986253 - Homescreen crash on nexus-4 and nexus-5

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Sotaro Ikeda [:sotaro]]

On recent master, Homescreen crash often on nexus-4 and nexus-5. The crash seems to be caused by obsoleted android::Fence durin IPC.

STR
-[1] show homescreen
-[2] start message app
-[3] return to homescreen

The crash happened in [3].

Comment 1

[Sotaro Ikeda [:sotaro]]

Attachment: stack trace of the crash

Comment 2

[Sotaro Ikeda [:sotaro]]

The crash happens when the Fence is delivered from Compositor to child via gecko IPC. The Fence is kernel object, it's lifetime is controlled by a reference. Need to keep the reference in Compositor side during IPC.

Comment 3

[Sotaro Ikeda [:sotaro]]

The problem sees to be caused by Bug 910010. Before the crash, parent side try to send 5 fences. I am going to investigate about it more.

Comment 4

[Sotaro Ikeda [:sotaro]]

In gecko IPC, number of file descriptors per IPC message is limited to 4.
http://mxr.mozilla.org/mozilla-central/source/ipc/chromium/src/chrome/common/file_descriptor_set_posix.h#33

Comment 5

[Sotaro Ikeda [:sotaro]]

I confirmed that the crash is fix by increasing MAX_DESCRIPTORS_PER_MESSAGE like Bug 979138 attachment 8385141 [details] [diff] [review]. But it can not be used as solution to the problem :-( And if we are going to send fences for tiling, any number of fences could be sent over IPC...

Comment 6

[Sotaro Ikeda [:sotaro]]

To fix the problem correctly and quickly seems not easy. It seems better to commit a quick workaround for the problem.

Comment 7

[Sotaro Ikeda [:sotaro]]

Most cases, one application does not use more than 4 textures. For the time being it seems OK. Need to fix it correctly in near future.

Comment 8

[Sotaro Ikeda [:sotaro]]

Attachment: patch - Limt a number of Fence to 4 per message

Comment 9

[Sotaro Ikeda [:sotaro]]

Bug 910010 also handling similar problems. But it seems that a solution can not be applied to this problem.

Comment 10

[Sotaro Ikeda [:sotaro]]

Comment on attachment 8394861 [details] [diff] [review]
patch - Limt a number of Fence to 4 per message

Nical, can you review the patch soon? Thanks.

Comment 11

[Sotaro Ikeda [:sotaro]]

Set 1.4? flag. This crash could happen on any JB/KK device.

Comment 12

[Nicolas Silva [:nical]]

Comment on attachment 8394861 [details] [diff] [review]
patch - Limt a number of Fence to 4 per message

Review of attachment 8394861 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/ipc/CompositableTransactionParent.cpp
@@ +317,5 @@
>    const std::vector< RefPtr<TextureHost> > textureList =
>          aCompositable->GetCompositableBackendSpecificData()->GetPendingReleaseFenceTextureList();
>    // Return pending Texture data
>    for (size_t i = 0; i < textureList.size(); i++) {
> +    // File descriptr number is limited to 4 per IPC message.

nit: typo in "descriptr"

Comment 13

[Sotaro Ikeda [:sotaro]]

https://hg.mozilla.org/integration/b2g-inbound/rev/05e914ac24e0

Comment 14

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #11)
> Set 1.4? flag. This crash could happen on any JB/KK device.

I already confirmed the crash happened on v1.4 nexus4/5 and the crash is fixed by attachment 8394861 [details] [diff] [review].

Comment 15

[Preeti Raghunath(:Preeti)]

blocking as it is device independent

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/05e914ac24e0

Comment 17

[Sushil]

Sotaro, 

It seems the patch from Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=974152 is causing this issue. If I revert that patch, I never see the Home screen crash. I guess it is related to creation of lot of dup Fds and setting release fences on layer textures.

texture->SetReleaseFence(new android::Fence(GetGonkDisplay()->GetPrevFBAcquireFd()));

Comment 18

[Sotaro Ikeda [:sotaro]]

Sushi, can you try again by the source code applying attachment 8394861 [details] [diff] [review]? I already confirmed the problem is fixed by the patch. From my debugging, the crash always happens when trying to send 5 Fences to Homescreen in one ipc message. As in Comment 4, IPC message has a limitation to a file descriptor number.

And Homescreen never uses HwComposer for composition. So, Bug 974152 trigger this bug I think.

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/a96a82ca7f02

Comment 20

[Sushil]

Yes, the patch fixes the crash. Does it mean, all the fences (> 4) are just ignored and will not be delivered to HomeScreen ? OR they will be delivered in next IPC message ?

Comment 22

[Sotaro Ikeda [:sotaro]]

(In reply to Sushil from comment #20)
> Yes, the patch fixes the crash. Does it mean, all the fences (> 4) are just
> ignored and will not be delivered to HomeScreen ? OR they will be delivered
> in next IPC message ?

In current implementasion, overflowed fences are not delivered to client side.

Comment 23

[cafbot (PoC: ggrisco)]

Observed on: 

Device: 
Gonk Version: AU_LINUX_GECKO_B2G_KK_3.5.01.04.00.113.047
Moz BuildID: 20140320000349
B2G Version: 1.4
Gecko Version: 30.0a2
Gaia:  http://git.mozilla.org/?p=releases/gaia.git;a=commit;h=53edbf08b0a750c31e8c6b2c20f2b1315b1412d1
Gecko: http://git.mozilla.org/?p=releases/gecko.git;a=commit;h=979daba51a33e90b5ba88be7ef3940fa55d3297b