806176 - crash in mozilla::AndroidGeckoLayerClient::ProgressiveUpdateCallback

Status: RESOLVED WORKSFORME

(Core :: Graphics: Layers, defect)

Description

[Scoobidiver (away)]

There are two crashes from two users in 19.0a1/20121027. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5ecff3e46ed5&tochange=f9acc2e4d4e3


Signature 	dvmAbort | JNI_CreateJavaVM | JNI_CreateJavaVM | _JNIEnv::CallObjectMethod(_jobject*, _jmethodID*, ...) | mozilla::AndroidGeckoLayerClient::ProgressiveUpdateCallback(bool, mozilla::gfx::Rect const&, float, mozilla::gfx::Rect&, float&, float&) More Reports Search
UUID	ab0f03d7-9ed3-4217-840c-0ca822121028
Date Processed	2012-10-28 03:50:11
Uptime	17765
Install Age	4.9 hours since version was first installed.
Install Time	2012-10-27 23:53:45
Product	FennecAndroid
Version	19.0a1
Build ID	20121027030611
Release Channel	nightly
OS	Android
OS Version	0.0.0 Linux 2.6.32.9-perf #1 PREEMPT Wed Aug 3 20:29:41 CST 2011 armv7l Huawei/U8800/hwu8800/U8800:2.2.2/HuaweiU8800/C96B138SP06:user/ota-rel-keys,release-keys
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0xdeadd00d
App Notes 	
AdapterDescription: 'Qualcomm -- Adreno 205 -- OpenGL ES 2.0 1309647 -- Model: MTC Neo, Product: U8800, Manufacturer: HUAWEI, Hardware: huawei'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ 
HUAWEI MTC Neo
Huawei/U8800/hwu8800/U8800:2.2.2/HuaweiU8800/C96B138SP06:user/ota-rel-keys,release-keys
EMCheckCompatibility	True
Adapter Vendor ID	Qualcomm
Adapter Device ID	Adreno 205
Device	HUAWEI MTC Neo
Android API Version	8 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 	libdvm.so 	dvmAbort 	
1 	libdvm.so 	JNI_CreateJavaVM 	
2 	libdvm.so 	JNI_CreateJavaVM 	
3 	libxul.so 	_JNIEnv::CallObjectMethod 	jni.h:617
4 	libxul.so 	mozilla::AndroidGeckoLayerClient::ProgressiveUpdateCallback 	AndroidJavaWrappers.cpp:872
5 	libxul.so 	mozilla::AndroidBridge::ProgressiveUpdateCallback 	AndroidBridge.cpp:2536
6 	libxul.so 	mozilla::layers::BasicShadowLayerManager::ProgressiveUpdateCallback 	BasicLayerManager.cpp:1305
7 	libxul.so 	mozilla::layers::BasicTiledThebesLayer::ComputeProgressiveUpdateRegion 	BasicTiledThebesLayer.cpp:276
8 	libxul.so 	mozilla::layers::BasicTiledThebesLayer::PaintThebes 	BasicTiledThebesLayer.cpp:446
9 	libxul.so 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren 	BasicLayerManager.cpp:825
10 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	BasicLayerManager.cpp:932
11 	libxul.so 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren 	BasicLayerManager.cpp:840
12 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	BasicLayerManager.cpp:932
13 	libxul.so 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren 	BasicLayerManager.cpp:840
14 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	BasicLayerManager.cpp:932
15 	libxul.so 	mozilla::layers::BasicLayerManager::PaintSelfOrChildren 	BasicLayerManager.cpp:840
16 	libxul.so 	mozilla::layers::BasicLayerManager::PaintLayer 	BasicLayerManager.cpp:932
17 	libxul.so 	mozilla::layers::BasicLayerManager::EndTransactionInternal 	BasicLayerManager.cpp:585
18 	libxul.so 	mozilla::layers::BasicLayerManager::EndTransaction 	BasicLayerManager.cpp:508
19 	libxul.so 	mozilla::layers::BasicShadowLayerManager::EndTransaction 	BasicLayerManager.cpp:1130
20 	libxul.so 	nsDisplayList::PaintForFrame const 	nsDisplayList.cpp:1118
21 	libxul.so 	nsDisplayList::PaintRoot const 	nsDisplayList.cpp:983
22 	libxul.so 	nsLayoutUtils::PaintFrame 	nsLayoutUtils.cpp:1853
23 	libxul.so 	PresShell::Paint 	nsPresShell.cpp:5340
24 	libxul.so 	nsViewManager::ProcessPendingUpdatesForView 	nsViewManager.cpp:439
25 	libxul.so 	nsViewManager::ProcessPendingUpdates 	nsViewManager.cpp:1214
26 	libxul.so 	nsRefreshDriver::Notify 	nsRefreshDriver.cpp:432
27 	libxul.so 	nsTimerImpl::Fire 	nsTimerImpl.cpp:475 
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=dvmAbort+|+JNI_CreateJavaVM+|+JNI_CreateJavaVM+|+_JNIEnv%3A%3ACallObjectMethod%28_jobject*%2C+_jmethodID*%2C+...%29+|+mozilla%3A%3AAndroidGeckoLayerClient%3A%3AProgressiveUpdateCallback%28bool%2C+mozilla%3A%3Agfx%3A%3ARect+const%26%2C+float%2C+mozilla%3A%3Agfx%3A%3ARect%26%2C+float%26%2C+float%26%29
https://crash-stats.mozilla.com/report/list?signature=_JNIEnv%3A%3ACallObjectMethod%28_jobject*%2C+_jmethodID*%2C+...%29+|+mozilla%3A%3AAndroidGeckoLayerClient%3A%3AProgressiveUpdateCallback%28bool%2C+mozilla%3A%3Agfx%3A%3ARect+const%26%2C+float%2C+mozilla%3A%3Agfx%3A%3ARect%26%2C+float%26%2C+float%26%29

Comment 1

[Scoobidiver (away)]

It spiked in 19.0a1/20121109. The regression range for the spike is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=36e99ea02c05&tochange=90cea19e27e2

Comment 2

[Scoobidiver (away)]

85% of crashes occur on ARMv6 devices.

Comment 3

[Alex Keybl [:akeybl]]

Went through the affected ARMv6 devices and pulled out Samsung Galaxy Ace, Samsung Galaxy Y, and the Samsung Galaxy Ace Duos. Only the last phone is within our spec for released versions of Fennec, but we could use any of these for testing.

Would be great to hear if we think anything in the regression range from Comment 1 rings a bill with the mobile team.

Comment 4

[Chris Lord [:cwiiis]]

(In reply to Alex Keybl [:akeybl] from comment #3)
> Went through the affected ARMv6 devices and pulled out Samsung Galaxy Ace,
> Samsung Galaxy Y, and the Samsung Galaxy Ace Duos. Only the last phone is
> within our spec for released versions of Fennec, but we could use any of
> these for testing.
> 
> Would be great to hear if we think anything in the regression range from
> Comment 1 rings a bill with the mobile team.

No commit in this range looks particularly suspect to me, sorry :(

Comment 5

[Kevin Brosnan [Ex-Mozilla]]

* http://bttv.click-tt.de/cgi-bin/WebObjects/ClickBTTV.woa/wa/groupPage?championship=B700+2012%2F13&group=180000
* http://bttv.click-tt.de/cgi-bin/WebObjects/ClickBTTV.woa/wa/groupPage?championship=B700+2012%2F13&group=180001
* http://bttv.click-tt.de/cgi-bin/WebObjects/ClickBTTV.woa/wa/groupPage?championship=V000+2012%2F13&group=180286
* http://bttv.click-tt.de/cgi-bin/WebObjects/ClickBTTV.woa/wa/leaguePage?championship=B700+2012%2F13
* http://bttv.click-tt.de/cgi-bin/WebObjects/ClickBTTV.woa/wa/clubTeams?club=24742
* http://androidheadlines.com/2012/10/droid-game-hub-weekly-102012-razor-salvation-thd-global-outbreak-shadowgun-deadzone-marvel-war-of-the-heroes-and-more.html

Comment 6

[Scoobidiver (away)]

One crash signature is specific to ARMv6 devices and the other one to ARMv7 ones so only 66% of crashes happen on ARMv6 devices.

It happened one build earlier than comment 0 states it. Here is the regression range:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=5c82f5a5e90d&tochange=5ecff3e46ed5

Comment 7

[Chris Lord [:cwiiis]]

(In reply to Scoobidiver from comment #6)
> One crash signature is specific to ARMv6 devices and the other one to ARMv7
> ones so only 66% of crashes happen on ARMv6 devices.
> 
> It happened one build earlier than comment 0 states it. Here is the
> regression range:
> http://hg.mozilla.org/mozilla-central/
> pushloghtml?fromchange=5c82f5a5e90d&tochange=5ecff3e46ed5

oh, well this range includes switching on progressive tiles (bug 795259), so of course the crash didn't happen before this point (the callback was never called). When you say it's a spike, does that mean that it's gone down now, or that there are still crashes here being reported?

Do the URLs in comment #5 cause instant crashes? Is this only on certain devices?

Comment 8

[Scoobidiver (away)]

(In reply to Chris Lord [:cwiiis] from comment #7)
> When you say it's a spike, does that mean that it's gone down now,
> or that there are still crashes here being reported?
The spike lasted two builds but crashes remain at least up to 19.0a1/20121113.

> Is this only on certain devices?
Samsung GT-S5830L 	20
Samsung GT-S5360 	4
Samsung GT-I9001 	1
Samsung GT-S6802B 	1
Motorola MB860 	2
Motorola DROID X2 	1

Comment 9

[Alex Keybl [:akeybl]]

Will leave this in nominate for now, since it's not clear whether this will be a top crash on Aurora.

Comment 10

[Robert Kaiser]

I can't see any of those signatures in the last week. Scoobidiver, do you agree that this is WFM now? If so, we should also clear the tracking flag for 19.

Comment 11

[Scoobidiver (away)]

(In reply to Robert Kaiser (:[e-mail]) from comment #10)
> I can't see any of those signatures in the last week. Scoobidiver, do you
> agree that this is WFM now? If so, we should also clear the tracking flag
> for 19.
Crashes stopped after 19.0a1/20121116 but as it affected few users this could be caused by users leaving the Nightly channel. Let's wait before closing the bug.

Comment 12

[Mark Finkle (:mfinkle) (use needinfo?)]

Re-nom if volume picks up

Comment 13

[Scoobidiver (away)]

There's only one crash in 19.0.2 so let's close it