Homescreen crash on nexus-4 and nexus-5

RESOLVED FIXED in Firefox 30

Status

()

defect
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: sotaro, Assigned: sotaro)

Tracking

({crash})

unspecified
mozilla31
ARM
Gonk (Firefox OS)
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(blocking-b2g:1.4+, firefox29 wontfix, firefox30 fixed, firefox31 fixed, b2g-v1.4 fixed, b2g-v2.0 fixed)

Details

(Whiteboard: [b2g-crash][caf-crash 131][caf priority: p2][CR 637308])

Attachments

(2 attachments)

Assignee

Description

5 years ago
On recent master, Homescreen crash often on nexus-4 and nexus-5. The crash seems to be caused by obsoleted android::Fence durin IPC.

STR
-[1] show homescreen
-[2] start message app
-[3] return to homescreen

The crash happened in [3].
Assignee

Comment 1

5 years ago
Assignee

Comment 2

5 years ago
The crash happens when the Fence is delivered from Compositor to child via gecko IPC. The Fence is kernel object, it's lifetime is controlled by a reference. Need to keep the reference in Compositor side during IPC.
Assignee

Updated

5 years ago
Assignee: nobody → sotaro.ikeda.g
Assignee

Comment 3

5 years ago
The problem sees to be caused by Bug 910010. Before the crash, parent side try to send 5 fences. I am going to investigate about it more.
Assignee

Comment 4

5 years ago
In gecko IPC, number of file descriptors per IPC message is limited to 4.
http://mxr.mozilla.org/mozilla-central/source/ipc/chromium/src/chrome/common/file_descriptor_set_posix.h#33
Assignee

Comment 5

5 years ago
I confirmed that the crash is fix by increasing MAX_DESCRIPTORS_PER_MESSAGE like Bug 979138 attachment 8385141 [details] [diff] [review]. But it can not be used as solution to the problem :-( And if we are going to send fences for tiling, any number of fences could be sent over IPC...
Assignee

Comment 6

5 years ago
To fix the problem correctly and quickly seems not easy. It seems better to commit a quick workaround for the problem.
Assignee

Comment 7

5 years ago
Most cases, one application does not use more than 4 textures. For the time being it seems OK. Need to fix it correctly in near future.
Assignee

Comment 9

5 years ago
Bug 910010 also handling similar problems. But it seems that a solution can not be applied to this problem.
Assignee

Comment 10

5 years ago
Comment on attachment 8394861 [details] [diff] [review]
patch - Limt a number of Fence to 4 per message

Nical, can you review the patch soon? Thanks.
Attachment #8394861 - Flags: review?(nical.bugzilla)
Assignee

Comment 11

5 years ago
Set 1.4? flag. This crash could happen on any JB/KK device.
blocking-b2g: --- → 1.4?
Comment on attachment 8394861 [details] [diff] [review]
patch - Limt a number of Fence to 4 per message

Review of attachment 8394861 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/ipc/CompositableTransactionParent.cpp
@@ +317,5 @@
>    const std::vector< RefPtr<TextureHost> > textureList =
>          aCompositable->GetCompositableBackendSpecificData()->GetPendingReleaseFenceTextureList();
>    // Return pending Texture data
>    for (size_t i = 0; i < textureList.size(); i++) {
> +    // File descriptr number is limited to 4 per IPC message.

nit: typo in "descriptr"
Attachment #8394861 - Flags: review?(nical.bugzilla) → review+
Assignee

Comment 14

5 years ago
(In reply to Sotaro Ikeda [:sotaro] from comment #11)
> Set 1.4? flag. This crash could happen on any JB/KK device.

I already confirmed the crash happened on v1.4 nexus4/5 and the crash is fixed by attachment 8394861 [details] [diff] [review].
blocking as it is device independent
blocking-b2g: 1.4? → 1.4+
https://hg.mozilla.org/mozilla-central/rev/05e914ac24e0
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla31

Comment 17

5 years ago
Sotaro, 

It seems the patch from Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=974152 is causing this issue. If I revert that patch, I never see the Home screen crash. I guess it is related to creation of lot of dup Fds and setting release fences on layer textures.

texture->SetReleaseFence(new android::Fence(GetGonkDisplay()->GetPrevFBAcquireFd()));
Flags: needinfo?(sotaro.ikeda.g)
Assignee

Comment 18

5 years ago
Sushi, can you try again by the source code applying attachment 8394861 [details] [diff] [review]? I already confirmed the problem is fixed by the patch. From my debugging, the crash always happens when trying to send 5 Fences to Homescreen in one ipc message. As in Comment 4, IPC message has a limitation to a file descriptor number.

And Homescreen never uses HwComposer for composition. So, Bug 974152 trigger this bug I think.
Flags: needinfo?(sotaro.ikeda.g) → needinfo?(sushilchauhan)

Comment 20

5 years ago
Yes, the patch fixes the crash. Does it mean, all the fences (> 4) are just ignored and will not be delivered to HomeScreen ? OR they will be delivered in next IPC message ?
Flags: needinfo?(sushilchauhan) → needinfo?(sotaro.ikeda.g)
Duplicate of this bug: 987220
Blocks: 960372

Updated

5 years ago
Whiteboard: [CR 637308]
Assignee

Comment 22

5 years ago
(In reply to Sushil from comment #20)
> Yes, the patch fixes the crash. Does it mean, all the fences (> 4) are just
> ignored and will not be delivered to HomeScreen ? OR they will be delivered
> in next IPC message ?

In current implementasion, overflowed fences are not delivered to client side.
Flags: needinfo?(sotaro.ikeda.g)
Whiteboard: [CR 637308] → [caf priority: p2][CR 637308]
Observed on: 

Device: 
Gonk Version: AU_LINUX_GECKO_B2G_KK_3.5.01.04.00.113.047
Moz BuildID: 20140320000349
B2G Version: 1.4
Gecko Version: 30.0a2
Gaia:  http://git.mozilla.org/?p=releases/gaia.git;a=commit;h=53edbf08b0a750c31e8c6b2c20f2b1315b1412d1
Gecko: http://git.mozilla.org/?p=releases/gecko.git;a=commit;h=979daba51a33e90b5ba88be7ef3940fa55d3297b
Whiteboard: [caf priority: p2][CR 637308] → [b2g-crash][caf-crash 131][caf priority: p2][CR 637308]
Keywords: crash
You need to log in before you can comment on or make changes to this bug.