspecified aThreadId should only be used with 1-sample buffer");

Difference is that aReadThreadId.IsSpecified()) is negated now.
It's also similar in baseprofiler: https://searchfox.org/mozilla-central/rev/38652b98c6dd3bf42403eeb8c5305902b9a6e938/mozglue/baseprofiler/core/ProfileBufferEntry.cpp#613-615
But when I try to capture a profile with this change, I'm still getting some assertion hits here. I'm starting to think that there are some threads with unspecified thread ids other than java threads. But it's pretty hard to remote debug android devices. I'll post more info if I find out more.

Comment 2

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

As discussed, I think the assertion as it is in the code is correct. The 1-sample buffer is for ProfilerBacktrace, which doesn't include a thread id.
I'm suspecting that the chosen Java thread id of 0 (zero) may be the cause, because zero is the special value used to indicate an unspecified thread.
Please try a thread id of 1. Thank you for working on this.

Comment 3

[Nazım Can Altınova [:canova][:canaltinova on phabricator]]

Attachment: Bug 1754781 - Remove the xpcshell global skip for Android and move that into tests instead r?gerald

Comment 4

[Nazım Can Altınova [:canova][:canaltinova on phabricator]]

Attachment: Bug 1754781 - Change the Android JVM thread id to 1 r?gerald

Depends on D138768

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8eda3ffd476a
Remove the xpcshell global skip for Android and move that into tests instead r=gerald
https://hg.mozilla.org/integration/autoland/rev/125468dd9db9
Change the Android JVM thread id to 1 r=gerald

Comment 6

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/8eda3ffd476a
https://hg.mozilla.org/mozilla-central/rev/125468dd9db9