CrashKill/2014-07-14

General

Previous Action Items

• [DONE] [ashughes] take a look at beta-to-beta
• [DONE] [KaiRo] see if we can account for addition 31b crash volume in numbers
• [ON TRACK] [KaiRo] ping relman on prerequisites in approval questionnaire

Socorro

• shipped last week: 17 bugs
• about to ship: 5 bugs

• many improvements to ADU by Sig graphs
• first steps towards new ADI source

Desktop

Beta

• Some JS-related signatures coming back from the dead (like FinalizeTypedArenas<JSObject>) after GGC deactivation, but net result is a huge drop in crash volume.
• Spiking in the latest Beta although low volume:
  • bug 568827 nsXPCWrappedJSClass::DelegatedQueryInterface(nsXPCWrappedJS*, nsID const&, void**)
  • bug 1038220 crash in mozilla::jsipc::JavaScriptParent::IsCPOW(JSObject*)
• _VEC_memzero is virtually gone again after fixing gfx/D2D blocklist.
• Oddly the explosiveness report shows mozilla::net::CacheFileIOManager::OnProfile() as a new signature that's "explosive" but I only see one crash reported
• bug 984033 is #6 yesterday and rising across channels, mostly correlated to Crossrider framework add-ons, but we need to get our patch landed for 32 at least.

Trunk

Start up crashing is a little high. Getting traction on the follow would help significantly:

• bug 1028902 - crash in js::GetLengthProperty(JS::Value const&, JS::MutableHandle<JS::Value>)
• (potentially same as above) bug 1028904 - crash in js::StringObject::setStringThis(JSString*)

B2G

Potential Uplift bugs

• bug 1034294 - Fix SharedBufferManagerParent
  • could be the root cause of bug 1031527
  • need to investigate bug 1034294 cafbot is reporting crashes still occurring. Need to make sure that the patch is in the build.
• bug 1032266 - ALSA crash in AudioStream::Shutdown when seeking during playback
  • 1.4 uplift; need a aurora version.

Partner Issues

• bug 1020956 - [Flame][RTSP][V2.0] The kernel crash happened if RTSP streaming is interrupted several times by incoming call
  • waiting for partner
• bug 1025414 - wifi_start_supplicant crashes
  • fix landed in vendor repo
• bug 1019987 - FX OS crash in sensors.msm8610.so@0x9f02 while using Yepi app
  • closed off as WFM.
• bug 1000271 - [Camera][Gecko][Tarako] Semi-auto camera test causes tarako camera to crash
  • closed WFM; following up with reporter

New Feature Crashes

Loop

• bug 1022058 - crash in sigslot::lock_block<sigslot::single_threaded>::lock_block(sigslot::single_threaded*)
  • dev looked at; needs patch
• bug 1009922 - [Open C] crash in __pthread_cond_pulse
  • dev looked atl needs patch
• bug 1021451 - WebRTC Chat between FFOS and Desktop Computer Resulted in Graphics Crash - mozalloc_abort(char const*) | NS_DebugBreak | mozilla::ipc::FatalError(char const*, char const*, int, bool) | mozilla::layers::PSharedBufferManagerChild::SendAllocateGrallocBuffer
  • might be fixed by bug 1034294

2.1 : Gecko 33a1

• bug 1035286 - crash in mozalloc_abort(char const*) | abort | js::jit::BacktrackingAllocator::splitAcrossCalls(js::jit::LiveInterval*)
• bug 1035249 - crash in jemalloc_crash | arena_dalloc | je_free | free | js::detail::HashTable<JS::Symbol* const, js::HashSet<JS::Symbol*, js::HashSymbolsByDescription, js::SystemAllocPolicy>::SetOps, js::SystemAllocPolicy>::changeTableSize(int)
• bug 1026631 - crash in jemalloc_crash | arena_salloc | je_realloc | realloc | moz_xrealloc | nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::EnsureCapacity(unsigned int, unsigned int) | nsObserverList::AddObserver(nsIObserver*, bool)
  • memory corruption; startup crashes; a couple on nightly
• bug 1026655 - crash in jemalloc_crash | arena_dalloc | je_free | free | moz_free | XPCNativeInterface::DestroyInstance(XPCNativeInterface*)
  • need dev input
• bug 1026672 - crash in jemalloc_crash | arena_dalloc | je_free | free | js::Shape::sweep()
  • need dev input
• bug 1025975 - crash in mozilla::layers::CompositorChild::SharedFrameMetricsData::GetViewID()
  • need better STR

2.0, the version formerly known as 1.5 : gecko 32a2

• bug 1029710 - crash in mozilla::dom::ShadowRoot::IsPooledNode(nsIContent*, nsIContent*, nsIContent*)
  • need dev input
• bug 1029938 - flame v2.0 periodically crashes after OTA update around June 26
  • need STR; more info from reporter
• bug 1026011 - crash in android::BpAudioPolicyService::initStreamVolume(audio_stream_type_t, int, int)
  • need str
• bug 1030803 - crash in @0x0 | MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&)
  • need dev input.

1.4 : Gecko 30.0

• bug 1019422 - [Flame][V1.4][System]Device Crashed after MT a call when playing a video
  • marked as dup of bug 1035755
• bug 1025312 - Crash in NetworkWorker::~NetworkWorker while stability testing
• bug 1008791 - Crash in stability test [@ ? | pthread_kill | raise | __libc_android_abort | ... | js::BaseProxyHandler::get(JSContext*, JS::Handle, JS::Handle, JS::Handle, JS::MutableHandleJS::Value) ]
  • closed as WFM.
• bug 1038037 - [dolphin][flame] b2g crash when open some streaming audio from browser
• bug 1035755 - [V1.4][Camera][Dolphin] Repeatedly tap video record button causes app crash
• bug 1035531 - Failed CHECK in GonkCameraSource::dataCallbackTimestamp() while stability testing

1.3/1.3T : Gecko 28.0/28.1

• bug 1007019 - [tarako] Facebook crashes whenever trying to upload a photo
  • facebook making UA change; OAUTH is not supported on lo-fi version ( bug 1033195 )
• bug 1031224 - shut down phone, and the b2g crash
• bug 1033966 - [Sora][FOTA] after FOTA updates,the system crash
  • being investigated
• bug 1034409 is a follow up crash
  • being investigated

2.1 Geeksphone

• bug 1016497 - crash in mozilla::layers::TextureClient::WaitForCompositorRecycle() | mozilla::layers::SimpleTextureClientPool::WaitForCompositorRecycleCallback(mozilla::layers::TextureClient*, void*) | mozilla::RefPtr<mozilla::layers::BufferTextureClient>::~RefPtr
  • need to disable SimpleTexture, vendor issue; can't seem to reproduce?
• bug 1032245 - crash in mozilla::layers::TextureClient::WaitForCompositorRecycle() | mozilla::layers::SimpleTextureClientPool::WaitForCompositorRecycleCallback(mozilla::layers::TextureClient*, void*) | mozilla::AtomicRefCountedWithFinalize..
  • need to disable SimpleTexture; can't seem to reproduce?
• [NEW] bug 1038229 - crash in mozilla::MediaEngine::Release()
• [NEW] bug 1038235 - crash in _cairo_surface_get_extents
• [NEW] bug 1038253 - crash in mozilla::CrossProcessMutex::CrossProcessMutex

Notes

Upcoming PTO

• juanb - July 18/21
• bsmedberg - July 21-Aug 4
• KaiRo - July 18

Action Items

• [KaiRo] Loop back to Socorro on Signature Summary not being up to date - covered in bug 1038234
• [KaiRo] finish up discussion with relman on prerequisites in approval questionnaire