Forecast.io triggers a reboot on the Nexus 4

VERIFIED DUPLICATE of bug 871390

Status

()

Core
Canvas: 2D
--
critical
VERIFIED DUPLICATE of bug 871390
5 years ago
4 years ago

People

(Reporter: aaronmt, Assigned: snorp)

Tracking

({crash, regression, reproducible})

unspecified
ARM
Android
crash, regression, reproducible
Points:
---

Firefox Tracking Flags

(firefox22 unaffected, firefox23 fixed, fennec23+)

Details

(Whiteboard: [native-crash], crash signature)

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Massive ammount of console logging 

W/Adreno200-GSL( 1221): <gsl_ldd_control:226>: ioctl code 0xc0140933 (IOCTL_KGSL_TIMESTAMP_EVENT) failed: errno 22 Invalid argument
W/Adreno200-EGLSUB( 1221): <SwapBuffers:1113>: gsl_add_fence_event failed
W/Adreno200-EGL( 1221): <eglSwapBuffers:3529>: EGL_BAD_SURFACE
E/Gecko   ( 1221): ShmemAndroid::Create():open: Too many open files (24)
E/BufferQueue(  159): [SurfaceView] queueBuffer: crop rect is not contained within the buffer in slot 1
E/SurfaceTextureClient( 1221): queueBuffer: error queuing buffer to SurfaceTexture, -22
W/Adreno200-EGLSUB( 1221): <SwapBuffers:1119>: failed to queueBuffer
W/Adreno200-EGL( 1221): <eglSwapBuffers:3529>: EGL_BAD_SURFACE
E/Gecko   ( 1221): ShmemAndroid::ShareToProcess(): Too many open files (24)
E/Gecko   ( 1221): ShmemAndroid::ShareToProcess(): Too many open files (24)


The device then reboots each and every time I visit http://forecast.io

--
LG Nexus 4 (Android 4.2.2)
Nightly (05/08)
(Reporter)

Comment 1

5 years ago
Created attachment 747204 [details]
Raw logcat (Nightly 05/08)

Raw log
(Reporter)

Updated

5 years ago
Attachment #747204 - Attachment mime type: text/x-log → text/plain
(Reporter)

Updated

5 years ago
Severity: normal → major
tracking-fennec: --- → ?
status-firefox23: --- → affected
Keywords: regression, regressionwindow-wanted, reproducible

Updated

5 years ago
Severity: major → critical
Keywords: crash
Whiteboard: [native-crash]

Updated

5 years ago
Crash Signature: [@ EMPTY: no crashing thread identified; corrupt dump ]

Updated

5 years ago
Crash Signature: [@ EMPTY: no crashing thread identified; corrupt dump ] → [@ EMPTY: no crashing thread identified; corrupt dump]
Assignee: nobody → snorp
tracking-fennec: ? → 23+
status-firefox22: --- → unaffected

Updated

5 years ago
Version: Trunk → Firefox 23
I can repro this to some extent. The phone doesn't reboot, I just get a fennec crash. The first sign of things going bad seems to be:

E/SurfaceTextureClient( 5365): dequeueBuffer: error duping fence: 24

'24' is the value of errno, which corresponds to "too many files open". Using lsof, I could see that we have about 1000 fds open to /dev/ashmem. It would seem whatever is causing that is causing this crash.
It looks like the main place we use ashmem is IPC for shared memory. So something is either causing us to create a bunch of these, or we are leaking them.
So the animation next to the temperature is a <canvas>. It looks like we create a shared memory region on each frame that never gets freed.

#0  mozilla::ipc::SharedMemoryBasic::Create (this=0x76d49d40, aNbytes=28672)
    at /Users/snorp/source/mozilla-central/ipc/glue/SharedMemoryBasic_android.cpp:60
#1  0x78da32fc in mozilla::ipc::CreateSegment (aNBytes=28672, aHandle=...) at /Users/snorp/source/mozilla-central/ipc/glue/Shmem.cpp:147
#2  0x78da34a6 in mozilla::ipc::Shmem::Alloc (aNBytes=26908, aType=mozilla::ipc::SharedMemory::TYPE_BASIC)
    at /Users/snorp/source/mozilla-central/ipc/glue/Shmem.cpp:497
#3  0x78e1f56a in mozilla::layers::PCompositorChild::CreateSharedMemory (this=0x773a1a40, aSize=<optimized out>, aType=<optimized out>, 
    aUnsafe=<optimized out>, aId=0x74cabc0c) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PCompositorChild.cpp:448
#4  0x78da4222 in mozilla::dom::PExternalHelperAppParent::CreateSharedMemory (this=<optimized out>, aSize=<optimized out>, aType=<optimized out>, 
    aUnsafe=<optimized out>, aId=0x74cabc0c) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PExternalHelperAppParent.cpp:155
#5  0x78da9fe2 in mozilla::dom::indexedDB::PIndexedDBIndexParent::AllocUnsafeShmem (this=<optimized out>, aSize=<optimized out>, 
    aType=<optimized out>, aMem=0x74cabc38) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PIndexedDBIndexParent.cpp:433
#6  0x79023cb4 in gfxBaseSharedMemorySurface<gfxImageSurface, gfxSharedImageSurface>::Create<mozilla::layers::ISurfaceAllocator, true> (
    aAllocator=0x782c4118, aSize=..., aFormat=gfxASurface::ImageFormatARGB32, aShmType=mozilla::ipc::SharedMemory::TYPE_BASIC)
    at ../../dist/include/gfxBaseSharedMemorySurface.h:151
#7  0x79023d6e in CreateUnsafe<mozilla::layers::ISurfaceAllocator> (aShmType=mozilla::ipc::SharedMemory::TYPE_BASIC, aFormat=<optimized out>, 
    aSize=..., aAllocator=0x782c4118) at ../../dist/include/gfxBaseSharedMemorySurface.h:95
#8  mozilla::layers::ISurfaceAllocator::AllocSharedImageSurface (this=0x782c4118, aSize=..., aContent=gfxASurface::CONTENT_COLOR_ALPHA, 
    aBuffer=0x74cabc8c) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:56
#9  0x79023b46 in AllocSurfaceDescriptorWithCaps (aBuffer=0x741033cc, aContent=gfxASurface::CONTENT_COLOR_ALPHA, aSize=..., this=0x782c4118, 
    aCaps=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:90
#10 mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptorWithCaps (this=0x782c4118, aSize=..., aContent=gfxASurface::CONTENT_COLOR_ALPHA, 
    aCaps=<optimized out>, aBuffer=0x741033cc) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:74
#11 0x79023af4 in mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptor (this=<optimized out>, aSize=<optimized out>, 
    aContent=<optimized out>, aBuffer=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:70
#12 0x79023efe in mozilla::layers::TextureClientShmem::EnsureAllocated (this=0x741033c0, aSize=..., aContentType=gfxASurface::CONTENT_COLOR_ALPHA)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/TextureClient.cpp:80
#13 0x79017e2e in mozilla::layers::CanvasClient2D::Update (this=0x76d498e0, aSize=..., aLayer=0x79e9d8b0)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/CanvasClient.cpp:63
#14 0x79001046 in mozilla::layers::ClientCanvasLayer::RenderLayer (this=0x79e9d8b0)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientCanvasLayer.cpp:85
#15 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#16 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#17 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#18 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187
#19 0x79001c6a in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0x782c40c0, aCallback=<optimized out>, 
    aCallbackData=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:175
#20 0x790021c8 in mozilla::layers::ClientLayerManager::EndTransaction (this=0x782c40c0, aCallback=
    0x787f541d <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x74cac2d0, aFlags=mozilla::layers::LayerManager::END_NO_COMPOSITE)
    at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:198
#21 0x78813286 in nsDisplayList::PaintForFrame (this=0x74cac224, aBuilder=0x74cac2d0, aCtx=<optimized out>, aForFrame=<optimized out>, aFlags=13)
    at /Users/snorp/source/mozilla-central/layout/base/nsDisplayList.cpp:1197
#22 0x788133dc in nsDisplayList::PaintRoot (this=0x74cac224, aBuilder=0x74cac2d0, aCtx=0x0, aFlags=13)
    at /Users/snorp/source/mozilla-central/layout/base/nsDisplayList.cpp:1058
#23 0x78822b02 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0x77b9d298, aDirtyRegion=<optimized out>, aBackstop=0, aFlags=772)
    at /Users/snorp/source/mozilla-central/layout/base/nsLayoutUtils.cpp:2092
#24 0x7882ece6 in PresShell::Paint (this=0x7727eda0, aViewToPaint=0x782c7bf0, aDirtyRegion=..., aFlags=1)
    at /Users/snorp/source/mozilla-central/layout/base/nsPresShell.cpp:5577
#25 0x78a6a21e in ProcessPendingUpdatesForView (aView=0x782c7bf0, this=0x782f6d00, aFlushDirtyRegion=<optimized out>)
    at /Users/snorp/source/mozilla-central/view/src/nsViewManager.cpp:396
I'm relatively certain this is fallout from the layers refactor at this point. -> gfx
Component: Graphics, Panning and Zooming → Canvas: 2D
Product: Firefox for Android → Core
Version: Firefox 23 → unspecified
Alright, so TextureClientShmem::ReleaseResources falls through all of the conditions. It seems that something is clobbering TextureClientShmem::mDescriptor such that we have a null mDescriptor in ReleaseResources.
ShadowLayerForwarder::UpdateTexture() is where the problem lies:

*aDescriptor = SurfaceDescriptor();

This resets mDescriptor in TextureClientShmem which is why TextureClientShmem::ReleaseResources() can't do it's job.
Created attachment 747559 [details] [diff] [review]
Don't reset SurfaceDescriptor when updating texture for CanvasClient2D

This also corrects a booboo I saw from my patch for bug 863223. I'll split that out.
Attachment #747559 - Flags: review?(bas)
Duplicate of this bug: 870744
(Reporter)

Comment 11

5 years ago
Another test-case; just load: http://people.mozilla.com/~wlachance/clock.html
(In reply to Aaron Train [:aaronmt] from comment #11)
> Another test-case; just load: http://people.mozilla.com/~wlachance/clock.html

This test case crashes immediately with the patch applied (whereas before it would work for a bit before crashing).
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 871390
(Reporter)

Comment 14

5 years ago
Fixed via bug 871390
Status: RESOLVED → VERIFIED

Updated

5 years ago
No longer blocks: 872208
Keywords: regressionwindow-wanted

Updated

5 years ago
status-firefox23: affected → fixed
Attachment #747559 - Flags: review?(bas)
You need to log in before you can comment on or make changes to this bug.