808378 - crash in nsMediaPluginHost::CreateDecoder @ libOMX_Core.so@0x1... on devices with rk<n>board HW and Mali-400 MP GPU running JB

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Scoobidiver (away)]

It's #112 top crasher in 17.0b3.

Here is the breakdown by devices in 17.0:
* libOMX_Core.so@0x18c4 	7
Rockchip U30GT-H 	3
Rockchip rk30sdk 	2
Samsung SGH-I777 	1
Rockchip U9GT4 	1

Signature 	libOMX_Core.so@0x18c4 More Reports Search
UUID	a42eed8b-5f50-48c5-b0ad-10c162121101
Date Processed	2012-11-01 02:09:18
Uptime	142
Install Age	9.6 minutes since version was first installed.
Install Time	2012-11-01 01:59:36
Product	FennecAndroid
Version	17.0
Build ID	20121023123711
Release Channel	beta
OS	Linux
OS Version	0.0.0 Linux 3.0.8+ #8 SMP PREEMPT Sat Sep 22 15:16:58 CST 2012 armv7l
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
AdapterDescription: 'ARM -- Mali-400 MP -- OpenGL ES 2.0 -- Model: POV_TAB-PROTAB30-IPS10, Product: rk30sdk, Manufacturer: POV, Hardware: rk30board'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ WebGL? WebGL+ 
POV POV_TAB-PROTAB30-IPS10
rk30sdk/rk30sdk/rk30sdk:4.1.1/JRO03H/eng.lsd.20120905.183634:eng/test-keys
EMCheckCompatibility	True
Adapter Vendor ID	ARM
Adapter Device ID	Mali-400 MP
Device	POV POV_TAB-PROTAB30-IPS10
Android API Version	16 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 	libOMX_Core.so 	libOMX_Core.so@0x18c4 	
1 	libOMX_Core.so 	libOMX_Core.so@0x188b 	
2 	libOMX_Core.so 	libOMX_Core.so@0x154f 	
3 	libOMX_Core.so 	libOMX_Core.so@0x1517 	
4 	libstagefright_omx.so 	libstagefright_omx.so@0xf8c5 	
5 	libstagefrighthw.so 	libstagefrighthw.so@0x9e7 	
6 	libstagefrighthw.so 	libstagefrighthw.so@0x9f7 	
7 	libstagefright_omx.so 	libstagefright_omx.so@0xbf85 	
8 	libOMX_Core.so 	libOMX_Core.so@0x248a 	
9 	libc.so 	libc.so@0x1aed3 	
10 	libOMX_Core.so 	libOMX_Core.so@0x248a 	
11 	libOMX_Core.so 	libOMX_Core.so@0x2444 	
12 	libOMX_Core.so 	libOMX_Core.so@0x1a7b 	
13 	libOMX_Core.so 	libOMX_Core.so@0x2444 	
14 	libOMX_Core.so 	libOMX_Core.so@0x2444 	
15 	libOMX_Core.so 	libOMX_Core.so@0x13a9 	
16 	libOMX_Core.so 	libOMX_Core.so@0x245b 	
17 	libOMX_Core.so 	libOMX_Core.so@0x161f 	
18 	libstagefright_omx.so 	libstagefright_omx.so@0xc091 	
19 	libstagefright_omx.so 	libstagefright_omx.so@0xb1a3 	
20 	libstagefright.so 	libstagefright.so@0x9e8c5 	
21 	libstagefright.so 	libstagefright.so@0x9e88b 	
22 	libstagefright.so 	libstagefright.so@0xa461b 	
23 	libstagefright.so 	libstagefright.so@0x9c0c1 	
24 	libstagefright.so 	libstagefright.so@0x1c5b9c 	
25 	libstagefright.so 	libstagefright.so@0x1cad52 	
26 	libstagefright.so 	libstagefright.so@0x765f7 	
27 	libstagefright_foundation.so 	libstagefright_foundation.so@0x9ec2 	
28 	libstagefright_foundation.so 	libstagefright_foundation.so@0x8307 	
29 	libstagefright.so 	libstagefright.so@0x9c071 	
30 	libstagefright_foundation.so 	libstagefright_foundation.so@0x9ec2 	
31 	libc.so 	libc.so@0x16cef 	
32 	system@[e-mail]@classes.dex 	system@[e-mail]@classes.dex@0x115470 	
33 	libstagefright.so 	libstagefright.so@0x9022f 	
34 	libc.so 	libc.so@0x15219 	
35 	libstagefright.so 	libstagefright.so@0x903df 	
36 	libstagefright.so 	libstagefright.so@0x8e4d5 	
37 	libomxplugin.so 	OmxPlugin::OmxDecoder::Init 	OmxPlugin.cpp:414
38 	libomxplugin.so 	OmxPlugin::CreateDecoder 	OmxPlugin.cpp:877
39 	libxul.so 	nsMediaPluginHost::CreateDecoder 	content/media/plugins/nsMediaPluginHost.cpp:149
40 	libxul.so 	nsMediaPluginReader::ReadMetadata 	content/media/plugins/nsMediaPluginReader.cpp:44
41 	libxul.so 	nsBuiltinDecoderStateMachine::DecodeMetadata 	content/media/nsBuiltinDecoderStateMachine.cpp:1720
42 	libxul.so 	nsBuiltinDecoderStateMachine::DecodeThreadRun 	content/media/nsBuiltinDecoderStateMachine.cpp:479
43 	libxul.so 	nsRunnableMethodImpl<void , true>::Run 	nsThreadUtils.h:349
44 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:624
45 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:220
46 	libxul.so 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:257
47 	libnspr4.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c:156
48 	libc.so 	libc.so@0x12b72 	
49 	libc.so 	libc.so@0x122ca 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=libOMX_Core.so%400x18c4

Comment 1

[Scoobidiver (away)]

There are still crashes in 17.0b5 despite the StageFright blacklisting on ICS except for Samsung devices.

Comment 2

[Scoobidiver (away)]

I thinks it's an HW decoder issue that the blocklist doesn't handle.

Comment 3

[Scoobidiver (away)]

It's #18 top crasher in 18.0.

Comment 4

[Robert Kaiser]

libOMX_Core.so@0x1a40 now is at #14 on Firefox for Android 18.0 - on 19.0b3 it's only #28 for now, but that could be due to different devices being prominent on different channels.

Benoit, as this is rising in volume and you have been doing the patch to bug 806369 which is referenced here, I'm including you here - anything we can do to avoid this crash?

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Unfortunately I'm completely swamped at the moment (doing the b2g port of the layers refactoring).

That's very unfortunate as it seems that the blocklisting I made in bug 806369 doesn't work as expected.

We had a conversation around that in bug 802827, so if I have time to do anything I'd rather finish the work we had started there, I suppose.

All this does need fixing --- but we need to have a conversation of who should do what, as the current problems show that it doesn't scale well to always assign blacklisting bugs to me.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

So, I reread the bugs; it seems that bug 802827 is virtually fixed and is just waiting on some blocklist entries to be deployed (bug 824118); and the present bug is similar but on separate hardware. To fix it, just request a new blocklist entry for the STAGEFRIGHT feature on 'rk30board' hardware, i.e. completely similar to 824118 but with rk30board instead of the other hardware values there. Thanks!

Comment 7

[Chris Peterson [:cpeterson]]

This crash is now #5 on Firefox 19 release channel.

Comment 8

[Scoobidiver (away)]

How can blocklisting antares, endeavoru, harmony, picasso, picasso_e and ventana HW prevent crashes on rk30board HW?

Comment 9

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Scoobi : comment 6; I was marking it as a same type of fix.

Comment 10

[Scoobidiver (away)]

(In reply to Naoki Hirata :nhirata from comment #9)
> Scoobi : comment 6; I was marking it as a same type of fix.
Are you going to mark this bug dependent to every StageFright blocklist requests even those unrelated to fixing these crashes?

Comment 11

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Scoobi, let's handle this email thread off line in an email thread please if you would like to discuss this.  This discussion does not have anything to do with resolving the bug, only a matter of bugzilla usage.  Thanks.

Comment 12

[Scoobidiver (away)]

Here is a recent breakdown per device (min 5 crashes):
* libOMX_Core.so@0x1a40 	763
Rockchip rk30sdk 	55
Bq bq Curie 	30
Rockchip PMP7100D3G 	30
Bq bq Edison 	29
Rockchip ADM8000KP_A 	28
Rockchip MK808B 	21
Rockchip PMP5880D 	21
Yarvik Xenta TAB10-201 	18
Rockchip PMP7100D 	16
Rockchip MK808 	14
Rockchip GEM10313BK 	14
AOC MW0712 	12
Rockchip Rikomagic MK802IIIS 	12
Samsung GT-I9100 	12
SurfTab ST10216-1 	12
Rockchip ACGM727KC 	9
PIPO S2 	9
Rockchip TR736 	8
Rockchip PMP5570C 	8
Rockchip Pro 10 dual core 	8
Rockchip VS TOUCHTAB 10.1DC 	7
Rockchip myTab 10 Dual Core 	7
VS VS TOUCHTAB 8DC 	7
Rockchip N90DC_S 	6
Rockchip NEO-X5 	6
Rockchip U21GT 	6
AOC MW0831 	6
Rockchip GOCLEVER TAB R76.1 	6
Rockchip MID 	6
Rockchip MIDC410 	6
PIPO S1 	6
Rockchip 1038EP 	5
Rockchip TM-MID720 	5
PIPO M3 	5
BLUSENS TOUCH96 	5
Samsung SGH-I777 	5
* libOMX_Core.so@0x18c4 	160
GOCLEVER TAB R83 GOCLEVER 	13
Rockchip rk30sdk 	10
PIPO M1 	9
Rockchip TP10.1-1500DC Dark grey metal 	8
Rockchip Surfer 10.11 	7
Rockchip U30GT-H 	6
Rockchip N70-S 	6
Rockchip SP0718 	6
POV POV_TAB-PROTAB30-IPS10 	5

Comment 13

[Robert Kaiser]

libOMX_Core.so@0x1a40 is #3 on release 20 and #5 on 21.0b3, FYI.

Comment 14

[bhavana bajaj [:bajaj]]

(In reply to Robert Kaiser (:[e-mail]) from comment #13)
> libOMX_Core.so@0x1a40 is #3 on release 20 and #5 on 21.0b3, FYI.

https://bugzilla.mozilla.org/show_bug.cgi?id=863843 has been recently uplifted and should help this.

Comment 15

[Scoobidiver (away)]

Despite the rk30board blocklist, it still happens (see bp-d9bd6adc-04e1-435b-8a4d-e4b202130427) but at a lower volume: #32 crasher in 21.0b4.

Comment 16

[Scoobidiver (away)]

It's still high: #7 top crasher in 21.0.
The hw breakdown is as follow:
* rk2928board: 62% 
* rk30board: 33% (already blocklisted in 21.0 for Stagefright on all Android versions: http://mxr.mozilla.org/mozilla-release/source/widget/android/GfxInfo.cpp#366)
* rk29board: 5%

The blocklist is applied (see bp-b3e80c67-b3a3-4bb4-81f0-265402130515) when applicable but it seems it's not a video crash. Flash is also not in the stack trace.

Comment 17

[bhavana bajaj [:bajaj]]

:bjacob , we were doing some spring cleaning of our top crashes and this is still on our top-crash list with #9 on release.Going by the bug comment #6 I think there was some action that we could take to make the blocklist work.Can you please help with that or recommend anyone else who can work on it?

Comment 18

[cajbir (:cajbir)]

(In reply to bhavana bajaj [:bajaj] from comment #17)
> :bjacob , we were doing some spring cleaning of our top crashes and this is
> still on our top-crash list with #9 on release.Going by the bug comment #6 I
> think there was some action that we could take to make the blocklist
> work.Can you please help with that or recommend anyone else who can work on
> it?

This should be fixed by the landing of bug 860599. Is anyone able to verify?

Comment 19

[Benoit Jacob [:bjacob] (mostly away)]

(looks like I'm not needed here, see comment 18)

Comment 20

[bhavana bajaj [:bajaj]]

(In reply to Chris Double (:doublec) from comment #18)
> (In reply to bhavana bajaj [:bajaj] from comment #17)
> > :bjacob , we were doing some spring cleaning of our top crashes and this is
> > still on our top-crash list with #9 on release.Going by the bug comment #6 I
> > think there was some action that we could take to make the blocklist
> > work.Can you please help with that or recommend anyone else who can work on
> > it?
> 
> This should be fixed by the landing of bug 860599. Is anyone able to verify?

needinfo'ing :kbrosnan to help with that info as that's landed in Fx25.

Comment 21

[Kevin Brosnan [Ex-Mozilla]]

Fixed by 860599.

Comment 22

[u279076]

This has shown back up in Fennec 35:
https://crash-stats.mozilla.com/report/list?product=FennecAndroid&range_value=7&range_unit=days&date=2014-12-08&signature=libOMX_Core.so%400x1a40&version=FennecAndroid%3A35.0b1

Is that worth filing a new bug or should I reopen this bug?

Comment 23

[u279076]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #22)
> This has shown back up in Fennec 35:
> https://crash-stats.mozilla.com/report/
> list?product=FennecAndroid&range_value=7&range_unit=days&date=2014-12-
> 08&signature=libOMX_Core.so%400x1a40&version=FennecAndroid%3A35.0b1
> 
> Is that worth filing a new bug or should I reopen this bug?

Just to be clear, [@ libOMX_Core.so@0x1a40] has shown up - the stack looks similar to what was originally reported in comment 0 but I'm not sure it's the same crash.

Comment 24

[Kevin Brosnan [Ex-Mozilla]]

Please file a new bug.

Comment 25

[u279076]

(In reply to Kevin Brosnan [:kbrosnan] from comment #24)
> Please file a new bug.

Done, see bug 1108709.