Closed Bug 854095 Opened 11 years ago Closed 8 years ago

crash in mozilla::layers::LayerManagerOGL::BindAndDrawQuadWithTextureRect @ libpvrANDROID_WSEGL_SGX540_120 on ICS and above

Categories

(Core :: Graphics: Layers, defect)

ARM
Android
defect
Not set
critical

Tracking

()

RESOLVED FIXED
mozilla49
Tracking Status
firefox19 --- wontfix
firefox20 --- wontfix
firefox21 --- wontfix
firefox22 --- wontfix
firefox23 --- wontfix
firefox24 --- wontfix
firefox31 --- wontfix
firefox32 --- wontfix
firefox33 --- wontfix
firefox34 --- wontfix
firefox45 --- wontfix
firefox46 + wontfix
firefox47 - wontfix
firefox48 --- fixed
firefox49 --- fixed
fennec + ---

People

(Reporter: scoobidiver, Assigned: eflores)

References

Details

(Keywords: crash, topcrash-android-armv7, Whiteboard: [native-crash])

Crash Data

Attachments

(2 files, 1 obsolete file)

With combined signatures, it's #65 crasher in 19.0.2 and #32 in 20.0b5.

The affected devices are:
* libpvrANDROID_WSEGL_SGX540_120.so@0xb0c 	64
Samsung GT-P5113 	21
Samsung GT-P5110 	17
Samsung GT-P3113 	10
Samsung GT-P5100 	6
Samsung GT-P3110 	4
Samsung GT-P3100 	4
Samsung GT-I9100G 	1
Motorola DROID RAZR 	1
* libpvrANDROID_WSEGL_SGX540_120.so@0x1490 	3
Motorola MB865 	1
Motorola DROID RAZR 	1
MOTO XT910 	1

Signature 	libpvrANDROID_WSEGL_SGX540_120.so@0xb0c More Reports Search
UUID	d37808cc-32b1-4d78-82b9-596702130323
Date Processed	2013-03-23 12:19:28
Uptime	3933
Install Age	5.6 days since version was first installed.
Install Time	2013-03-17 20:50:45
Product	FennecAndroid
Version	19.0.2
Build ID	20130307022932
Release Channel	release
OS	Android
OS Version	0.0.0 Linux 3.0.31-523998 #1 SMP PREEMPT Thu Nov 29 14:35:14 KST 2012 armv7l samsung/espresso10wifibby/espresso10wifi:4.1.1/JRO03C/P5113UECLK7:user/release-keys
Build Architecture	arm
Build Architecture Info	
Crash Reason	SIGSEGV
Crash Address	0x0
App Notes 	
AdapterDescription: 'Imagination Technologies -- PowerVR SGX 540 -- OpenGL ES 2.0 build 1.9@2120756 -- Model: GT-P5113, Product: espresso10wifibby, Manufacturer: samsung, Hardware: espresso10'
EGL? EGL+ GL Context? GL Context+ GL Layers? GL Layers+ Stagefright? Stagefright+ 
samsung GT-P5113
samsung/espresso10wifibby/espresso10wifi:4.1.1/JRO03C/P5113UECLK7:user/release-keys
Processor Notes 	sp-processor02.phx1.mozilla.com_11578:2008; exploitablity tool: ERROR: unable to analyze dump
EMCheckCompatibility	True
Adapter Vendor ID	Imagination Technologies
Adapter Device ID	PowerVR SGX 540
Device	samsung GT-P5113
Android API Version	16 (REL)
Android CPU ABI	armeabi-v7a

Frame 	Module 	Signature 	Source
0 	libpvrANDROID_WSEGL_SGX540_120.so 	libpvrANDROID_WSEGL_SGX540_120.so@0xb0c 	
1 	libIMGegl_SGX540_120.so 	libIMGegl_SGX540_120.so@0x10012 	
2 	libIMGegl_SGX540_120.so 	libIMGegl_SGX540_120.so@0x2fca 	
3 	libIMGegl_SGX540_120.so 	libIMGegl_SGX540_120.so@0x2e62 	
4 	libEGL.so 	libEGL.so@0xc785 	
5 	libEGL.so 	libEGL.so@0x22106 	
6 	libgui.so 	libgui.so@0x1fb65 	
7 	libgui.so 	libgui.so@0x20029 	
8 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0x3cae 	
9 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0xb1486 	
10 	libdvm.so 	libdvm.so@0x48f27 	
11 	libandroid_runtime.so 	libandroid_runtime.so@0x7269f 	
12 	dalvik-LinearAlloc (deleted) 	dalvik-LinearAlloc @0xb17ae 	
13 	libdvm.so 	libdvm.so@0x1deb2 	
14 	dalvik-heap (deleted) 	dalvik-heap @0x9b690e 	
15 	libdvm.so 	libdvm.so@0x4d105 	
16 	framework.odex 	framework.odex@0x5c19d7 	
17 	libandroid_runtime.so 	libandroid_runtime.so@0x7268b 	
18 	libandroid_runtime.so 	libandroid_runtime.so@0x72601 	
19 	libGLESv2_POWERVR_SGX540_120.so 	libGLESv2_POWERVR_SGX540_120.so@0xdd26 	
20 	libGLESv2.so 	libGLESv2.so@0x3d4a 	
21 	libxul.so 	mozilla::layers::LayerManagerOGL::BindAndDrawQuadWithTextureRect 	nsTArray.h:442 

More reports at:
https://crash-stats.mozilla.com/query/query?product=FennecAndroid&query_search=signature&query_type=contains&query=libpvrANDROID_WSEGL_SGX540_120.so&do_query=1
Version: 19 Branch → 21 Branch
It's #33 crasher in 21.0, #12 in 22.0b4, and #20 in 23.0a2.
Version: 21 Branch → Trunk
Crash Signature: [@ libpvrANDROID_WSEGL_SGX540_120.so@0xb0c ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0x1490 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0xfc0 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0xfac ] → [@ libpvrANDROID_WSEGL_SGX540_120.so@0xb14 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0xb0c ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0xb84 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0xfc0 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0x1490 ] [@ libpvrANDROID_WSEGL_S…
Reproduced this crash with a slightly different signature[@ libpvrANDROID_WSEGL.so@0x14e8 ]
Device:
Samsung Galaxy Nexus(Android 4.2.1)
Build:
Nightly 34.0a1 (2014-08-31)

STR:
1. Open http://bit.ly/1qvzlYE (google ad, or a site that has google ads)
2. Tap on URL bar and write something (Firefox crashes)

More reports:
https://crash-stats.mozilla.com/query/?product=FennecAndroid&version=ALL%3AALL&range_value=4&range_unit=weeks&date=09%2F01%2F2014+13%3A00%3A00&query_search=signature&query_type=contains&query=libpvrANDROID_WSEGL&reason=&release_channels=&build_id=&process_type=any&hang_type=any

Crash logs:
https://pastebin.mozilla.org/6265787
Crash Signature: libpvrANDROID_WSEGL_SGX540_120.so@0x3026 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0x706 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0x864 ] → libpvrANDROID_WSEGL_SGX540_120.so@0x3026 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0x706 ] [@ libpvrANDROID_WSEGL_SGX540_120.so@0x864 ] [@ libpvrANDROID_WSEGL.so@0x14e8 ]
This is #11 on beta right now.
tracking-fennec: --- → ?
This appears to be happening on Samsung Espresso tablets these days. Milan, can Jamie take a look? Might be similar to bug 1194923?
tracking-fennec: ? → +
Flags: needinfo?(milan)
:snorp, can you reproduce it, and Jamie, do you have access to this device?
Flags: needinfo?(milan) → needinfo?(jnicol)
I'm charging my Galaxy Nexus to try it.
I don't have a galaxy nexus or a samsung espresso tablet.

I do have a Nexus S which also has a SGX540, but unfortunately I cannot reproduce using the steps in comment 2. (This is with stock android 4.1.2).

Should we order a device? Do we have any other STR?
Flags: needinfo?(jnicol)
Tested on Google Nexus with Android 4.2.1 and, using the steps from comment #2, I can't reproduce the crash.
This device has a SGX540 GPU.
Keywords: steps-wanted
[Tracking Requested - why for this release]:
This is a topcrash in Fennec.

Fennec 45: 11357 crashes reported in the last week (#7 overall @ 2.14%)
Fennec 46:   290 crashes reported in the last week (#4 overall @ 4.09%)
Fennec 47:     0 crashes reported in the last week
Fennec 48:     0 crashes reported in the last week

Top Devices:
65% espresso10wifi Samsung Galaxy Tab 2 10.1 [GT-P5110, GT-P5100]
32%   espressowifi Samsung Galaxy Tab 2 7.0  [GT-P3110, GT-P3113, GT-P3100]

Top Android Versions:
71% Jellybean 4.2.* (API Level 17)
29% Jellybean 4.1.* (API Level 16)
James, are you any closer to reproducing this?
Flags: needinfo?(snorp)
Did this start in any particular version of Firefox?
It was reported against Firefox 19 which is 2 releases from 17 the first tablet supported release. 

This crash requires specific hardware. The active signatures can be found at https://crash-stats.mozilla.com/search/?product=FennecAndroid&signature=%5ElibpvrANDROID_WSEGL_SGX540_120.so&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

libpvrANDROID_WSEGL_SGX540_120.so@0xb14 top 5 devices
Mfgr      Model    Andr API  CPU ABI       #  
samsung  GT-P5110  17 (REL)  armeabi-v7a  3776  38.4% [Galaxy Tab 2 10.1 WiFi]
samsung  GT-P5100  17 (REL)  armeabi-v7a  2176  22.1% [Galaxy Tab 2 10.1 SIM]
samsung  GT-P5113  17 (REL)  armeabi-v7a  1549  15.7%
samsung  GT-P3113  17 (REL)  armeabi-v7a  1013  10.3%
samsung  GT-P3100  17 (REL)  armeabi-v7a   688   7.0%

libpvrANDROID_WSEGL_SGX540_120.so@0xb0c top 5 devices
Mfgr      Model    Andr API    CPU ABI     #  
samsung  GT-P3110  16 (REL)  armeabi-v7a  1083  27.4% [Galaxy Tab 7.0 WiFi]
samsung  GT-P3100  16 (REL)  armeabi-v7a   980  24.8% [Galaxy Tab 7.0 SIM]
samsung  GT-P5110  16 (REL)  armeabi-v7a   954  24.2%
samsung  GT-P5100  16 (REL)  armeabi-v7a   650  16.5%
samsung  GT-P3113  16 (REL)  armeabi-v7a    48   1.2%
I think our best chance for this crash is if we can get our hands on a Galaxy Tab 2 10.1 WiFi. Neither Roland or I have one in the Vancouver office, nor does the anyone else on the GFX team according to our inventory wiki. Please let me know if you want me to try to acquire one through Service Now or by other means.
I can pick this up. Could you have a device sent to the London office?
Flags: needinfo?(anthony.s.hughes)
(In reply to Edwin Flores [:eflores] [:edwin] from comment #14)
> I can pick this up. Could you have a device sent to the London office?

I think you should be able to request a device through Service Now - assuming you can still purchase one. If not you may need to see if you can find one second hand (ebay, etc.). My recommendation would be to coordinate with Milan outside of this bug report.
Flags: needinfo?(anthony.s.hughes)
I can track this top crash for 46 in case we figure out a fix, but it seems unlikely to get fixed in that timeframe. Tracking for 47 too since it is affected.

Edwin, are you taking on this bug?
Flags: needinfo?(edwin)
Filed service-now RITM0044371 for device.
Assignee: nobody → edwin
Flags: needinfo?(edwin)
(In reply to Edwin Flores [:eflores] [:edwin] from comment #17)
> Filed service-now RITM0044371 for device.

Can't figure out how to check the status in service-now :)  Edwin, did we get this device?
Flags: needinfo?(edwin)
On its way via Amazon. Should be here next week.
Flags: needinfo?(edwin)
[Tracking Requested - why for this release]: We're still waiting for the device, I don't see us coming up with a fix that we'd want to uplift to beta.  I'd suggest wontfix for 47.
Attached patch 854095.patch (obsolete) — Splinter Review
Looks like media dormant mode was disabled by accident in bug 1178437, patch 5. This patch simply makes sure MP4_READER_DORMANT_HEURISTIC is defined on Android.

I'm not sure why the #if is there at all since it seems to cover all major platforms. An alternative patch would just rip out all the MP4_READER_DORMANT_HEURISTIC stuff altogether, especially since we have a pref to control this behaviour.
Flags: needinfo?(snorp)
Attachment #8758339 - Flags: review?(jyavenard)
Remove some unused code.
Attachment #8758343 - Flags: review?(jyavenard)
We might still see a few crashes after this patch lands, but nowhere near as many. The other piece of the puzzle is bug 1214710, which will limit the number of decoders in use at any one time.
Comment on attachment 8758339 [details] [diff] [review]
854095.patch

Review of attachment 8758339 [details] [diff] [review]:
-----------------------------------------------------------------

IIRC, dormant was never enabled on Android; at first only on B2G and Windows. Bug 1178437 didn't change that.

Now that it's enabled on Android, that means it's now available on all platforms, so #if defined(MOZ_GONK_MEDIACODEC) || defined(XP_WIN) || defined(MOZ_APPLEMEDIA) || defined(MOZ_FFMPEG) || defined(MOZ_WIDGET_ANDROID) is always true.

So, yes, I would prefer your alternative "an alternative patch would just rip out all the MP4_READER_DORMANT_HEURISTIC stuff altogether, especially since we have a pref to control this behaviour."

there's no use for MP4_READER_DORMANT_HEURISTIC anymore.
Attachment #8758339 - Flags: review?(jyavenard)
Attachment #8758343 - Flags: review?(jyavenard) → review+
This is likely similar to bug 1214710, and the solution there would be nicer than dormant IMHO.
See Also: → 1214710
Attached patch 854095v2.patchSplinter Review
Approval Request Comment
[Feature/regressing bug #]: MP4 playback on Android
[User impact if declined]: Crashes playing MP4 content
[Describe test coverage new/current, TreeHerder]: None
[Risks and why]: Low risk of breaking MP4 playback.
[String/UUID change made/needed]: None
Attachment #8758339 - Attachment is obsolete: true
Attachment #8758538 - Flags: review?(jyavenard)
Attachment #8758538 - Flags: approval-mozilla-aurora?
Attachment #8758538 - Flags: review?(jyavenard) → review+
(In reply to Jean-Yves Avenard [:jya] from comment #26)
> This is likely similar to bug 1214710, and the solution there would be nicer
> than dormant IMHO.

I'm aware of that bug (comment 24) and they're complementary, really. That patch makes sure that we can limit the number of decoders, while enabling dormancy makes sure that we're not tying up any decoders unnecessarily.

I agree that this isn't properly fixed without that, but it buys us time while that's in review (and is nicer to uplift) and makes seemingly random playback failures less likely once that does land.
Pushed by cbook@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6a3f6d522c49
Remove an unused member from MediaFormatReader - r=jya
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/6a3f6d522c49
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla49
Comment on attachment 8758538 [details] [diff] [review]
854095v2.patch

Fix a crash, taking it!
Attachment #8758538 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
just realized the v2 patch had a wrong bug number in the commit, so the commit message landed in the wrong bug - but its here - https://hg.mozilla.org/mozilla-central/rev/2233ba87144b
Volume looks to be down on beta but still happening, as expected. The remainder should be wiped out by bug 1214710.

Removing steps-wanted keyword because this bug has been resolved.

Keywords: steps-wanted
You need to log in before you can comment on or make changes to this bug.