Massive ammount of console logging W/Adreno200-GSL( 1221): <gsl_ldd_control:226>: ioctl code 0xc0140933 (IOCTL_KGSL_TIMESTAMP_EVENT) failed: errno 22 Invalid argument W/Adreno200-EGLSUB( 1221): <SwapBuffers:1113>: gsl_add_fence_event failed W/Adreno200-EGL( 1221): <eglSwapBuffers:3529>: EGL_BAD_SURFACE E/Gecko ( 1221): ShmemAndroid::Create():open: Too many open files (24) E/BufferQueue( 159): [SurfaceView] queueBuffer: crop rect is not contained within the buffer in slot 1 E/SurfaceTextureClient( 1221): queueBuffer: error queuing buffer to SurfaceTexture, -22 W/Adreno200-EGLSUB( 1221): <SwapBuffers:1119>: failed to queueBuffer W/Adreno200-EGL( 1221): <eglSwapBuffers:3529>: EGL_BAD_SURFACE E/Gecko ( 1221): ShmemAndroid::ShareToProcess(): Too many open files (24) E/Gecko ( 1221): ShmemAndroid::ShareToProcess(): Too many open files (24) The device then reboots each and every time I visit http://forecast.io -- LG Nexus 4 (Android 4.2.2) Nightly (05/08)

Raw log

I can repro this to some extent. The phone doesn't reboot, I just get a fennec crash. The first sign of things going bad seems to be: E/SurfaceTextureClient( 5365): dequeueBuffer: error duping fence: 24 '24' is the value of errno, which corresponds to "too many files open". Using lsof, I could see that we have about 1000 fds open to /dev/ashmem. It would seem whatever is causing that is causing this crash.

It looks like the main place we use ashmem is IPC for shared memory. So something is either causing us to create a bunch of these, or we are leaking them.

So the animation next to the temperature is a <canvas>. It looks like we create a shared memory region on each frame that never gets freed. #0 mozilla::ipc::SharedMemoryBasic::Create (this=0x76d49d40, aNbytes=28672) at /Users/snorp/source/mozilla-central/ipc/glue/SharedMemoryBasic_android.cpp:60 #1 0x78da32fc in mozilla::ipc::CreateSegment (aNBytes=28672, aHandle=...) at /Users/snorp/source/mozilla-central/ipc/glue/Shmem.cpp:147 #2 0x78da34a6 in mozilla::ipc::Shmem::Alloc (aNBytes=26908, aType=mozilla::ipc::SharedMemory::TYPE_BASIC) at /Users/snorp/source/mozilla-central/ipc/glue/Shmem.cpp:497 #3 0x78e1f56a in mozilla::layers::PCompositorChild::CreateSharedMemory (this=0x773a1a40, aSize=<optimized out>, aType=<optimized out>, aUnsafe=<optimized out>, aId=0x74cabc0c) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PCompositorChild.cpp:448 #4 0x78da4222 in mozilla::dom::PExternalHelperAppParent::CreateSharedMemory (this=<optimized out>, aSize=<optimized out>, aType=<optimized out>, aUnsafe=<optimized out>, aId=0x74cabc0c) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PExternalHelperAppParent.cpp:155 #5 0x78da9fe2 in mozilla::dom::indexedDB::PIndexedDBIndexParent::AllocUnsafeShmem (this=<optimized out>, aSize=<optimized out>, aType=<optimized out>, aMem=0x74cabc38) at /Users/snorp/source/mozilla-central/objdir-android/ipc/ipdl/PIndexedDBIndexParent.cpp:433 #6 0x79023cb4 in gfxBaseSharedMemorySurface<gfxImageSurface, gfxSharedImageSurface>::Create<mozilla::layers::ISurfaceAllocator, true> ( aAllocator=0x782c4118, aSize=..., aFormat=gfxASurface::ImageFormatARGB32, aShmType=mozilla::ipc::SharedMemory::TYPE_BASIC) at ../../dist/include/gfxBaseSharedMemorySurface.h:151 #7 0x79023d6e in CreateUnsafe<mozilla::layers::ISurfaceAllocator> (aShmType=mozilla::ipc::SharedMemory::TYPE_BASIC, aFormat=<optimized out>, aSize=..., aAllocator=0x782c4118) at ../../dist/include/gfxBaseSharedMemorySurface.h:95 #8 mozilla::layers::ISurfaceAllocator::AllocSharedImageSurface (this=0x782c4118, aSize=..., aContent=gfxASurface::CONTENT_COLOR_ALPHA, aBuffer=0x74cabc8c) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:56 #9 0x79023b46 in AllocSurfaceDescriptorWithCaps (aBuffer=0x741033cc, aContent=gfxASurface::CONTENT_COLOR_ALPHA, aSize=..., this=0x782c4118, aCaps=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:90 #10 mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptorWithCaps (this=0x782c4118, aSize=..., aContent=gfxASurface::CONTENT_COLOR_ALPHA, aCaps=<optimized out>, aBuffer=0x741033cc) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:74 #11 0x79023af4 in mozilla::layers::ISurfaceAllocator::AllocSurfaceDescriptor (this=<optimized out>, aSize=<optimized out>, aContent=<optimized out>, aBuffer=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/ipc/ISurfaceAllocator.cpp:70 #12 0x79023efe in mozilla::layers::TextureClientShmem::EnsureAllocated (this=0x741033c0, aSize=..., aContentType=gfxASurface::CONTENT_COLOR_ALPHA) at /Users/snorp/source/mozilla-central/gfx/layers/client/TextureClient.cpp:80 #13 0x79017e2e in mozilla::layers::CanvasClient2D::Update (this=0x76d498e0, aSize=..., aLayer=0x79e9d8b0) at /Users/snorp/source/mozilla-central/gfx/layers/client/CanvasClient.cpp:63 #14 0x79001046 in mozilla::layers::ClientCanvasLayer::RenderLayer (this=0x79e9d8b0) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientCanvasLayer.cpp:85 #15 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187 #16 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187 #17 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187 #18 0x790016da in ClientContainerLayer::RenderLayer (this=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientContainerLayer.h:187 #19 0x79001c6a in mozilla::layers::ClientLayerManager::EndTransactionInternal (this=0x782c40c0, aCallback=<optimized out>, aCallbackData=<optimized out>) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:175 #20 0x790021c8 in mozilla::layers::ClientLayerManager::EndTransaction (this=0x782c40c0, aCallback= 0x787f541d <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0x74cac2d0, aFlags=mozilla::layers::LayerManager::END_NO_COMPOSITE) at /Users/snorp/source/mozilla-central/gfx/layers/client/ClientLayerManager.cpp:198 #21 0x78813286 in nsDisplayList::PaintForFrame (this=0x74cac224, aBuilder=0x74cac2d0, aCtx=<optimized out>, aForFrame=<optimized out>, aFlags=13) at /Users/snorp/source/mozilla-central/layout/base/nsDisplayList.cpp:1197 #22 0x788133dc in nsDisplayList::PaintRoot (this=0x74cac224, aBuilder=0x74cac2d0, aCtx=0x0, aFlags=13) at /Users/snorp/source/mozilla-central/layout/base/nsDisplayList.cpp:1058 #23 0x78822b02 in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0x77b9d298, aDirtyRegion=<optimized out>, aBackstop=0, aFlags=772) at /Users/snorp/source/mozilla-central/layout/base/nsLayoutUtils.cpp:2092 #24 0x7882ece6 in PresShell::Paint (this=0x7727eda0, aViewToPaint=0x782c7bf0, aDirtyRegion=..., aFlags=1) at /Users/snorp/source/mozilla-central/layout/base/nsPresShell.cpp:5577 #25 0x78a6a21e in ProcessPendingUpdatesForView (aView=0x782c7bf0, this=0x782f6d00, aFlushDirtyRegion=<optimized out>) at /Users/snorp/source/mozilla-central/view/src/nsViewManager.cpp:396

I'm relatively certain this is fallout from the layers refactor at this point. -> gfx

Alright, so TextureClientShmem::ReleaseResources falls through all of the conditions. It seems that something is clobbering TextureClientShmem::mDescriptor such that we have a null mDescriptor in ReleaseResources.

ShadowLayerForwarder::UpdateTexture() is where the problem lies: *aDescriptor = SurfaceDescriptor(); This resets mDescriptor in TextureClientShmem which is why TextureClientShmem::ReleaseResources() can't do it's job.

This also corrects a booboo I saw from my patch for bug 863223. I'll split that out.

For bonus points, this screws up Breakpad causing it to write empty minidumps: https://crash-stats.mozilla.com/report/index/bp-ef5de0a3-1b4b-46dd-823f-8bed92130508 https://crash-stats.mozilla.com/report/index/bp-9d9e4c44-74df-4339-95db-89c652130509

Another test-case; just load: http://people.mozilla.com/~wlachance/clock.html

(In reply to Aaron Train [:aaronmt] from comment #11) > Another test-case; just load: http://people.mozilla.com/~wlachance/clock.html This test case crashes immediately with the patch applied (whereas before it would work for a bit before crashing).

Fixed via bug 871390