845734 - crash in mozilla::MediaPluginHost::CreateDecoder @ libcutils.so@0x50.. on Sony Xperia S, T, V and Z running JB 4.1

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: Playback, defect, P5)

Description

[Scoobidiver (away)]

With combined signatures, it's #11 top crasher in the first day of 20.0b1.
It happens on:
* Sony SO-02E = Sony Xperia Z
* Sony C6603 = Sony Xperia Z
* Sony LT25i = Sony Xperia V
* Sony LT30p = Sony Xperia T

Signature 	libcutils.so@0x507c More Reports Search
UUID	0af92378-2f7f-4ac7-bdaf-6309c2130227
Date Processed	2013-02-27 06:19:47
Uptime	7113
Install Age	1.4 days since version was first installed.
Install Time	2013-02-25 20:49:58
Product	FennecAndroid
Version	20.0
Build ID	20130222123731
Release Channel	beta
OS	Android
OS Version	0.0.0 Linux 3.4.0-g298631f-02003-g681f581 #1 SMP PREEMPT Thu Jan 17 21:50:36 2013 armv7l docomo/SO-02E_1272-3467/SO-02E:4.1.2/10.1.D.0.317/wj5_rw:user/release-keys
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGBUS
Crash Address	0x4478766d
App Notes 	
AdapterDescription: 'Qualcomm -- Adreno (TM) 320 -- OpenGL ES 2.0 V@6.0 AU@04.01.02.44.002 (CL@2778170) -- Model: SO-02E, Product: SO-02E_1272-3467, Manufacturer: Sony, Hardware: qcom'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ Stagefright? Stagefright+ 
Sony SO-02E
docomo/SO-02E_1272-3467/SO-02E:4.1.2/10.1.D.0.317/wj5_rw:user/release-keys
Processor Notes 	sp-processor09.phx1.mozilla.com_9484:2008; exploitablity tool: ERROR: unable to analyze dump
EMCheckCompatibility	True
Adapter Vendor ID	Qualcomm
Adapter Device ID	Adreno (TM) 320
Device	Sony SO-02E
Android API Version	16 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 	libcutils.so 	libcutils.so@0x507c 	
1 	libstagefright.so 	libstagefright.so@0xbafa5 	
2 		@0x696f9ffe 	
3 	libmmparser.so 	libmmparser.so@0x91afe 	
...	
18 	libstagefright.so 	libstagefright.so@0x1a9d76 	
19 	linker 	linker@0x6ea7 	
20 	libnspr4.so 	pt_PostNotifies 	nsprpub/pr/src/pthreads/ptsynch.c:106
21 	libnspr4.so 	PR_Unlock 	nsprpub/pr/src/pthreads/ptsynch.c:208
22 	libnspr4.so 	PR_Unlock 	nsprpub/pr/src/pthreads/ptsynch.c:205
23 	libxul.so 	nsThread::GetObserver 	Mutex.h:83
24 	libxul.so 	nsThread::PutEvent 	nsCOMPtr.h:449
25 	libxul.so 	NS_DispatchToMainThread_P 	xpcom/glue/nsCOMPtr.h:410
26 	libnspr4.so 	PR_ExitMonitor 	nsprpub/pr/src/pthreads/ptsynch.c:557
27 	libxul.so 	mozilla::ReentrantMonitorAutoEnter::~ReentrantMonitorAutoEnter 	ReentrantMonitor.h:80
28 		@0x927a3ccf 	
29 	libomxplugin.so 	OmxPlugin::OmxDecoder::Init 	media/omx-plugin/OmxPlugin.cpp:357
30 	libomxplugin.so 	OmxPlugin::CreateDecoder 	media/omx-plugin/OmxPlugin.cpp:983
31 	libxul.so 	mozilla::MediaPluginHost::CreateDecoder 	content/media/plugins/MediaPluginHost.cpp:267
32 	libxul.so 	mozilla::MediaPluginReader::ReadMetadata 	content/media/plugins/MediaPluginReader.cpp:50
33 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeMetadata 	content/media/MediaDecoderStateMachine.cpp:1776
34 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeThreadRun 	content/media/MediaDecoderStateMachine.cpp:477
35 	libxul.so 	nsRunnableMethodImpl<tag_nsresult 	
36 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
37 	libxul.so 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
38 	libxul.so 	nsThread::ThreadFunc 	xpcom/threads/nsThread.cpp:265
39 	libnspr4.so 	_pt_root 	nsprpub/pr/src/pthreads/ptthread.c:156
40 	libc.so 	libc.so@0x12ef2 	
41 	libc.so 	libc.so@0x1264a

More reports at:
https://crash-stats.mozilla.com/query/query?product=FennecAndroid&query_search=signature&query_type=contains&query=libcutils.so%400x5&do_query=1

Comment 1

[Scoobidiver (away)]

It spikes across all channels so maybe it's caused by an OS upgrade on those Sony devices.

Comment 2

[cajbir (:cajbir)]

I'm curious if the fix for the Xperia Ion in bug 817478 would work for these devices. Does anyone have one of these that reproduces the crash that can test a fix if I provide a patch?

Comment 3

[Scoobidiver (away)]

With combined signatures, it's #8 top crasher in 19.0 and #16 in 20.0b1.

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

Mobile QA is at the FxA team week we don't have this device with us. I don't think we have any JB Xperia devices in MV or Toronto.

Comment 5

[bhavana bajaj [:bajaj]]

(In reply to Chris Double (:doublec) from comment #2)
> I'm curious if the fix for the Xperia Ion in bug 817478 would work for these
> devices. Does anyone have one of these that reproduces the crash that can
> test a fix if I provide a patch?

Chris considering comment# 4,can we try a low risk speculative fix on nightly/aurora and check crash-stats to see if it helped ? If that works,without any fallouts we can think about uplift in beta before 3/12 which would be our last opportunity to land any speculative fixes .

Comment 6

[Alex Keybl [:akeybl]]

(In reply to Kevin Brosnan [:kbrosnan] from comment #4)
> Mobile QA is at the FxA team week we don't have this device with us. I don't
> think we have any JB Xperia devices in MV or Toronto.

What's the ETA for ordering an applicable device?

Comment 7

[Kevin Brosnan [Ex-Mozilla]]

I put an order in. Now in Desktop's hands.  REQ0014051

Comment 8

[Kevin Brosnan [Ex-Mozilla]]

Trivial to crash using a Sony Xperia Z.

* Load https://hacks.mozilla.org/2012/11/h264-video-in-firefox-for-android/
* Click the "Big Buck Bunny" video link
* Crash

bp-db20eff1-cde7-44f3-8c73-0a3232130313

Comment 9

[cajbir (:cajbir)]

(In reply to Kevin Brosnan [:kbrosnan] from comment #8)
> Trivial to crash using a Sony Xperia Z.

Are you able to do builds? If I provide a temporary patch for you to try that forces use of our 'sony ICS workaround' are you able to test it?

Comment 10

[cajbir (:cajbir)]

Attachment: Possible fix

This enables our ICS Sony workaround on Jellybean as well. It also adds the device id's for those listed in the original comment. kbrosnan, does this fix the crash for you?

Comment 11

[cajbir (:cajbir)]

Attachment: Possible fix

Rather than listing the actual device numbers this patch checks for "Sony Ericsson" as the manufacturer.

Comment 12

[Kevin Brosnan [Ex-Mozilla]]

Pushed to try as https://tbpl.mozilla.org/?tree=Try&rev=7a6614131761 will check back when that build is done.

Comment 13

[Kevin Brosnan [Ex-Mozilla]]

Still crashes with the try build. Though Sony bought out Ericsson several months ago. I wonder if the manufacturer string changed. Where can I query that.

Comment 14

[Kevin Brosnan [Ex-Mozilla]]

Yep. Answered my own question by visiting about:support. The graphics info shows that the Manufacturer is Sony.

Comment 15

[Kevin Brosnan [Ex-Mozilla]]

Changed the match to be 'Sony' and pushed that to try https://tbpl.mozilla.org/?tree=Try&rev=11674192352c will check on this in the morning Pacific.

Comment 16

[Kevin Brosnan [Ex-Mozilla]]

Negative. The build from comment 15 still crashes.

Comment 17

[cajbir (:cajbir)]

(In reply to Kevin Brosnan [:kbrosnan] from comment #16)
> Negative. The build from comment 15 still crashes.

Ok, I'll need a device to go further. Can you send me exact details on the device you're using the duplicate the crash? Model number, manufacturer, OS version, etc.

Comment 18

[Kevin Brosnan]

Create a Desktop ticket referencing REQ0014051 I received a C6603 / Sony Xperia Z

Comment 19

[Lukas Blakk [:lsblakk] use ?needinfo]

At this point in beta 20 we'll have to wontfix this and hope investigation provides a possible fix for FF21.

Comment 20

[Scoobidiver (away)]

Sony ST26i is also affected with another signature.

Comment 21

[cajbir (:cajbir)]

I've reaqested a Sony Xperia Z for testing.

Comment 22

[cajbir (:cajbir)]

I have a Sony Xperia Z for testing now.

Comment 23

[Scoobidiver (away)]

(In reply to Scoobidiver from comment #3)
> With combined signatures, it's #8 top crasher in 19.0 and #16 in 20.0b1.
It's now even higher: #2 top crasher in 20.0 with 5.5% of all crashes.

Comment 24

[bhavana bajaj [:bajaj]]

Chris, any new interesting findings on the investigation you have been helping with ?

Given comment #23, it will be great to find a fix for this in FX21 timeframe than release with a known reproducible top-crasher .

Comment 25

[cajbir (:cajbir)]

(In reply to bhavana bajaj [:bajaj] from comment #24)
> Chris, any new interesting findings on the investigation you have been
> helping with ?

I've been unable to find the issue. We're currently working on a different approach to solve the crashing problems across devices.

Comment 26

[cajbir (:cajbir)]

Bug 860599 will fix this but in the meantime we'll blocklist.

Comment 27

[cajbir (:cajbir)]

Attachment: Blocklist sony JB devices

Comment 28

[Scoobidiver (away)]

I've updated https://wiki.mozilla.org/Blocklisting/Blocked_Graphics_Drivers#On_Android_2 accordingly.

Comment 29

[cajbir (:cajbir)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c671215206cb

Comment 30

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/c671215206cb

Comment 31

[Aaron Train [:aaronmt]]

Since Chris has the device, I trust that this is block-listed and fine on mozilla-central. Chris, please verify this bug.

Comment 32

[Benoit Jacob [:bjacob] (mostly away)]

http://hg.mozilla.org/releases/mozilla-aurora/rev/a8380a577645
http://hg.mozilla.org/releases/mozilla-beta/rev/352a49f9dcc5

Comment 33

[Scoobidiver (away)]

It still happens in 21.0b4 at the same crash rate.

If the *else if* use right?
      if (CompareVersions(mOSVersion.get(), "2.2.0") >= 0 &&
          CompareVersions(mOSVersion.get(), "2.3.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "2.3.0") >= 0 &&
          CompareVersions(mOSVersion.get(), "2.4.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "3.0.0") >= 0 &&
          CompareVersions(mOSVersion.get(), "4.0.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "4.0.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "4.1.0") < 0)
      else if (CompareVersions(mOSVersion.get(), "4.2.0") < 0)

Comment 34

[cajbir (:cajbir)]

(In reply to Scoobidiver from comment #33)
> It still happens in 21.0b4 at the same crash rate.

Can you link to a crash report? Maybe some devices are reporting a slightly different manufacturer.

Comment 35

[Scoobidiver (away)]

(In reply to Chris Double (:doublec) from comment #34)
> Can you link to a crash report? Maybe some devices are reporting a slightly
> different manufacturer.
See https://crash-stats.mozilla.com/query/query?product=FennecAndroid&version=FennecAndroid%3A21.0b4&query_search=signature&query_type=contains&query=libcutils.so%400x50&do_query=1
The manufacturer is still Sony and not Sony Ericsson.

Comment 36

[bhavana bajaj [:bajaj]]

:kbrosnan, has a device in and will be able to check the first thing Monday morning.
CCing :tchung here to see if he can help before that.

:Chris,
Based on comment# 35 looks like our blocklist didn't work as expected. Were you able to verify the patch on your device if it was blocklisted? Do we have a problem only with a few devices ?

Comment 37

[Scoobidiver (away)]

(In reply to Benoit Jacob [:bjacob] from comment #32)
> http://hg.mozilla.org/releases/mozilla-beta/rev/352a49f9dcc5
It's the culprit. It's not in the right else if. Compare http://mxr.mozilla.org/mozilla-beta/source/widget/android/GfxInfo.cpp#451 and http://mxr.mozilla.org/mozilla-central/source/widget/android/GfxInfo.cpp#454.

Comment 38

[cajbir (:cajbir)]

Attachment: Fix for mozilla beta

Comment 39

[cajbir (:cajbir)]

Comment on attachment 742929 [details] [diff] [review]
Fix for mozilla beta

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Enabling of stagefright decoding on gingerbread
User impact if declined: Some gingerbread devices will crash when videos are played
Testing completed (on m-c, etc.): Unable to test due to not having devices
Risk to taking this patch (and alternatives if risky): Devices that might not have crashed will not play video
String or IDL/UUID changes made by this patch: None

Comment 40

[bhavana bajaj [:bajaj]]

Comment on attachment 742929 [details] [diff] [review]
Fix for mozilla beta

Patch only needed on beta as it had a typo.Aurora/central works as expected.

Comment 41

[bhavana bajaj [:bajaj]]

Requesting QA verification on this bug once this lands.

Comment 42

[cajbir (:cajbir)]

https://hg.mozilla.org/releases/mozilla-beta/rev/2d7b923c53cb

Comment 43

[Kevin Brosnan [Ex-Mozilla]]

Tested this on trunk no crash on Video for Everyone. Release still crashes. Sony Xperia S.

Comment 44

[cajbir (:cajbir)]

Attachment: Remove blocklist

Removes blocklist for when bug 860599 lands. That bug fixes the underlying issue.

Comment 45

[cajbir (:cajbir)]

Attachment: Remove blocklist

Comment 46

[cajbir (:cajbir)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/010cd70691da

Comment 47

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/010cd70691da

Comment 49

[Brad Lassey [:blassey] (use needinfo?)]

filter on [mass-p5]

Comment 50

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 51

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 52

[Sylvestre Ledru [:Sylvestre]]

No assignee, updating the status.

Comment 53

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.

Comment 54

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.