1853740 - Crash at null in [@ libGLES_mali.so@0x7c6fd4 ]

Status: RESOLVED WORKSFORME

(Core :: Graphics: CanvasWebGL, defect, P2)

Description

[Tyson Smith [:tsmith]]

This is consistently reproducible by visiting the following url:

• https://climatechangetracker.org/global-warming

Comment 1

[Bob Hood [:bhood]]

Tested on my OnePlus 8 5G running Firefox 117.1.0 on Android 11 and I get no crashing. ( Cool site, btw ;) )

Jamie, can you reproduce this?

Comment 2

[Jamie Nicol [:jnicol]]

Crash stats show it only occurs on Pixel 6 family devices. It's possible other Mali devices are affected too but with a different crash address, but I cannot repro on my Pixel 7.

I have a Pixel 6a at home so hopefully should be able to debug it on that.

Comment 3

[Jamie Nicol [:jnicol]]

Hrm, I cannot reproduce on the Pixel 6a. Tyson, is there any specific interaction that has to be done to trigger the crash, or just loading it? Could you please attach your about:support?

Comment 4

[Tyson Smith [:tsmith]]

Attachment: about-support.txt

Just loading the page triggers the crash on my Pixel 6a.

Comment 5

[Tyson Smith [:tsmith]]

I can also trigger crashes running: https://registry.khronos.org/webgl/sdk/tests/webgl-conformance-tests.html

Comment 6

[Tyson Smith [:tsmith]]

FWIW the tab does not crash but I get a notification (that pops behind) saying there has been a crash. If I don't switch to the notification and hit send the report does not get submitted.

Comment 7

[Jesse Schwartzentruber (:truber)]

This crashes with libGLES_mali.so@0x7ad154 for me on Pixel 7.

Comment 8

[Jamie Nicol [:jnicol]]

Hrm, I can't crash on either URL with either a Pixel 6a or 7. Is there anything interesting in the logcat? Would mozregression work or does this crash on a year old revision?

Comment 9

[Jesse Schwartzentruber (:truber)]

I think this is specific to GrapheneOS, which uses an expanded virtual address space and hardened allocator. I'm not sure if we use the system allocator on Android or not, but disabling both features fixes this crash.

Hardened Malloc	48-bit VA	Crash
✅	✅	Yes
✅	❌	Hang on launch
❌	✅	Yes
❌	❌	No

1. https://grapheneos.org/usage#bugs-uncovered-by-security-features

Comment 10

[Tyson Smith [:tsmith]]

I am also using GrapheneOS.

I don't have a dev device to do any testing with unfortunately.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.