870165 - Forecast.io triggers a reboot on the Nexus 4

Status: VERIFIED DUPLICATE of bug 871390

(Core :: Graphics: Canvas2D, defect)

Description

[Aaron Train [:aaronmt]]

Massive ammount of console logging 

W/Adreno200-GSL( 1221): <gsl_ldd_control:226>: ioctl code 0xc0140933 (IOCTL_KGSL_TIMESTAMP_EVENT) failed: errno 22 Invalid argument
W/Adreno200-EGLSUB( 1221): <SwapBuffers:1113>: gsl_add_fence_event failed
W/Adreno200-EGL( 1221): <eglSwapBuffers:3529>: EGL_BAD_SURFACE
E/Gecko   ( 1221): ShmemAndroid::Create():open: Too many open files (24)
E/BufferQueue(  159): [SurfaceView] queueBuffer: crop rect is not contained within the buffer in slot 1
E/SurfaceTextureClient( 1221): queueBuffer: error queuing buffer to SurfaceTexture, -22
W/Adreno200-EGLSUB( 1221): <SwapBuffers:1119>: failed to queueBuffer
W/Adreno200-EGL( 1221): <eglSwapBuffers:3529>: EGL_BAD_SURFACE
E/Gecko   ( 1221): ShmemAndroid::ShareToProcess(): Too many open files (24)
E/Gecko   ( 1221): ShmemAndroid::ShareToProcess(): Too many open files (24)


The device then reboots each and every time I visit http://forecast.io

--
LG Nexus 4 (Android 4.2.2)
Nightly (05/08)

Comment 1

[Aaron Train [:aaronmt]]

Attachment: Raw logcat (Nightly 05/08)

Raw log

Comment 2

[James Willcox (:snorp) ([e-mail]) (he/him)]

I can repro this to some extent. The phone doesn't reboot, I just get a fennec crash. The first sign of things going bad seems to be:

E/SurfaceTextureClient( 5365): dequeueBuffer: error duping fence: 24

'24' is the value of errno, which corresponds to "too many files open". Using lsof, I could see that we have about 1000 fds open to /dev/ashmem. It would seem whatever is causing that is causing this crash.

Comment 3

[James Willcox (:snorp) ([e-mail]) (he/him)]

It looks like the main place we use ashmem is IPC for shared memory. So something is either causing us to create a bunch of these, or we are leaking them.

Comment 4

[James Willcox (:snorp) ([e-mail]) (he/him)]

So the animation next to the temperature is a <canvas>. It looks like we create a shared memory region on each frame that never gets freed.

#0  mozilla::ipc::SharedMemoryBasic::Create (this=0x76d49d40, aNbytes=28672)
    at /Users/snorp/source/mozilla-central/ipc/glue/SharedMemoryBasic_android.cpp:60
#1  0x78da32fc in mozilla::ipc::CreateSegment (aNBytes=28672, aHandle=...) at /Users/snorp/source/mozilla-central/ipc/glue/Shmem.cpp:147
#2  0x78da34a6 in mozilla::ipc::Shmem::Alloc (aNBytes=26908, aType=mozilla::ipc::SharedMemory::TYPE_BASIC)
    at /Users/snorp/source/mozilla-central/ipc/glue/Shmem.cpp:497
#3  0x78e1f56a in mozilla::layers::PCompositorChild::CreateSharedMemory (this=0x773a1a40, aSize=<optimized out>, aType=<optimized out>, 
    aUnsafe=<optimized out>, aId=0x74cabc0c) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PCompositorChild.cpp:448
#4  0x78da4222 in mozilla::dom::PExternalHelperAppParent::CreateSharedMemory (this=<optimized out>, aSize=<optimized out>, aType=<optimized out>, 
    aUnsafe=<optimized out>, aId=0x74cabc0c) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PExternalHelperAppParent.cpp:155
#5  0x78da9fe2 in mozilla::dom::indexedDB::PIndexedDBIndexParent::AllocUnsafeShmem (this=<optimized out>, aSize=<optimized out>, 
    aType=<optimized out>, aMem=0x74cabc38) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PIndexedDBIndexParent.cpp:433
#6  0x79023cb4 in gfxBaseSharedMemorySurface<gfxImageSurface, gfxSharedImageSurface>::Create<mozilla::layers::ISurfaceAllocator, true> (
    aAllocator=0x782c4118, aSize=..., aFormat=gfxASurface::ImageFormatARGB32, aShmType=mozilla::ipc::SharedMemory::TYPE_BASIC)
    at ../../dist/include/gfxBaseSharedMemorySurface.h:151
#7  0x79023d6e in CreateUnsafe<mozilla::layers::ISurfaceAllocator> (aShmType=mozilla::ipc::SharedMemory::TYPE_BASIC, aFormat=<optimized out>, 
    aSize=..., aAllocator=0x782c4118) at ../../dist/include/gfxBaseSharedMemorySurface.h:95
#8  mozilla::layers::ISurfaceAllocator::AllocSharedImageSurface (this=0x782c4118, aSize=..., aContent=gfxASurface::CONTENT_COLOR_ALPHA, 
    aBuffer=0x74cabc8c) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:56
#9  0x79023b46 in AllocSurfaceDescriptorWithCaps (aBuffer=0x741033cc, aContent=gfxASurface::CONTENT_COLOR_ALPHA, aSize=..., this=0x782c4118, 
    aCaps=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:90
#10 mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptorWithCaps (this=0x782c4118, aSize=..., aContent=gfxASurface::CONTENT_COLOR_ALPHA, 
    aCaps=<optimized out>, aBuffer=0x741033cc) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:74
#11 0x79023af4 in mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptor (this=<optimized out>, aSize=<optimized out>, 
    aContent=<optimized out>, aBuffer=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:70
#12 0x79023efe in mozilla::layers::TextureClientShmem::EnsureAllocated (this=0x741033c0, aSize=..., aContentType=gfxASurface::CONTENT_COLOR_ALPHA)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/TextureClient.cpp:80
#13 0x79017e2e in mozilla::layers::CanvasClient2D::Update (this=0x76d498e0, aSize=..., aLayer=0x79e9d8b0)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/CanvasClient.cpp:63
#14 0x79001046 in mozilla::layers::ClientCanvasLayer::RenderLayer (this=0x79e9d8b0)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientCanvasLayer.cpp:85
#15 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#16 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#17 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#18 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#19 0x79001c6a in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0x782c40c0, aCallback=<optimized out>, 
    aCallbackData=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:175
#20 0x790021c8 in mozilla::layers::ClientLayerManager::EndTransaction (this=0x782c40c0, aCallback=
    0x787f541d <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x74cac2d0, aFlags=mozilla::layers::LayerManager::END_NO_COMPOSITE)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:198
#21 0x78813286 in nsDisplayList::PaintForFrame (this=0x74cac224, aBuilder=0x74cac2d0, aCtx=<optimized out>, aForFrame=<optimized out>, aFlags=13)
    at /Users/snorp/source/mozilla-central/layout/base/nsDisplayList.cpp:1197
#22 0x788133dc in nsDisplayList::PaintRoot (this=0x74cac224, aBuilder=0x74cac2d0, aCtx=0x0, aFlags=13)
    at /Users/snorp/source/mozilla-central/layout/base/nsDisplayList.cpp:1058
#23 0x78822b02 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0x77b9d298, aDirtyRegion=<optimized out>, aBackstop=0, aFlags=772)
    at /Users/snorp/source/mozilla-central/layout/base/nsLayoutUtils.cpp:2092
#24 0x7882ece6 in PresShell::Paint (this=0x7727eda0, aViewToPaint=0x782c7bf0, aDirtyRegion=..., aFlags=1)
    at /Users/snorp/source/mozilla-central/layout/base/nsPresShell.cpp:5577
#25 0x78a6a21e in ProcessPendingUpdatesForView (aView=0x782c7bf0, this=0x782f6d00, aFlushDirtyRegion=<optimized out>)
    at /Users/snorp/source/mozilla-central/view/src/nsViewManager.cpp:396

Comment 5

[James Willcox (:snorp) ([e-mail]) (he/him)]

I'm relatively certain this is fallout from the layers refactor at this point. -> gfx

Comment 6

[James Willcox (:snorp) ([e-mail]) (he/him)]

Alright, so TextureClientShmem::ReleaseResources falls through all of the conditions. It seems that something is clobbering TextureClientShmem::mDescriptor such that we have a null mDescriptor in ReleaseResources.

Comment 7

[James Willcox (:snorp) ([e-mail]) (he/him)]

ShadowLayerForwarder::UpdateTexture() is where the problem lies:

*aDescriptor = SurfaceDescriptor();

This resets mDescriptor in TextureClientShmem which is why TextureClientShmem::ReleaseResources() can't do it's job.

Comment 8

[James Willcox (:snorp) ([e-mail]) (he/him)]

Attachment: Don't reset SurfaceDescriptor when updating texture for CanvasClient2D

This also corrects a booboo I saw from my patch for bug 863223. I'll split that out.

Comment 10

[(not currently active) Ted Mielczarek]

For bonus points, this screws up Breakpad causing it to write empty minidumps:
https://crash-stats.mozilla.com/report/index/bp-ef5de0a3-1b4b-46dd-823f-8bed92130508
https://crash-stats.mozilla.com/report/index/bp-9d9e4c44-74df-4339-95db-89c652130509

Comment 11

[Aaron Train [:aaronmt]]

Another test-case; just load: http://people.mozilla.com/~wlachance/clock.html

Comment 12

[William Lachance (:wlach)]

(In reply to Aaron Train [:aaronmt] from comment #11)
> Another test-case; just load: http://people.mozilla.com/~wlachance/clock.html

This test case crashes immediately with the patch applied (whereas before it would work for a bit before crashing).

Comment 14

[Aaron Train [:aaronmt]]

Fixed via bug 871390