796773 - "Jewel Treasure Match" game from everything.me always crashes and reboots

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect, P1)

Description

[GH to BZ]

[GitHub issue by kaichih on 2012-09-28T09:58:35Z, https://github.com/mozilla-b2g/gaia/issues/5404]
STR: 

1. Go to everything.me and go to game category. 
2. Execute "Jewel Treasure Match" game. 
3. Firefox OS crashes and reboots. 

Always reproducible.

Comment 1

[GH to BZ]

[GitHub comment by nhirata on 2012-09-28T23:40:24Z]
Probably OOM... do you have a logcat?

Comment 2

[GH to BZ]

[GitHub comment by jds2501 on 2012-09-29T02:08:07Z]
A crash is a platform bug. Can you move to bugzilla under boottogecko general?

Comment 3

[Alex Keybl [:akeybl]]

[mass adding reproducible keyword for any open Gaia bug with the word "STR:" in comments]

Comment 4

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Attachment: log cat

Comment 5

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Wow.  I don't think this is just an OOM issue any more based on logcat.  On some occasions it looks like the plugin got zombied?  If you try to kill the task, you don't see it in the task manager.

Comment 6

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

This is a crash

10-08 12:54:07.067: A/libc(482): Fatal signal 11 (SIGSEGV) at 0x000001e2 (code=-6)

Thanks for the logcat!

Comment 7

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Np... it was your comment in another bug that made me dig deeper.  lessons learned.

Comment 8

[Jason Smith [:jsmith]]

Does this crash still reproduce on a more recent build?

Comment 9

[Alex Keybl [:akeybl]]

This is one of our few reproducible crashes. Can we see if this still reproduces?

Comment 10

[Andrew Overholt [:overholt]]

I can still reproduce this on 2012-12-03 on Unagi.  We should fix it.

Chris, are you the best owner here?

Comment 11

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

(In reply to Andrew Overholt [:overholt] from comment #10)
> Chris, are you the best owner here?

Sadly yes.

I was able to look at this a little today.  The cause isn't obvious.  What seems to be happening is
 - (usually) the content process running this game makes a gralloc request
 - the compositor thread gets into PmemUserspaceAlloc::alloc_buffer()
 - the allocation (seems to) succeed
 - PmemUserspaceAlloc::alloc_buffer() tries to zero out the newly allocated region, but segfaults writing outside the mapped area for the buffer

The last part there makes no sense.  There's no race condition possible in the gecko gralloc code because it's all synchronous.  I also can't walk out of the PmemUserspaceAlloc::alloc_buffer() code because a library without unwind info calls into it.

So the things we need to figure out are
 - what kind of allocation is being requested
 - whether the successful alloc actually returns memory that fits within the pmem region

In either case, I suspect we're going to have to phone a friend at CAF.

I can't reproduce this in the emulator or on desktop.

Comment 12

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

(In reply to Chris Jones [:cjones] [:warhammer] from comment #11)
>  - PmemUserspaceAlloc::alloc_buffer() tries to zero out the newly allocated
> region, but segfaults writing outside the mapped area for the buffer

I should add that gdb can't read even the base of the pmem region.  But I don't trust that too much because the segfault happens on an address well above the base pointer.

Comment 13

[Andrew Overholt [:overholt]]

(In reply to Chris Jones [:cjones] [:warhammer] from comment #11)
> In either case, I suspect we're going to have to phone a friend at CAF.

Want me to email?

Comment 14

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I need to get more info before phoning friends, but hopefully we can keep the discussion in bz as much as possible.

Comment 15

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Argh, regressions.

Comment 16

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Can't reproduce anymore.

Comment 17

[Cody Roesch [:croesch]]

Attachment: Jewel Treasure Match Crash Log

Comment 18

[Cody Roesch [:croesch]]

Hey Guys,
   When I ran this game on Unagi build 20121231070201, I got a crash message but then the game just went on launching. So I checked the reported crashes and was surprised to see a crash log for that even had posted.

So I am getting the crash but for some reason it doesn't stop the game from launching. Weird.

Comment 19

[Cody Roesch [:croesch]]

I wanted to clarify my comment above...
When I launched Jewel Treasure Match, I received an error message "Just Crashed" on a grey screen. That message was up for about 2 seconds or less and then game loaded to the Main Menu.

I am actually unable to play the game due to what seems like the game being in a frozen state once the Main Menu loads. This freeze has been seen on multiple phones but the "JUST CRASHED" message only appeared 1 time.

Comment 20

[Robert Kaiser]

Can you give us the crash report ID of that one?

Comment 21

[Robert Kaiser]

Oh, actually, that's bp-a456d1d8-2cf7-42d0-9a78-b797c2121231 - please just paste that in the bug comment instead of attaching that text file. ;-)

Comment 22

[Robert Kaiser]

The crash is  [@ jemalloc_crash | arena_dalloc | free | moz_free | mozilla::CameraControlImpl::~CameraControlImpl ] - that's in camera code. Did you have the camera app open?

Comment 23

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

That's bug 823955.

Comment 24

[Cody Roesch [:croesch]]

I'm not sure if I had camera app open. I'm trying to repro but so far no luck.