847837 - crash in mozilla::MediaPluginHost::CreateDecoder @ libstagefright.so@0x7... on Samsung Galaxy S Advance, Ace 2 and Beam with samsung hw, Galaxy Mini 2 and Ace Plus with qcom hw running Gingerbread

Status: RESOLVED INCOMPLETE

(Core :: Audio/Video: Playback, defect)

Description

[Scoobidiver (away)]

It first showed up in 21.0a2/20130224 and 22.0a1/20130223. It's discontinuous across builds but is likely a regression from bug 823253 that allows StageFright decoding on Samsung devices running Gingerbread.

Hardware is samsung so I don't know it's enough accurate to use it to add again the blocklist.

Signature 	@0x0 | libstagefright.so@0x7c49b More Reports Search
UUID	75e9f675-ea74-4f02-8c4d-d83342130226
Date Processed	2013-02-26 17:06:45
Uptime	185
Last Crash	3.6 hours before submission
Install Age	3.9 hours since version was first installed.
Install Time	2013-02-26 13:14:55
Product	FennecAndroid
Version	22.0a1
Build ID	20130225031141
Release Channel	nightly
OS	Android
OS Version	0.0.0 Linux 2.6.35.7-I8160XXLD8-CL1100997 #2 SMP PREEMPT Tue Apr 24 05:35:29 KST 2012 armv7l samsung/GT-I8160/GT-I8160:2.3.6/GINGERBREAD/XXLK6:user/release-keys
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
AdapterDescription: 'ARM -- Mali-400 MP -- OpenGL ES 2.0 -- Model: GT-I8160, Product: GT-I8160, Manufacturer: samsung, Hardware: samsung'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ Stagefright? Stagefright+ 
samsung GT-I8160
samsung/GT-I8160/GT-I8160:2.3.6/GINGERBREAD/XXLK6:user/release-keys
Processor Notes 	sp-processor02.phx1.mozilla.com_29270:2008; exploitablity tool: ERROR: unable to analyze dump
EMCheckCompatibility	True
Adapter Vendor ID	ARM
Adapter Device ID	Mali-400 MP
Device	samsung GT-I8160
Android API Version	10 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 		@0x0 	
1 	libutils.so 	libutils.so@0x28ee2 	
2 	libstagefright.so 	libstagefright.so@0x7c49b 	
3 	libstagefright.so 	libstagefright.so@0x1941b6 	
4 	libstagefright.so 	libstagefright.so@0x5b363 	
5 	libstagefright.so 	libstagefright.so@0x19ab3a 	
6 	libutils.so 	libutils.so@0x28ee2 	
7 	libstagefright.so 	libstagefright.so@0x1941b6 	
8 	libstagefright.so 	libstagefright.so@0x68b93 	
9 	libomxplugingb.so 	OmxPlugin::OmxDecoder::Init 	OmxPlugin.cpp:362
10 	libomxplugingb.so 	OmxPlugin::CreateDecoder 	OmxPlugin.cpp:988
11 	libxul.so 	mozilla::MediaPluginHost::CreateDecoder 	content/media/plugins/MediaPluginHost.cpp:267
12 	libxul.so 	mozilla::MediaPluginReader::ReadMetadata 	content/media/plugins/MediaPluginReader.cpp:50
13 	libnspr4.so 	PR_Unlock 	ptsynch.c:205
14 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeMetadata 	content/media/MediaDecoderStateMachine.cpp:1810
15 	libnspr4.so 	PR_SetCurrentThreadName 	ptthread.c:1656
16 	libxul.so 	mozilla::MediaDecoderStateMachine::DecodeThreadRun 	content/media/MediaDecoderStateMachine.cpp:481
17 	libxul.so 	nsRunnableMethodImpl<tag_nsresult 	nsThreadUtils.h:367
18 	libxul.so 	nsRunnableMethodImpl<tag_nsresult 	
19 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:627
20 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:238
21 	libxul.so 	nsThread::ThreadFunc 	nsThread.cpp:265
22 	libnspr4.so 	pt_AttachThread 	ptthread.c:238
23 	libnspr4.so 	_pt_root 	ptthread.c:156
24 	libnspr4.so 	pt_AttachThread 	ptthread.c:238
25 	libc.so 	libc.so@0x11ee2 	
26 	libc.so 	libc.so@0x11aae 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=%400x0+|+libstagefright.so%400x7c49b

Comment 1

[Scoobidiver (away)]

Samsung Galaxy Beam also have a samsung hardware.

More reports also at:
https://crash-stats.mozilla.com/report/list?signature=%400x0+|+libstagefright.so%400x7c30b

Comment 2

[cajbir (:cajbir)]

I have a Galaxy Ace 2 for testing now. It looks like an issue with the DataSource class layout like in previous crash bugs. The Ace seems to use some mix of Gingerbread and Honeycomb for their stagefright. I'm trying to track down the class layout that it uses.

Comment 3

[Scoobidiver (away)]

With combined signatures, it's #1 top crasher in 21.0b1.

More reports at:
https://crash-stats.mozilla.com/query/query?product=FennecAndroid&query_search=signature&query_type=startswith&query=%400x0+|+libstagefright.so%400x7&do_query=1

Comment 4

[Scoobidiver (away)]

Here are correlations per device for the last day:
* @0x0 | libstagefright.so@0x7c1a3 	58
Samsung GT-I9070 	58
* @0x0 | libstagefright.so@0x7c4bb 	22
Samsung GT-I8160 	22
* @0x0 | libstagefright.so@0x7c2cb 	18
Samsung GT-I9070 	18
* @0x0 | libstagefright.so@0x7c49b 	15
Samsung GT-I8160 	15
* @0x0 | libstagefright.so@0x7c283 	13
Samsung GT-I9070 	13
* @0x0 | libstagefright.so@0x7c363 	8
Samsung GT-I8530 	8
* @0x0 | libstagefright.so@0x7c473 	7
Samsung GT-I8160P 	7
* @0x0 | libstagefright.so@0x7c2a3 	6
Samsung GT-I9070 	6
* @0x0 | libstagefright.so@0x7d287 	4
Samsung GT-S7500L 	4
* @0x0 | libstagefright.so@0x7ccd7 	4
Samsung GT-S6500T 	4
* @0x0 | libstagefright.so@0x7c4d3 	3
Samsung GT-I8160L 	3
* @0x0 | libstagefright.so@0x7c4cb 	3
Samsung GT-I8160 	3
* @0x0 | libstagefright.so@0x7cd47 	3
Samsung GT-S7500 	3
* @0x0 | libstagefright.so@0x7cdaf 	1
Samsung GT-S7500T 	1
* @0x0 | libstagefright.so@0x7c1c3 	1
Samsung GT-I9070P 	1

Comment 5

[Lukas Blakk [:lsblakk] use ?needinfo]

Can we track down what might have changed between FF17 and FF21 to cause this to flare up now?

Comment 6

[Scoobidiver (away)]

(In reply to [e-mail] from comment #5)
> Can we track down what might have changed between FF17 and FF21 to cause
> this to flare up now?
It's bug 823253 which is a consequence of a new feature for Gingerbread.

Comment 7

[bhavana bajaj [:bajaj]]

(In reply to Chris Double (:doublec) from comment #2)
> I have a Galaxy Ace 2 for testing now. It looks like an issue with the
> DataSource class layout like in previous crash bugs. The Ace seems to use
> some mix of Gingerbread and Honeycomb for their stagefright. I'm trying to
> track down the class layout that it uses.

Chris, do we have any work-in-progress patch on this based off , of your investigation? 
This has become #1 top crasher and comment #6 points to bug 823253 to be the cause of the spike.What are our next options going forward ? Would blocklisting these devices be the right way to go?

Comment 8

[cajbir (:cajbir)]

Attachment: Blocklist devices

Blocklist devices while permanent fix is being worked on.

Comment 9

[cajbir (:cajbir)]

Bug 860599 will hopefully be the permanent fix for this crasher.

Comment 10

[Benoit Jacob [:bjacob] (mostly away)]

Comment on attachment 736115 [details] [diff] [review]
Blocklist devices

Review of attachment 736115 [details] [diff] [review]:
-----------------------------------------------------------------

r=me, just a style nit: after a multi-line if() condition, the { should go on a newline.

Comment 11

[cajbir (:cajbir)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3135a6091d4c

Set [leave open] until root cause is resolved.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3135a6091d4c

Comment 13

[Scoobidiver (away)]

Can you uplift the Stagefright blocklist to Beta and Aurora?

Comment 14

[bhavana bajaj [:bajaj]]

Adding QA, to help with blocklist verification on trunk and braches once this lands.

Comment 15

[cajbir (:cajbir)]

(In reply to Scoobidiver from comment #13)
> Can you uplift the Stagefright blocklist to Beta and Aurora?

What do I need to do this? I've not done it before. I looked on MDN but didn't see anything obvious.

Comment 16

[Scoobidiver (away)]

(In reply to Chris Double (:doublec) from comment #15)
> (In reply to Scoobidiver from comment #13)
> > Can you uplift the Stagefright blocklist to Beta and Aurora?
> What do I need to do this?
I meant the patch is to uplift. See https://wiki.mozilla.org/Tree_Rules

Comment 17

[Scoobidiver (away)]

I've updated https://wiki.mozilla.org/Blocklisting/Blocked_Graphics_Drivers#On_Android_2 accordingly.

Comment 18

[Benoit Jacob [:bjacob] (mostly away)]

Many thanks Scoobidiver for updating the documentation.

http://hg.mozilla.org/releases/mozilla-aurora/rev/b435d0606ec0
http://hg.mozilla.org/releases/mozilla-beta/rev/41627ad5cdf0

Comment 19

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Need to continue monitoring and seeing the outcome 
(monitoring from feedback + crash reporting)

Comment 20

[Scoobidiver (away)]

(In reply to Naoki Hirata :nhirata (please use needinfo instead of cc) from comment #19)
> Need to continue monitoring and seeing the outcome 
I see no crashes after 21.0b3 except one signature, @0x0 | libstagefright.so@0x7ccd7, related to samsung GT-S6500 running Gingerbread that still happens in 21.0b4 but was fixed in 21.0b6 by bug 864734.

Comment 21

[u597032]

Gingerbread is no longer supported.