767061 - [Browser App] 'Vid.ly video service' sample crashes and restarts phone

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: General, defect, P1)

Description

[John Hammink]

Loading this URL and playing the html5 video will crash the browser and reset the phone. See screencast.

URL: https://firefoxflicks.mozilla.org/en-US/video/589
Screencast: http://youtu.be/kIrw40Bsww0

logcat:
06-20 23:37:40.489: A/libc(2649): Fatal signal 11 (SIGSEGV) at 0x00000000 (code=1)
06-20 23:37:41.079: I/Gecko(2854): [Child 2854] WARNING: pipe error (3): Connection reset by peer: file /Users/tchung/Desktop/BuildB2G/B2G/gecko/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 419
06-20 23:37:41.309: I/DEBUG(2650): debuggerd committing suicide to free the zombie!
06-20 23:37:41.369: I/DEBUG(6356): debuggerd: Jun 15 2012 23:44:42

Env: 

Otoro, build 2012-06-21
commit 272fa46e55e9flbc3a
 
STR:

Launch browser, and goto URL
Tap the HTML5 video to start playback
Verify the app will immediately crash and screen will reset back to lock screen. All your settings are restored to default (eg. no Wifi enabled)

Expected:
Playing HTML5 video should not crash the app and restart phone

Actual:
HTML5 app example crashes browser and restarts phone

tchung originally found this on otoro builds from m-c (6/21); I've reproduced the issues on 6/19 and 6/20.

Comment 1

[cajbir (:cajbir)]

This doesn't appear to be an HTML video bug. The browser crashes before reaching any video code. The video is served by a third party service called 'vidly' which sniffs the device and then serves what it things is the correct video for the device. In the case for b2g it looks like it's trying to instantiate a plugin. See backtrace:

#0  0x40a458be in mozilla::dom::ExternalHelperAppParent::RecvOnStartRequest (this=0x1277308, entityID=<value optimized out>)
    at /src/mozilla/b2g/mc-otoro/uriloader/exthandler/ExternalHelperAppParent.cpp:68
#1  0x40b9e5c0 in mozilla::dom::PExternalHelperAppParent::OnMessageReceived (this=0x1277308, __msg=...)
    at /src/mozilla/b2g/otoro/objdir-gecko/ipc/ipdl/PExternalHelperAppParent.cpp:215
#2  0x40bb64be in mozilla::dom::PContentParent::OnMessageReceived (this=0x104c0c0, __msg=...)
    at /src/mozilla/b2g/otoro/objdir-gecko/ipc/ipdl/PContentParent.cpp:1073
#3  0x40b98e54 in mozilla::ipc::AsyncChannel::OnDispatchMessage (this=0x104c0c8, msg=...) at /src/mozilla/b2g/mc-otoro/ipc/glue/AsyncChannel.cpp:463
#4  0x40b9c73c in mozilla::ipc::RPCChannel::OnMaybeDequeueOne (this=0x104c0c8) at /src/mozilla/b2g/mc-otoro/ipc/glue/RPCChannel.cpp:402
#5  0x40b8dd4e in DispatchToMethod<mozilla::plugins::PluginInstanceChild, void (mozilla::plugins::PluginInstanceChild::*)()> (this=<value optimized out>)
    at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/tuple.h:383
#6  RunnableMethod<mozilla::plugins::PluginInstanceChild, void (mozilla::plugins::PluginInstanceChild::*)(), Tuple0>::Run (this=<value optimized out>)
    at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/task.h:307
#7  0x40b9afdc in mozilla::ipc::RPCChannel::RefCountedTask::Run (this=<value optimized out>) at ../../dist/include/mozilla/ipc/RPCChannel.h:430
#8  mozilla::ipc::RPCChannel::DequeueTask::Run (this=<value optimized out>) at ../../dist/include/mozilla/ipc/RPCChannel.h:453
#9  0x40c54254 in MessageLoop::RunTask (this=0xf288, task=0xbee367fc) at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/message_loop.cc:326
#10 0x40c550a2 in MessageLoop::DeferOrRunPendingTask (this=0x104c0c8, pending_task=<value optimized out>)
    at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/message_loop.cc:334
#11 0x40c55c80 in MessageLoop::DoWork (this=0xf288) at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/message_loop.cc:434
#12 0x40b9aa94 in mozilla::ipc::MessagePump::Run (this=0xf098, aDelegate=0xf288) at /src/mozilla/b2g/mc-otoro/ipc/glue/MessagePump.cpp:86
#13 0x40c54204 in MessageLoop::RunInternal (this=0x41069f50) at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/message_loop.cc:208
#14 0x40c542ba in MessageLoop::RunHandler (this=0xf288) at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/message_loop.cc:201
#15 MessageLoop::Run (this=0xf288) at /src/mozilla/b2g/mc-otoro/ipc/chromium/src/base/message_loop.cc:175
#16 0x40b2efbc in nsBaseAppShell::Run (this=0x1da568) at /src/mozilla/b2g/mc-otoro/widget/xpwidgets/nsBaseAppShell.cpp:163
#17 0x40a6f004 in nsAppStartup::Run (this=0x1da510) at /src/mozilla/b2g/mc-otoro/toolkit/components/startup/nsAppStartup.cpp:256
#18 0x40503bda in XREMain::XRE_mainRun (this=0xbee36a3c) at /src/mozilla/b2g/mc-otoro/toolkit/xre/nsAppRunner.cpp:3786
#19 0x40506350 in XREMain::XRE_main (this=0xbee36a3c, argc=<value optimized out>, argv=0xbee38c24, aAppData=<value optimized out>)
    at /src/mozilla/b2g/mc-otoro/toolkit/xre/nsAppRunner.cpp:3863
#20 0x405064a8 in XRE_main (argc=1, argv=0xbee38c24, aAppData=0xa970, aFlags=<value optimized out>)
    at /src/mozilla/b2g/mc-otoro/toolkit/xre/nsAppRunner.cpp:3939
#21 0x0000896a in do_main (argc=1, argv=0xbee38c24) at /src/mozilla/b2g/mc-otoro/b2g/app/nsBrowserApp.cpp:153
#22 main (argc=1, argv=0xbee38c24) at /src/mozilla/b2g/mc-otoro/b2g/app/nsBrowserApp.cpp:236

Comment 2

[Tony Chung [:tchung]]

nom'ing for blocking k90 and blcoking basecamp.  we certainly can't have sites trying to instantiate plugins, causing us to crash.

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

mwu/dougt do you guys know about this code?

Comment 4

[Andreas Gal :gal]

How are we doing here?

Comment 5

[Doug Turner (:dougt)]

not crashing on a build from today - but not playing either.  Bad pixel format or oom now?


E/memalloc(  569): unrecognized pixel format: 8
W/GraphicBufferAllocator(  569): alloc(252, 141, 8, 00000133, ...) failed -22 (Invalid argument)
D/memalloc(  756): /dev/pmem: Unmapping buffer base:0x43310000 size:2277376 offset:1908736
D/memalloc(  569): /dev/pmem: Freeing buffer base:0x4844b000 size:368640 offset:1908736 fd:112
D/memalloc(  569): /dev/pmem: Freeing buffer base:0x48399000 size:368640 offset:1179648 fd:153
E/memalloc(  569): unrecognized pixel format: 9
W/GraphicBufferAllocator(  569): alloc(252, 141, 9, 00000133, ...) failed -22 (Invalid argument)
I/Gonk    (  569): GraphicBufferAllocator::alloc failed

Comment 6

[Doug Turner (:dougt)]

pixel format 8 and 9 aren't defined by HAL.  Something is odd here.

Comment 7

[Andreas Gal :gal]

Is this on otoro?

Comment 8

[Andreas Gal :gal]

This is some OEM-specific YUV format I am betting.

Comment 9

[Doug Turner (:dougt)]

yes.  otoro.  haven't been able to load any videos yet (youtube, videojs, firefox flicks)

Comment 10

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

In bug 777495 we weren't getting format 8, which is A8.  Gecko will output that for YUV components of video, among a few other things.  We deal with the allocation failure by falling back on a slower path.

But I don't know what format 9 is, looking ...

Comment 11

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

9 is |GGL_PIXEL_FORMAT_L_8,        // 8-bit L (R=G=B=L)|.  I'm guessing the binary representation is the same as A8, but I don't know what might be asking for this.

Doug, since the original bug here seems to be fixed, do you mind closing WFM and filing a new one for the L8 issue?

Comment 12

[John Hammink]

WFM - as mentioned above, we are no longer crashing but also not playing either.  Does someone have a link to the L8 issue?