976129 - [B2G][Gallery] Crash occurred while stressing Gallery App viewing images and rotating orientation then tapping the back icon

Status: RESOLVED DUPLICATE of bug 975033

(Core :: Graphics: Layers, defect)

Description

[Tony Nguyen]

This bug was filed from the Socorro interface and is 
report bp-1d7067a3-8a34-47ad-aae5-33dc52140224.
=============================================================

I encountered this crash while browsing through the Gallery App. I was viewing an image and rotating the orientation of the image several times.

Steps to Repro:
1. Updated Buri to 20140224040201
2. Navigate to Gallery App
3. Tap on any image to view fullscreen
4. Rotate device 90 degrees to the right
5. Rotate device 180 degrees to the left
6. Rotate device 90 degrees to the right
7. Tap the '<' arrow to go back

Actual Result:
Device crashes

Expected result:
Device does not crash

Environmental Variables:
Device: Buri Master M-C mozRIL
BuildID: 20140224040201
Gaia: ffb527b84594396ed611edf0a8a5a130d60a742f
Gecko: 31113754db3b
Version: 30.0a1
v1.2-device.cfg

Note: Bugzilla did not me put in the original title of the crash. The original title is - crash in mozalloc_abort(char const*) | NS_DebugBreak | mozilla::layers::PLayerTransactionChild::SendPGrallocBufferConstructor(mozilla::layers::PGrallocBufferChild*, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, unsigned int const&, unsigned int...

Comment 1

[Natalya Kot [:nkot]]

just got this crash too, was sliding gallery pictures while in landscape mode and pressed the back button

Comment 2

[Jason Smith [:jsmith]]

Can we include specific reproducible STR here to generate this crash?

Comment 3

[Sotaro Ikeda [:sotaro]]

Tony, can you attach a logcat log?

Comment 4

[Sotaro Ikeda [:sotaro]]

Bug 976240  seems a dup of this bug.

Comment 5

[Sotaro Ikeda [:sotaro]]

I can not reproduce tha crash. But it might be caused by ipc failure because of out of ashmem.

Comment 7

[Jason Smith [:jsmith]]

QA Wanted - Need a logcat.

Comment 8

[Tony Nguyen]

Attachment: logcat

I was able to find better steps to reproduce this crash. I will attach a logcat and a video link to YouTube to better represent the issue. 

Steps to Repro:
1. Updated Buri to 20140224040201
2. Navigate to Gallery App
3. Tap on any image to view fullscreen
4. Rotate device to landscape view
5. Tap the '<' icon quickly before image rotates

Comment 9

[Tony Nguyen]

I am unable to repro this crash on today's Buri build 20140225040205 after multiple attempts on several devices and will close this as worksforme.

Environmental Variables:
Device: Buri Master M-C mozRIL
BuildID: 20140225040205
Gaia: e0f39c7179c8b297326c0e2313950610be1f5c52
Gecko: e3daaa4c73dd
Version: 30.0a1
v1.2-device.cfg

Comment 10

[Sotaro Ikeda [:sotaro]]

After gralloc buffer allocation failure. IPC seems not work correctly.

02-24 16:52:39.199: I/Gecko(136): GrallocBufferActor::Create -- requested gralloc buffer is too big. Killing child instead.
02-24 16:52:39.199: I/Gecko(136): ###!!! [Child][DispatchSyncMessage] Error: Value error: message was deserialized, but contained an illegal value
02-24 16:52:39.209: I/Gecko(1182): [Child 1182] ###!!! ABORT: constructor for actor failed: file PLayerTransactionChild.cpp, line 133
02-24 16:52:39.209: E/Gecko(1182): mozalloc_abort: [Child 1182] ###!!! ABORT: constructor for actor failed: file PLayerTransactionChild.cpp, line 133
02-24 16:52:39.819: I/Gecko(136): ###!!! [Parent][MessageChannel] Error: Channel error: cannot send/recv

Comment 11

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #10)
> After gralloc buffer allocation failure. IPC seems not work correctly.
> 
> 02-24 16:52:39.199: I/Gecko(136): GrallocBufferActor::Create -- requested
> gralloc buffer is too big. Killing child instead.

The above log says that an app was killed because of too large gralloc buffer request. It is added by Bug 965945 as temporal workaround. And actual fix is coming by Bug 975033.

Comment 12

[Sotaro Ikeda [:sotaro]]

It seems better to set dup of Bug 975033.