Closed Bug 741166 Opened 10 years ago Closed 10 years ago

crash in AndroidGLController::ProvideEGLSurface


(Core Graveyard :: Widget: Android, defect)

14 Branch
Not set


(blocking-fennec1.0 +)

Tracking Status
blocking-fennec1.0 --- +


(Reporter: scoobidiver, Assigned: joe)



(4 keywords, Whiteboard: [native-crash][startupcrash])

Crash Data


(1 file)

It first appeared in 14.0a1/20120315.

Signature 	AndroidGLController::ProvideEGLSurface More Reports Search
UUID	00c6f9c3-7173-467e-abd0-269962120401
Date Processed	2012-04-01 03:33:37
Uptime	4
Last Crash	26 seconds before submission
Install Age	38 seconds since version was first installed.
Install Time	2012-04-01 03:32:46
Product	FennecAndroid
Version	14.0a1
Build ID	20120331161857
Release Channel	nightly
OS	Linux
OS Version	0.0.0 Linux #1 PREEMPT Tue Aug 9 21:02:37 2011 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x8
App Notes 	
EGL? EGL+ AdapterVendorID: semc, AdapterDeviceID: R800at.
AdapterDescription: 'Android, Model: 'R800at', Product: 'R800at_1248-6414', Manufacturer: 'Sony Ericsson', Hardware: 'semc''.
Sony Ericsson R800at
EMCheckCompatibility	True

Frame 	Module 	Signature 	Source
1 	AndroidGLController::ProvideEGLSurface 	jni.h:706
2 	mozilla::AndroidBridge::ProvideEGLSurface 	widget/android/AndroidBridge.cpp:1115
3 	mozilla::gl::GLContextProviderEGL::CreateForWindow 	gfx/gl/GLContextProviderEGL.cpp:1507
4 	mozilla::layers::LayerManagerOGL::CreateContext 	gfx/layers/opengl/LayerManagerOGL.cpp:172
5 	mozilla::layers::CompositorParent::AllocPLayers 	LayerManagerOGL.h:110
6 	mozilla::layers::PCompositorParent::OnMessageReceived 	obj-firefox/ipc/ipdl/PCompositorParent.cpp:470
7 	mozilla::ipc::SyncChannel::OnDispatchMessage 	ipc/glue/SyncChannel.cpp:175
8 	mozilla::ipc::RPCChannel::OnMaybeDequeueOne 	ipc/glue/RPCChannel.cpp:432
9 	RunnableMethod<mozilla::ipc::RPCChannel, bool , Tuple0>::Run 	ipc/chromium/src/base/tuple.h:383
10 	mozilla::ipc::RPCChannel::DequeueTask::Run 	RPCChannel.h:462
11 	MessageLoop::RunTask 	ipc/chromium/src/base/
12 	MessageLoop::DeferOrRunPendingTask 	ipc/chromium/src/base/
13 	MessageLoop::DoWork 	ipc/chromium/src/base/
14 	base::MessagePumpDefault::Run 	ipc/chromium/src/base/
15 	MessageLoop::RunInternal 	ipc/chromium/src/base/
16 	MessageLoop::Run 	ipc/chromium/src/base/
17 	base::Thread::ThreadMain 	ipc/chromium/src/base/
18 	ThreadFunc 	ipc/chromium/src/base/

More reports at:
There is a spike in startup crashes from 14.0a1/20120331031108. The regression range for the spike is:
It's likely a regression from bug 740244.

Crashes after the spike occur on:
* LGE LG-P925, LG-P990
* NEC N-01D
* Samsung Galaxy Nexus, Nexus S, SCH-I500
* SMDKV210
* Sony Ericsson R800at
Blocks: 740244
Crash Signature: [@ AndroidGLController::ProvideEGLSurface] → [@ AndroidGLController::ProvideEGLSurface] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x23a20e] [@ dalvik-LinearAlloc (deleted)@0x23b6ee]
Whiteboard: [native-crash] → [native-crash][startupcrash]
Err... how glx test for GLX drivers caused problem with android EGL stuff?
(In reply to Oleg Romashin (:romaxa) from comment #2)
> Err... how glx test for GLX drivers caused problem with android EGL stuff?
Wrong bug because of EGL in its title.
It might a regression from bug 737437.
Blocks: 737437
No longer blocks: 740244
Crash Signature: [@ AndroidGLController::ProvideEGLSurface] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x23a20e] [@ dalvik-LinearAlloc (deleted)@0x23b6ee] → [@ AndroidGLController::ProvideEGLSurface] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x2378fe] [@ dalvik-LinearAlloc (deleted)@0x238876] [@ dalvik-LinearAlloc (deleted)@0x23a20e] [@ dalvik-LinearAlloc (deleted)@0x23b6e…
Other possible culprits are bug 739488 and bug 740190.
(In reply to Scoobidiver from comment #3)
> It might a regression from bug 737437.

The patch for Bug 737437 that's in the regression range was also backed out within the regression range. The latest patch for Bug 737437 only made it to mozilla-central last night, so it's not in 14.0a1/20120331031108.

Since this crash is happening during the call to AndroidBridge::ProvideEGLSurface that happens right after AndroidBridge::RegisterCompositor, one plausible theory is that the call to GetJNIForThread in RegisterCompositor is failing, causing RegisterCompositor to return early without calling sController.Acquire, leading to a crash during the call to sController.ProvideEGLSurface.

kats, is it likely/possible that the call to GetJNIForThread is failing?
No longer blocks: 737437
It's possible that GetJNIForThread is failing, but I wouldn't consider it likely. I don't think I've ever seen that fail before, but I don't know the specifics of how dalvik finds a JNIEnv for a random pthread.
blocking-fennec1.0: --- → ?
Crash Signature: [@ AndroidGLController::ProvideEGLSurface] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x2378fe] [@ dalvik-LinearAlloc (deleted)@0x238876] [@ dalvik-LinearAlloc (deleted)@0x23a20e] [@ dalvik-LinearAlloc (deleted)@0x23b6e… → [@ AndroidGLController::ProvideEGLSurface] [@ JNI_GetCreatedJavaVMs] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x2378fe] [@ dalvik-LinearAlloc (deleted)@0x2380be] [@ dalvik-LinearAlloc (deleted)@0x238f5e] [@ dalvik-Li…
Keywords: topcrash
This crash still occurs on the latest Nightly build:

Steps to reproduce:
1. Open Fennec
2. Right after performing step 1, tap on URL Bar
3. Tap on Bookmarks tab and then on History tab (keep switching them quickly until the crash will occur)

Expected result:
No crash should occur after step 3

Actual result:

Firefox 14.0a1 (2012-04-01)
Devices: HTC Desire (2.2), Motorola Droid 2 (2.3.3), Samsung Nexus (4.0.2)
Keywords: reproducible
Here is a video about this crash:
Ali tells me that, before we call egl functions on our window, we have to wait for a valid EGL surface. I removed this code in bug 737949 because I didn't think it was necessary any more, but this is apparently an Android requirement.

I can't reproduce the crash mentioned in comment 7 with this fix.
Assignee: nobody → joe
Attachment #611489 - Flags: review?(ajuma)
Blocks: 737949
Attachment #611489 - Flags: review?(ajuma) → review+
Comment on attachment 611489 [details] [diff] [review]
restore waitForValidSurface

I'm not a reviewer or such, but shouldn't some comment(s) be added to make clear why this is needed? I mean, if you thought it could be removed yourself before being bitten by this, anyone else could run into the same wrong thought and should be warned when looking into the code, right? ;-)
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
I am still able to reproduce this issue by performing the steps from comment #7 or by tapping continuous in URL Bar just after Fennec is opened. Reopening bug

Firefox 14.0a1 (2012-04-03)
Device: HTC Desire Z
OS: Android 2.3.3
Resolution: FIXED → ---
The build from April 3rd ( doesn't contain the fix.
Closed: 10 years ago10 years ago
Resolution: --- → FIXED
Verified fixed on:

Firefox 14.0a1 (2012-04-04)
Device: Samsung Galaxy S
OS: Android 2.2
Duplicate of this bug: 686457
blocking-fennec1.0: ? → +
Crash Signature: [@ AndroidGLController::ProvideEGLSurface] [@ JNI_GetCreatedJavaVMs] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x2378fe] [@ dalvik-LinearAlloc (deleted)@0x2380be] [@ dalvik-LinearAlloc (deleted)@0x238f5e] [@ dalvik-Li… → [@ AndroidGLController::ProvideEGLSurface] [@ JNI_GetCreatedJavaVMs] [@ JNI_GetCreatedJavaVMs | AndroidGLController::ProvideEGLSurface] [@ dalvik-LinearAlloc (deleted)@0x2376de] [@ dalvik-LinearAlloc (deleted)@0x2378fe] [@ dalvik-LinearAlloc (deleted…
Product: Core → Core Graveyard
You need to log in before you can comment on or make changes to this bug.