Closed Bug 1754781 Opened 3 years ago Closed 3 years ago

Crash on debug assertion when capturing a profile from Android

Tracking

()

Status:

RESOLVED FIXED

Milestone:

99 Branch

Tracking Flags:

Tracking

Status

firefox-esr91

---

unaffected

firefox97

---

wontfix

firefox98

---

wontfix

firefox99

---

fixed

People

(Reporter: canova, Assigned: canova)

References

(Regression)

Details

(Keywords: regression)

Attachments

(2 files)

Bug 1754781 - Remove the xpcshell global skip for Android and move that into tests instead r?gerald 3 years ago Nazım Can Altınova [:canova][:canaltinova on phabricator] (deleted), text/x-phabricator-request		Details
Bug 1754781 - Change the Android JVM thread id to 1 r?gerald 3 years ago Nazım Can Altınova [:canova][:canaltinova on phabricator] (deleted), text/x-phabricator-request		Details

Nazım Can Altınova [:canova][:canaltinova on phabricator]

Assignee

Description

•

3 years ago

When user capture a profile, the following assertion is being hit and android app crashes:

02-10 13:47:44.657  2341  2801 F MOZ_Assert: Assertion failure: aThreadId.IsSpecified() || (processedCount == 1 && aReadThreadId.IsSpecified()) (Unspecified aThreadId should only be used with 1-sample buffer), at /home/canova/projects/gecko-android/tools/profiler/core/ProfileBufferEntry.cpp:1346

This is the assertion: https://searchfox.org/mozilla-central/rev/38652b98c6dd3bf42403eeb8c5305902b9a6e938/tools/profiler/core/ProfileBufferEntry.cpp#1343-1346

This is the full crash output but unfortunately I couldn't get a symbolicated crash report:

02-10 13:47:44.658  2341  2801 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 2801 (Thread-5), pid 2341 (iew_example:gpu)
02-10 13:47:44.789  2860  2860 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-10 13:47:44.789  2860  2860 F DEBUG   : Build fingerprint: 'samsung/a51nsxx/a51:11/RP1A.200720.012/A515FXXU5EUJ4:user/release-keys'
02-10 13:47:44.789  2860  2860 F DEBUG   : Revision: '9'
02-10 13:47:44.789  2860  2860 F DEBUG   : ABI: 'arm'
02-10 13:47:44.790  2860  2860 F DEBUG   : Timestamp: 2022-02-10 13:47:44+0100
02-10 13:47:44.790  2860  2860 F DEBUG   : pid: 2341, tid: 2801, name: Thread-5  >>> org.mozilla.geckoview_example:gpu <<<
02-10 13:47:44.790  2860  2860 F DEBUG   : uid: 10309
02-10 13:47:44.790  2860  2860 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
02-10 13:47:44.790  2860  2860 F DEBUG   : Cause: null pointer dereference
02-10 13:47:44.790  2860  2860 F DEBUG   : Abort message: 'Assertion failure: aThreadId.IsSpecified() || (processedCount == 1 && aReadThreadId.IsSpecified()) (Unspecified aThreadId should only be used with 1-sample buffer), at /home/canova/projects/gecko-android/tools/profiler/core/ProfileBufferEntry.cpp:1346
02-10 13:47:44.790  2860  2860 F DEBUG   : '
02-10 13:47:44.790  2860  2860 F DEBUG   :     r0  00000542  r1  00000000  r2  464f8ecb  r3  464f8ecb
02-10 13:47:44.790  2860  2860 F DEBUG   :     r4  bf3a6d88  r5  a3387988  r6  a3387320  r7  a3386b48
02-10 13:47:44.790  2860  2860 F DEBUG   :     r8  a338730c  r9  a519e830  r10 a3387420  r11 f334825c
02-10 13:47:44.790  2860  2860 F DEBUG   :     ip  eee62b08  sp  a3386b20  lr  bb5c2335  pc  bb5c233c
02-10 13:47:44.859  2860  2860 F DEBUG   : backtrace:
02-10 13:47:44.859  2860  2860 F DEBUG   :       #00 pc 0cfb933c  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #01 pc 0cfb8c63  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #02 pc 0cfb9fed  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #03 pc 0cfb9265  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #04 pc 0cfb8abb  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.859  2860  2860 F DEBUG   :       #05 pc 0cf9d83f  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #06 pc 0cf9d7b7  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #07 pc 0cfbd68b  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #08 pc 0cf9efb5  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #09 pc 0cf9e7ad  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #10 pc 0cf9e5f7  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #11 pc 0cfa3f21  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #12 pc 0cfa2c41  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #13 pc 0cfa4407  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #14 pc 0cfaa49d  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #15 pc 0cfaa621  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.860  2860  2860 F DEBUG   :       #16 pc 0cfae3b7  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libxul.so (BuildId: 96c02cf8666f1574fb86af644c80a27696f70326)
02-10 13:47:44.861  2860  2860 F DEBUG   :       #17 pc 001b042f  /data/app/~~EKjLyHDCYG5xSuTyVTK-hA==/org.mozilla.geckoview_example-WKF815j-A2w050uuG8r5Mg==/lib/arm/libnss3.so (BuildId: b05c9fc69d226c56599b12b69282813047dd4e0e)
02-10 13:47:44.861  2860  2860 F DEBUG   :       #18 pc 000ab7eb  /apex/com.android.runtime/lib/bionic/libc.so (__pthread_start(void*)+40) (BuildId: b3b27b88dfad1a88f83c4380d3183302)
02-10 13:47:44.861  2860  2860 F DEBUG   :       #19 pc 00063dcf  /apex/com.android.runtime/lib/bionic/libc.so (__start_thread+30) (BuildId: b3b27b88dfad1a88f83c4380d3183302)
02-10 13:47:45.652  5201  2865 I DropBoxManagerService: add tag=data_app_native_crash isTagEnabled=true flags=0x2

I think this is most likely a refression from Bug 1721110 but this assertion is actually newer than this bug. It's introduced in Bug 1577658, so I'm adding both just in case.

Nazım Can Altınova [:canova][:canaltinova on phabricator]

Assignee

Comment 1

•

3 years ago

I'm pretty sure this assertion should be like this instead:

MOZ_ASSERT(
            aThreadId.IsSpecified() ||
                (processedCount == 1 && !aReadThreadId.IsSpecified()),
            "Unspecified aThreadId should only be used with 1-sample buffer");

Difference is that aReadThreadId.IsSpecified()) is negated now.
It's also similar in baseprofiler: https://searchfox.org/mozilla-central/rev/38652b98c6dd3bf42403eeb8c5305902b9a6e938/mozglue/baseprofiler/core/ProfileBufferEntry.cpp#613-615
But when I try to capture a profile with this change, I'm still getting some assertion hits here. I'm starting to think that there are some threads with unspecified thread ids other than java threads. But it's pretty hard to remote debug android devices. I'll post more info if I find out more.

Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)

Comment 2

•

3 years ago

As discussed, I think the assertion as it is in the code is correct. The 1-sample buffer is for ProfilerBacktrace, which doesn't include a thread id.
I'm suspecting that the chosen Java thread id of 0 (zero) may be the cause, because zero is the special value used to indicate an unspecified thread.
Please try a thread id of 1. Thank you for working on this.

BugBot [:suhaib / :marco/ :calixte]

Updated

•

3 years ago

Keywords: regression

BugBot [:suhaib / :marco/ :calixte]

Updated

•

3 years ago

Has Regression Range: --- → yes

Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)

Updated

•

3 years ago

Severity: -- → S3

Priority: -- → P2

Nazım Can Altınova [:canova][:canaltinova on phabricator]

Assignee

Comment 3

•

3 years ago

Attached file Bug 1754781 - Remove the xpcshell global skip for Android and move that into tests instead r?gerald (deleted) — Details

Phabricator Automation

Updated

•

3 years ago

Assignee: nobody → canaltinova

Status: NEW → ASSIGNED

Nazım Can Altınova [:canova][:canaltinova on phabricator]

Assignee

Comment 4

•

3 years ago

Attached file Bug 1754781 - Change the Android JVM thread id to 1 r?gerald (deleted) — Details

Depends on D138768

Nazım Can Altınova [:canova][:canaltinova on phabricator]

Assignee

Updated

•

3 years ago

Blocks: 1755488

Pulsebot

Comment 5

•

3 years ago

Pushed by canaltinova@gmail.com: https://hg.mozilla.org/integration/autoland/rev/8eda3ffd476a Remove the xpcshell global skip for Android and move that into tests instead r=gerald https://hg.mozilla.org/integration/autoland/rev/125468dd9db9 Change the Android JVM thread id to 1 r=gerald

Natalia Csoregi [:nataliaCs]

Comment 6

•

3 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/8eda3ffd476a
https://hg.mozilla.org/mozilla-central/rev/125468dd9db9

Status: ASSIGNED → RESOLVED

Closed: 3 years ago

status-firefox99: affected → fixed

Resolution: --- → FIXED

Target Milestone: --- → 99 Branch

Ryan VanderMeulen [:RyanVM]

Updated

•

3 years ago

status-firefox97: --- → wontfix

status-firefox98: --- → wontfix

status-firefox-esr91: --- → unaffected

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

Crash on debug assertion when capturing a profile from Android

Categories

(Core :: Gecko Profiler, defect, P2)

Tracking

()

People

(Reporter: canova, Assigned: canova)

References

(Regression)

Details

(Keywords: regression)

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Updated

Updated

Updated

Comment 3

Updated

Comment 4

Updated

Comment 5

Comment 6

Updated

Attachment

General

Description

File Name

Content Type