993736 - [crash] AtomicBaseIncDec<unsigned int> | RefCounted<mozilla::layers::TextureChild> | TextureChild::ActorDestroy | PColorPickerChild::DestroySubtree

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect, P1)

Description

[Tapas[:tkundu on #b2g/gaia/memshrink/gfx] (always NI me)]

Attachment: logs and stack trace

STR:

1. Run stability test for Call, SMS, Browser, Camera, Camcorder, Music and video.
2. After night run, mini dumps are generated in the phone.

Comment 1

[Mike Habicher [:mikeh] (high bugzilla latency)]

Sotaro, is this related to the other graphics issues we're seeing?

Comment 2

[Jason Smith [:jsmith]]

Might be caused by bug 946720.

Also - could this potentially be a dupe of bug 986094?

Comment 3

[Sotaro Ikeda [:sotaro]]

Bug 988713 and Bug 985878 seem similar bug to the crash.

Comment 4

[Sotaro Ikeda [:sotaro]]

Bug 988713 is fixed only on master. It is not applied to b2g v1.4.

Comment 5

[Sotaro Ikeda [:sotaro]]

dup of Bug 988713 seems possible.

Comment 6

[Sotaro Ikeda [:sotaro]]

In attachment 8403609 [details], there are the following log, from it, video element and ImageLayer seems to be related to the crash. And the crash happened by destroying TextureChild. dup of Bug 988713 seems more possible.

------------------------------
Thread 0
 0  libc.so + 0x21a50
     r4 = 0xb1ffd950    r5 = 0xb1ffd944    r6 = 0x00000000    r7 = 0x000000f0
     r8 = 0x00000001    r9 = 0xb6f88154   r10 = 0xb1ffd950    fp = 0x00000004
     sp = 0xbe8235a8    lr = 0xb6ee3018    pc = 0xb6ef5a50
    Found by: given as instruction pointer in context
 1  libc.so!__pthread_cond_timedwait [pthread.c : 1140 + 0xa]
     sp = 0xbe8235c0    pc = 0xb6ee3078
    Found by: stack scanning
 2  libmozglue.so!__wrap_pthread_cond_wait [Nuwa.cpp : 993 + 0x7]
     r4 = 0x00000000    r5 = 0x00000000    sp = 0xbe8235d8    pc = 0xb6f49d73
    Found by: call frame info
 3  libnss3.so!PR_Wait [ptsynch.c : 698 + 0x3]
     r4 = 0xb1ffd940    r5 = 0xb1ffd944    r6 = 0xb1ffd94c    sp = 0xbe823600
     pc = 0xb5347a59
    Found by: call frame info
 4  libxul.so!mozilla::ReentrantMonitor::Wait(unsigned int) [ReentrantMonitor.h : 89 + 0x5]
     r4 = 0xb1ffdab8    r5 = 0xbe823654    r6 = 0xbe823630    r7 = 0xb1ffdaa0
     r8 = 0xb3d20b90    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe823620
     pc = 0xb5a2485d
    Found by: call frame info
 5  libxul.so!mozilla::layers::ImageBridgeChild::FlushAllImages(mozilla::layers::ImageClient*, mozilla::layers::ImageContainer*, bool) [ImageBridgeChild.cpp : 432 + 0x9]
     r4 = 0xb1ffdab8    r5 = 0xbe823654    r6 = 0xbe823630    r7 = 0xb1ffdaa0
     r8 = 0xb3d20b90    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe823628
     pc = 0xb5a25e8b
    Found by: call frame info
 6  libxul.so!mozilla::layers::ImageContainer::ClearAllImages() [ImageContainer.cpp : 212 + 0x9]
     r4 = 0xb2b5b290    r5 = 0x00000000    r6 = 0xb3498940    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe823670
     pc = 0xb59f614d
    Found by: call frame info
 7  libxul.so!mozilla::VideoFrameContainer::ClearCurrentFrame(bool) [VideoFrameContainer.cpp : 88 + 0x5]
     r4 = 0xb3498b20    r5 = 0x00000000    r6 = 0x00000001    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe823688
     pc = 0xb5ee7e0d
    Found by: call frame info
 8  libxul.so!mozilla::VideoFrameContainer::Reset() [VideoFrameContainer.cpp : 70 + 0x5]
     r4 = 0xb3498b20    r5 = 0x00000000    r6 = 0x00000000    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe8236a0
     pc = 0xb5ee7e2b
    Found by: call frame info
 9  libxul.so!mozilla::dom::HTMLMediaElement::Load() [HTMLMediaElement.cpp : 739 + 0x5]
     r4 = 0xb3f34740    r5 = 0x00000000    r6 = 0x00000000    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe8236b0
     pc = 0xb5ea49d7
    Found by: call frame info
10  libxul.so!mozilla::dom::HTMLMediaElement::SetMozSrcObject(mozilla::DOMMediaStream&) [HTMLMediaElement.cpp : 489 + 0x9]
     r4 = 0xb3f34740    r5 = 0xb6bd5ffc    r6 = 0x00000000    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe8236c0
     pc = 0xb5ea192b
    Found by: call frame info
11  libxul.so!mozilla::dom::HTMLMediaElement::SetMozSrcObject(nsIDOMMediaStream*) [HTMLMediaElement.cpp : 496 + 0x3]
     r4 = 0xb5af6acd    r5 = 0xb6bd5ffc    r6 = 0x00000000    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe8236c8
     pc = 0xb5ea1933
    Found by: call frame info
12  libxul.so!mozilla::dom::HTMLMediaElementBinding::set_mozSrcObject [HTMLMediaElementBinding.cpp : 1221 + 0xb]
     r4 = 0xb5af6acd    r5 = 0xb6bd5ffc    r6 = 0x00000000    r7 = 0xb3f34740
     r8 = 0xb3fcbd40    r9 = 0xb6d1282c   r10 = 0xb3f34740    sp = 0xbe8236d0
     pc = 0xb5af6b5f
    Found by: call frame info

Comment 7

[Sotaro Ikeda [:sotaro]]

Tapas, how often did the crash happen? Is it possible to retest by applying attachment 8399258 [details] [diff] [review] in Bug 988713?

Comment 8

[Tapas[:tkundu on #b2g/gaia/memshrink/gfx] (always NI me)]

(In reply to Sotaro Ikeda [:sotaro] from comment #7)
> Tapas, how often did the crash happen? Is it possible to retest by applying
> attachment 8399258 [details] [diff] [review] in Bug 988713?

I am asking our internal test team to test it. I will update here soon

Comment 9

[Tapas[:tkundu on #b2g/gaia/memshrink/gfx] (always NI me)]

(In reply to Sotaro Ikeda [:sotaro] from comment #7)
> Tapas, how often did the crash happen? Is it possible to retest by applying
> attachment 8399258 [details] [diff] [review] in Bug 988713?

Issue is not observed in latest stability run after applying fix from that bug.  This happens randomly. So I will wait for another test run and then I will update here again. If we don't see it then we can mark it as Resolved.

Comment 10

[Sotaro Ikeda [:sotaro]]

If a new crash happens, please attach a new crash log, thanks.

Comment 11

[Tapas[:tkundu on #b2g/gaia/memshrink/gfx] (always NI me)]

(In reply to Sotaro Ikeda [:sotaro] from comment #10)
> If a new crash happens, please attach a new crash log, thanks.

It is not coming anymore on tip of v1.4 gaia/gecko. Thanks a lot for your work