Closed Bug 845734 Opened 7 years ago Closed 3 months ago

crash in mozilla::MediaPluginHost::CreateDecoder @ libcutils.so@0x50.. on Sony Xperia S, T, V and Z running JB 4.1

Categories

(Core :: Audio/Video: Playback, defect, P5, critical)

ARM
Android
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox19 --- affected
firefox20 + wontfix
firefox21 + fixed
firefox22 --- verified
fennec + ---

People

(Reporter: scoobidiver, Unassigned)

References

()

Details

(Keywords: crash, regression, reproducible, Whiteboard: [native-crash][leave open])

Crash Data

Attachments

(3 files, 3 obsolete files)

With combined signatures, it's #11 top crasher in the first day of 20.0b1.
It happens on:
* Sony SO-02E = Sony Xperia Z
* Sony C6603 = Sony Xperia Z
* Sony LT25i = Sony Xperia V
* Sony LT30p = Sony Xperia T

Signature 	libcutils.so@0x507c More Reports Search
UUID	0af92378-2f7f-4ac7-bdaf-6309c2130227
Date Processed	2013-02-27 06:19:47
Uptime	7113
Install Age	1.4 days since version was first installed.
Install Time	2013-02-25 20:49:58
Product	FennecAndroid
Version	20.0
Build ID	20130222123731
Release Channel	beta
OS	Android
OS Version	0.0.0 Linux 3.4.0-g298631f-02003-g681f581 #1 SMP PREEMPT Thu Jan 17 21:50:36 2013 armv7l docomo/SO-02E_1272-3467/SO-02E:4.1.2/10.1.D.0.317/wj5_rw:user/release-keys
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGBUS
Crash Address	0x4478766d
App Notes 	
AdapterDescription: 'Qualcomm -- Adreno (TM) 320 -- OpenGL ES 2.0 V@6.0 AU@04.01.02.44.002 (CL@2778170) -- Model: SO-02E, Product: SO-02E_1272-3467, Manufacturer: Sony, Hardware: qcom'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ Stagefright? Stagefright+ 
Sony SO-02E
docomo/SO-02E_1272-3467/SO-02E:4.1.2/10.1.D.0.317/wj5_rw:user/release-keys
Processor Notes 	sp-processor09.phx1.mozilla.com_9484:2008; exploitablity tool: ERROR: unable to analyze dump
EMCheckCompatibility	True
Adapter Vendor ID	Qualcomm
Adapter Device ID	Adreno (TM) 320
Device	Sony SO-02E
Android API Version	16 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 	libcutils.so 	libcutils.so@0x507c 	
1 	libstagefright.so 	libstagefright.so@0xbafa5 	
2 		@0x696f9ffe 	
3 	libmmparser.so 	libmmparser.so@0x91afe 	
...	
18 	libstagefright.so 	libstagefright.so@0x1a9d76 	
19 	linker 	linker@0x6ea7 	
20 	libnspr4.so 	pt_PostNotifies 	nsprpub/pr/src/pthreads/ptsynch.c:106
21 	libnspr4.so 	PR_Unlock 	nsprpub/pr/src/pthreads/ptsynch.c:208
22 	libnspr4.so 	PR_Unlock 	nsprpub/pr/src/pthreads/ptsynch.c:205
23 	libxul.so 	nsThread::GetObserver 	Mutex.h:83
24 	libxul.so 	nsThread::PutEvent 	nsCOMPtr.h:449
25 	libxul.so 	NS_DispatchToMainThread_P 	xpcom/glue/nsCOMPtr.h:410
26 	libnspr4.so 	PR_ExitMonitor 	nsprpub/pr/src/pthreads/ptsynch.c:557
27 	libxul.so 	mozilla::ReentrantMonitorAutoEnter::~ReentrantMonitorAutoEnter 	ReentrantMonitor.h:80
28 		@0x927a3ccf 	
29 	libomxplugin.so 	OmxPlugin::OmxDecoder::Init 	media/omx-plugin/OmxPlugin.cpp:357
30 	libomxplugin.so 	OmxPlugin::CreateDecoder 	media/omx-plugin/OmxPlugin.cpp:983
31 	libxul.so 	mozilla::MediaPluginHost::CreateDecoder 	content/media/plugins/MediaPluginHost.cpp:267
32 	libxul.so 	mozilla::MediaPluginReader::ReadMetadata 	content/media/plugins/MediaPluginReader.cpp:50
33 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeMetadata 	content/media/MediaDecoderStateMachine.cpp:1776
34 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeThreadRun 	content/media/MediaDecoderStateMachine.cpp:477
35 	libxul.so 	nsRunnableMethodImpl<tag_nsresult 	
36 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
37 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
38 	libxul.so 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:265
39 	libnspr4.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c:156
40 	libc.so 	libc.so@0x12ef2 	
41 	libc.so 	libc.so@0x1264a

More reports at:
https://crash-stats.mozilla.com/query/query?product=FennecAndroid&query_search=signature&query_type=contains&query=libcutils.so%400x5&do_query=1
It spikes across all channels so maybe it's caused by an OS upgrade on those Sony devices.
Version: 20 Branch → Trunk
I'm curious if the fix for the Xperia Ion in bug 817478 would work for these devices. Does anyone have one of these that reproduces the crash that can test a fix if I provide a patch?
With combined signatures, it's #8 top crasher in 19.0 and #16 in 20.0b1.
Keywords: topcrash
Mobile QA is at the FxA team week we don't have this device with us. I don't think we have any JB Xperia devices in MV or Toronto.
(In reply to Chris Double (:doublec) from comment #2)
> I'm curious if the fix for the Xperia Ion in bug 817478 would work for these
> devices. Does anyone have one of these that reproduces the crash that can
> test a fix if I provide a patch?

Chris considering comment# 4,can we try a low risk speculative fix on nightly/aurora and check crash-stats to see if it helped ? If that works,without any fallouts we can think about uplift in beta before 3/12 which would be our last opportunity to land any speculative fixes .
Assignee: nobody → chris.double
(In reply to Kevin Brosnan [:kbrosnan] from comment #4)
> Mobile QA is at the FxA team week we don't have this device with us. I don't
> think we have any JB Xperia devices in MV or Toronto.

What's the ETA for ordering an applicable device?
I put an order in. Now in Desktop's hands.  REQ0014051
Trivial to crash using a Sony Xperia Z.

* Load https://hacks.mozilla.org/2012/11/h264-video-in-firefox-for-android/
* Click the "Big Buck Bunny" video link
* Crash

bp-db20eff1-cde7-44f3-8c73-0a3232130313
(In reply to Kevin Brosnan [:kbrosnan] from comment #8)
> Trivial to crash using a Sony Xperia Z.

Are you able to do builds? If I provide a temporary patch for you to try that forces use of our 'sony ICS workaround' are you able to test it?
Attached patch Possible fix (obsolete) — Splinter Review
This enables our ICS Sony workaround on Jellybean as well. It also adds the device id's for those listed in the original comment. kbrosnan, does this fix the crash for you?
Flags: needinfo?(kbrosnan)
Attached patch Possible fix (obsolete) — Splinter Review
Rather than listing the actual device numbers this patch checks for "Sony Ericsson" as the manufacturer.
Attachment #724263 - Attachment is obsolete: true
Pushed to try as https://tbpl.mozilla.org/?tree=Try&rev=7a6614131761 will check back when that build is done.
Flags: needinfo?(kbrosnan)
Still crashes with the try build. Though Sony bought out Ericsson several months ago. I wonder if the manufacturer string changed. Where can I query that.
Yep. Answered my own question by visiting about:support. The graphics info shows that the Manufacturer is Sony.
Changed the match to be 'Sony' and pushed that to try https://tbpl.mozilla.org/?tree=Try&rev=11674192352c will check on this in the morning Pacific.
Negative. The build from comment 15 still crashes.
(In reply to Kevin Brosnan [:kbrosnan] from comment #16)
> Negative. The build from comment 15 still crashes.

Ok, I'll need a device to go further. Can you send me exact details on the device you're using the duplicate the crash? Model number, manufacturer, OS version, etc.
Flags: needinfo?(kbrosnan)
Create a Desktop ticket referencing REQ0014051 I received a C6603 / Sony Xperia Z
Flags: needinfo?(kbrosnan)
tracking-fennec: --- → ?
At this point in beta 20 we'll have to wontfix this and hope investigation provides a possible fix for FF21.
Sony ST26i is also affected with another signature.
Crash Signature: [@ libcutils.so@0x507c ] [@ libcutils.so@0x5050 ] → [@ libcutils.so@0x507c ] [@ libcutils.so@0x5050 ] [@ libcutils.so@0x558c ]
Summary: crash in mozilla::MediaPluginHost::CreateDecoder @ libcutils.so@0x50.. on Sony Xperia T, V and Z running JB → crash in mozilla::MediaPluginHost::CreateDecoder @ libcutils.so@0x50.. on Sony Xperia S, T, V and Z running JB
I've reaqested a Sony Xperia Z for testing.
tracking-fennec: ? → +
I have a Sony Xperia Z for testing now.
(In reply to Scoobidiver from comment #3)
> With combined signatures, it's #8 top crasher in 19.0 and #16 in 20.0b1.
It's now even higher: #2 top crasher in 20.0 with 5.5% of all crashes.
Chris, any new interesting findings on the investigation you have been helping with ?

Given comment #23, it will be great to find a fix for this in FX21 timeframe than release with a known reproducible top-crasher .
Attachment #724268 - Attachment is obsolete: true
(In reply to bhavana bajaj [:bajaj] from comment #24)
> Chris, any new interesting findings on the investigation you have been
> helping with ?

I've been unable to find the issue. We're currently working on a different approach to solve the crashing problems across devices.
Bug 860599 will fix this but in the meantime we'll blocklist.
Depends on: 860599
Attachment #739400 - Flags: review?(bjacob)
Whiteboard: [native-crash] → [native-crash][leave open]
Attachment #739400 - Flags: review?(bjacob) → review+
Keywords: verifyme
Since Chris has the device, I trust that this is block-listed and fine on mozilla-central. Chris, please verify this bug.
It still happens in 21.0b4 at the same crash rate.

If the *else if* use right?
      if (CompareVersions(mOSVersion.get(), "2.2.0") >= 0 &&
          CompareVersions(mOSVersion.get(), "2.3.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "2.3.0") >= 0 &&
          CompareVersions(mOSVersion.get(), "2.4.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "3.0.0") >= 0 &&
          CompareVersions(mOSVersion.get(), "4.0.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "4.0.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "4.1.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "4.2.0") < 0)
(In reply to Scoobidiver from comment #33)
> It still happens in 21.0b4 at the same crash rate.

Can you link to a crash report? Maybe some devices are reporting a slightly different manufacturer.
(In reply to Chris Double (:doublec) from comment #34)
> Can you link to a crash report? Maybe some devices are reporting a slightly
> different manufacturer.
See https://crash-stats.mozilla.com/query/query?product=FennecAndroid&version=FennecAndroid%3A21.0b4&query_search=signature&query_type=contains&query=libcutils.so%400x50&do_query=1
The manufacturer is still Sony and not Sony Ericsson.
:kbrosnan, has a device in and will be able to check the first thing Monday morning.
CCing :tchung here to see if he can help before that.

:Chris,
Based on comment# 35 looks like our blocklist didn't work as expected. Were you able to verify the patch on your device if it was blocklisted? Do we have a problem only with a few devices ?
Attachment #742929 - Flags: review?(bjacob)
Attachment #742929 - Flags: review?(bjacob) → review+
Comment on attachment 742929 [details] [diff] [review]
Fix for mozilla beta

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Enabling of stagefright decoding on gingerbread
User impact if declined: Some gingerbread devices will crash when videos are played
Testing completed (on m-c, etc.): Unable to test due to not having devices
Risk to taking this patch (and alternatives if risky): Devices that might not have crashed will not play video
String or IDL/UUID changes made by this patch: None
Attachment #742929 - Flags: approval-mozilla-beta?
Comment on attachment 742929 [details] [diff] [review]
Fix for mozilla beta

Patch only needed on beta as it had a typo.Aurora/central works as expected.
Attachment #742929 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Requesting QA verification on this bug once this lands.
Tested this on trunk no crash on Video for Everyone. Release still crashes. Sony Xperia S.
Blocks: 869444
Keywords: topcrash
Summary: crash in mozilla::MediaPluginHost::CreateDecoder @ libcutils.so@0x50.. on Sony Xperia S, T, V and Z running JB → crash in mozilla::MediaPluginHost::CreateDecoder @ libcutils.so@0x50.. on Sony Xperia S, T, V and Z running JB 4.1
Attached patch Remove blocklist (obsolete) — Splinter Review
Removes blocklist for when bug 860599 lands. That bug fixes the underlying issue.
Attached patch Remove blocklistSplinter Review
Attachment #776130 - Attachment is obsolete: true
Attachment #797061 - Flags: review?(bjacob)
Attachment #797061 - Flags: review?(bjacob) → review+
Duplicate of this bug: 919660
filter on [mass-p5]
Priority: -- → P5
Assignee: cajbir.bugzilla → nobody
Component: Audio/Video → Audio/Video: Playback
No assignee, updating the status.
Status: ASSIGNED → NEW
No assignee, updating the status.
No assignee, updating the status.

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 3 months ago
Resolution: --- → WORKSFORME

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression
You need to log in before you can comment on or make changes to this bug.