Snowball: Browser crashes observed when browsing across webpages

[Abhishek Paliwal]

Description:
==========
On Snowball build:
https://android-build.linaro.org/builds/~linaro-android/snowball-ics-gcc46-igloo-stable-blob/#build=266

After visiting few webpages - browser crash is observed.

Reproducible:
===========
Yes, 5/5 time

IMPACT:
========
Bad browsing experience.

Steps:
==========
1. Bootup snowball
2. Open Browser app
3. Browse pages - like google news/ google maps/google images/back to google news
Issue: Browser crashes after around 5 minutes of usage

Hardware:
==========
Snowball V11

Software:
=======
https://android-build.linaro.org/builds/~linaro-android/snowball-ics-gcc46-igloo-stable-blob/#build=266
sd card image.

Logs:
=====
Bootup , dmesg ,logcat attached.

[Sunil Kamath (sunil-kamath)]

Abhishek,
You are using WLAN or ethernet connectivity for browsing here?

[Abhishek Paliwal (abhishek-paliwal)]

Sunil: I tested this over Ethernet

[Jayeeta Bandyopadhyay (jayeeta)]

Anmar can you pls check if someone from Linaro can support for this issue?

[Iniyan Charles (iniyan-a)]

This is an application crash that is not related to kernel as it does not crash the entire system, but only android and it reboots again. I have checked this issue exists in the build https://android-build.linaro.org/builds/~linaro-android/snowball-ics-gcc46-igloo-stable-blob/#build=418 , though the crash seems to occur in a different libs.

This is what I did: I opened google using an ethernet connection, and using input text , tried to search for a string, but I could not select using the mouse from the list of suggestions that google gave and the crash occurred. Attaching the logs.

I suspected if the memory was full, but after the crash- android reboot sequence, I found internal memory was 400MB + , from settings -> storage. Perhaps the crash may be because of memory corruption or accessing a read-only /resticted area

[Ramesh Chandrasekaran (ramesh-chandrasekaran)]

From the logs posted by iniyan, this seems to crash at the android userspace and no issues with the kernel side. Should be re-assigned to appropriate team.

[Iniyan Charles (iniyan-a)]

I have been checking on this today,so I will update on that..Downloaded the latest Linaro 4.0.4 code yesterday and built and reproduced the issue today. Found a crash in system_server also today (a404_crash1.log) apart from the browser crash. I tried to locate the crash in the code using arm-linux-androideabi-addr2line and ndk-stack, the system_server seems to crash at dalvik/vm/mterp/out/InterpAsm-armv7-a-neon.S:7460 , which is a generated file generated by dalvik/vm/mterp/gen-mterp.py .

I was also checking on the web, and found this to be a issue on panda, vexpress,omap etc apart from snowball.
A bug already exists for a similar issue (https://bugs.launchpad.net/linaro-android/+bug/978060) , for which a patch has been promised. The discussion centered around the issue being in JIT code and a workaround is by disabling jit, as in #16 of https://bugs.launchpad.net/linaro-android/+bug/978060 .

[Iniyan Charles (iniyan-a)]

According to another similar issue https://bugs.launchpad.net/linaro-android/+bug/978060 , ARM has given a patch, which I have taken. But the browser crash is still coming, reproducible ¾ times, though I have not got the system_server crash till now. But unlike before all the 3 crashes occur in the same place.

android-ndk-r8b$ ndk-stack -sym /data/cmstore30/iniyanca/a4.0.4/out/target/product/snowball/symbols/system/lib/ -dump ~/brw3.log
********** Crash dump: **********
Build fingerprint: 'snowball/snowball/snowball:4.0.4/IMM76L/eng.iniyanca.20120928.121353:eng/test-keys'
pid: 2160, tid: 2160 >>> com.android.browser <<<
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr bbadbeef
Stack frame #00 pc 003ee1aa /system/lib/libwebcore.so: Routine crashIfOOM in external/webkit/Source/WebCore/platform/graphics/android/GLUtils.cpp:142
Stack frame #01 pc 003882d2 /system/lib/libwebcore.so: Routine drawLayerQuad in external/webkit/Source/WebCore/platform/graphics/android/ShaderProgram.cpp:612

Patch applied: http://review.android.git.linaro.org/2758

[Iniyan Charles (iniyan-a)]

Adding the logs for comment #10

[vishal (vishalbhoj)]

snowball is no more supported.