Skip to content

[Android 9] AImageReader video playback crash #814

New issue
New issue
Closed
Closed
[Android 9] AImageReader video playback crash#814
Labels
bugupstreambugs which are identified in upstream Chromium

Description

@Namit-Nayan
Namit-Nayan
opened on Nov 20, 2020

Bromite version

Version: 87.0.4280.67
Arch: arm64
Android version: 9.0(Lineage OS 16)
Device model: Asus-X00TD

Is this bug about the SystemWebView?

No

Is the bug reproducible with latest version?

Yes

Can the bug be reproduced with corresponding Chromium version?

Yes

Describe the bug

Can't play some YouTube videos. And bromite keeps stopping popup on every video page.

Steps to reproduce the bug

Steps to reproduce the bug:

  1. Go to https://m.youtube.com/watch?v=Pvv_yfoEvcM
  2. You will see a popup bromite keeps stopping , the browser is still running, though the page reloads (or it seems to).
  3. Try to play the video
  4. Video won't play. (Some other videos played, 2. Point happened there too)
    (I guessed this is due to autoplay blocking, but when I tried to toggle that setting, it is stuck on blocked) Also later found it to be reproducible on latest chromium version.

Expected behavior

Video plays and no bromite keeps stopping popup.

Screenshots

Screenshot_20201120-095359_Bromite

Screenshot_20201120-095412_Bromite

Activity

  1. uazo commented on Nov 20, 2020

    @uazo
    uazo
    on Nov 20, 2020
    Collaborator

    bug confirmed, here its tombstone
    https://gist.github.com/uazo/471e19b4785b04be8646937370e6a9e3

  2. uazo commented on Nov 20, 2020

    @uazo
    uazo
    on Nov 20, 2020
    Collaborator

    other info

    11-20 08:11:57.133  2777  2816 W VideoCapabilities: Unrecognized profile/level 0/0 for video/mpeg2
11-20 08:11:57.133  2777  2816 W VideoCapabilities: Unrecognized profile/level 0/2 for video/mpeg2
11-20 08:11:57.133  2777  2816 W VideoCapabilities: Unrecognized profile/level 0/3 for video/mpeg2
11-20 08:11:57.136  2777  2816 W VideoCapabilities: Unrecognized profile/level 32768/2 for video/mp4v-es
11-20 08:11:57.154  2777  2816 W VideoCapabilities: Unrecognized profile/level 1/32 for video/mp4v-es
11-20 08:11:57.154  2777  2816 I VideoCapabilities: Unsupported profile 16384 for video/mp4v-es
11-20 08:11:57.154  2777  2816 I VideoCapabilities: Unsupported profile 16384 for video/mp4v-es
11-20 08:11:57.163  2777  2816 I VideoCapabilities: Unsupported profile 4 for video/mp4v-es
11-20 08:11:57.173  2777  2816 W cr_MediaCodecUtil: HW encoder for video/avc is not available on this device.

11-20 08:10:13.081  2577  2742 I app_process64: frameworks/av/media/ndk/NdkImageReader.cpp:238:13: runtime error: control flow integrity check for type 'void (void *, AImageReader *)' failed during indirect function call
11-20 08:10:13.081  2577  2742 I app_process64:
11-20 08:10:13.085  2577  2597 D NdkImageReader: acquireImageLocked: Overriding buffer format YUV_420_888 to 0x300.
11-20 08:10:13.139  2577  2742 I app_process64: (/data/app/org.chromium.chrome.stable-7gyJ7xQDm3QLarRXDrI5VQ==/base.apk+0x9590200): note: (unknown) defined here
11-20 08:10:13.139  2577  2742 I app_process64:
11-20 08:10:13.287  2577  2742 F libc    : Fatal signal 6 (SIGABRT), code -6 (SI_TKILL) in tid 2742 (ImageReader-1x1), pid 2577 (ileged_process0)
11-20 08:10:13.287  2754  2754 E chromium: [1120/081013.286528:ERROR:socket.cc(182)] incorrect payload size 0
11-20 08:10:13.355  2758  2758 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstone

    Crash is here
    frameworks/av/media/ndk/NdkImageReader.cpp:238:13: runtime error: control flow integrity check for type 'void (void *, AImageReader *)

  3. uazo commented on Nov 20, 2020

    @uazo
    uazo
    on Nov 20, 2020
    Collaborator

    maybe related

    #445
    https://groups.google.com/a/chromium.org/g/chromium-dev/c/EbaVVYVaSA8/m/9Hnc-4w_CAAJ
    https://bugs.chromium.org/p/chromium/issues/detail?id=977583
    GrapheneOS/platform_frameworks_av@7f7b234

  4. oiao commented on Nov 20, 2020

    @oiao
    oiao
    on Nov 20, 2020

    I can confirm the same behavior as in #455 after the update to v87. Was working fine in v86

  5. csagan5 commented on Nov 20, 2020

    @csagan5
    csagan5
    on Nov 20, 2020
    Contributor

    The last time we ran tests for this issue was in #755; unfortunately it is a recurring issue.

  6. csagan5
    changed the title [-]YouTube video playback[/-] [+]AImageReader video playback crash[/+] on Nov 20, 2020
  7. csagan5
    pinned this issue on Nov 20, 2020
  8. csagan5
    added
    upstreambugs which are identified in upstream Chromium
    on Nov 20, 2020

  9. csagan5 commented on Nov 20, 2020

    @csagan5
    csagan5
    on Nov 20, 2020
    Contributor

    Can the bug be reproduced with corresponding Chromium version?

    Yes

    This is not a bug in Bromite; it is a bug in Chromium. We have introduced patches in the past to counteract it, they seem to not be effective anymore.

    @uazo @oiao please report your Android version, device model and the version you installed (arm or arm64).

    @uazo the problem is that chrome://gpu should contain disable_aimagereader, will check why that is not happening, might be easy to fix.

  10. csagan5 commented on Nov 20, 2020

    @csagan5
    csagan5
    on Nov 20, 2020
    Contributor

    This bug was extensively discussed in #445; @uazo if you wonder, the patch is this: https://github.com/bromite/bromite/blob/87.0.4280.67/build/patches/Restore-GPU-bug-blacklist-for-AImageReader-on-ARM-CPUs.patch
    The patch is limited to ARM GL vendor but now the bug is reproducible with other vendors as well.

    Until a new version of Bromite is released with the fix everybody can go to chrome://flags and disable AImageReader manually. This crash affects only Android 9 and ARM64, as far as I am aware.

    If we get enough reports about the model we can adjust the patch accordingly.

  11. csagan5
    changed the title [-]AImageReader video playback crash[/-] [+][Android 9] AImageReader video playback crash[/+] on Nov 20, 2020

  12. uazo commented on Nov 21, 2020

    @uazo
    uazo
    on Nov 21, 2020
    Collaborator

    please report your Android version, device model and the version you installed (arm or arm64).

    'HUAWEI/BLA-L29/HWBLA:8.0.0/HUAWEIBLA-L29S/137(C432):user/release-keys'
    hw is a BLN-L22, arm64, Android 9, but it's a custom build I used only for tests.
    In my Android 10 (Lineage 17.1) works perfectly.

    The patch is limited to ARM GL vendor but now the bug is reproducible with other vendors as well.

    I was trying to understand why.
    the error entry point is this:

    https://source.chromium.org/chromium/chromium/src/+/master:gpu/command_buffer/service/image_reader_gl_owner.cc;l=175

    among other things, putting it as a comment everything works perfectly but I don't understand why. some idea?

    do you know how the CFI works? can i imagine the problem could be a race-condition that makes this (https://cs.android.com/android/_/android/platform/frameworks/av/+/e2eba97ec5b0bdeb128eaed3dac00bbaca2ff56e:media/ndk/NdkImageReader.cpp;l=252;bpv=1;bpt=0) point to a null pointer? or maybe listener_ is it released before releasing that pointer?

    EDIT: ah, I've tried also this https://chromium-review.googlesource.com/c/chromium/src/+/2537782 but it doesn't seem to me to solve it, the only thing they solve is to comment on that line

  13. h3ndrik commented on Nov 21, 2020

    @h3ndrik
    h3ndrik
    on Nov 21, 2020

    Android Version: 9 (crDroid 5.12)
    Model: ZTE A2017X
    Version: arm64
    also affected. Disabling AImageReader in chrome://flags works.

  14. csagan5 commented on Nov 21, 2020

    @csagan5
    csagan5
    on Nov 21, 2020
    Contributor

    I was trying to understand why.
    the error entry point is this:

    https://source.chromium.org/chromium/chromium/src/+/master:gpu/command_buffer/service/image_reader_gl_owner.cc;l=175

    among other things, putting it as a comment everything works perfectly but I don't understand why. some idea?

    do you know how the CFI works? can i imagine the problem could be a race-condition that makes this (https://cs.android.com/android/_/android/platform/frameworks/av/+/e2eba97ec5b0bdeb128eaed3dac00bbaca2ff56e:media/ndk/NdkImageReader.cpp;l=252;bpv=1;bpt=0) point to a null pointer? or maybe listener_ is it released before releasing that pointer?

    EDIT: ah, I've tried also this https://chromium-review.googlesource.com/c/chromium/src/+/2537782 but it doesn't seem to me to solve it, the only thing they solve is to comment on that line

    @uazo see this comment on the upstream issue (by @thestinger); we have discussed it in the past, see his explanation here.

    How it works: call paths are tagged by the compiler and then verified at runtime for integrity; the code you linked is about dynamic loading, never a pretty business.

    Why it is now happening for Qualcomm chipsets on Android 9: I do not know, my guess is that something changed in Android 9 itself and now AImageReader hits the faulty paths.

    The solution is to disable AImageReader for Qualcomm as well, I will release a fixed version later; I wonder if other chipsets are affected too.

  15. uazo commented on Nov 21, 2020

    @uazo
    uazo
    on Nov 21, 2020
    Collaborator

    @thestinger said

    but we haven't yet identified the function being called and how it violates CFI. It's a bit painful with how it crosses the boundaries of these programs

    So, the function is here https://source.chromium.org/chromium/chromium/src/+/master:gpu/command_buffer/service/image_reader_gl_owner.cc;l=175
    sure enough because taking it off works, and among other things, I still have to understand why everything works anyway.

    the code you linked is about dynamic loading, never a pretty business.

    out of pure curiosity I try to understand something about CFI and see if it can be solved outside of aosp

    my guess is that something changed in Android 9 itself and now AImageReader hits the faulty paths.

    so i guess there is no sw that can use that library, at least as dynamic loading. possible?

    The solution is to disable AImageReader for Qualcomm as well, I will release a fixed version later; I wonder if other chipsets are affected too.

    Ok so you're disabling accelerated video decode, for those gpu's, right?

  16. 22 remaining items

  17. Me0wzz commented on Mar 29, 2021

    @Me0wzz
    Me0wzz
    on Mar 29, 2021

    My Device is SM-N950N(Exynos8895) running ARM64 Android 9. If I don't change the flag's value, Browser doesn't play video and it crashes. I tested from v88.0.4324.207 to v89.0.4389.100 but, all of them showed same issue.

  18. chirayudesai
    added a commit that references this issue on Jan 19, 2023

    AImageReader CFI crash mitigations

    ed8f2db
  19. calyxos-gerrit
    added 3 commits that reference this issue on Mar 7, 2023

    AImageReader CFI crash mitigations

    9ef6c5e

    AImageReader CFI crash mitigations

    d9e8c68

    AImageReader CFI crash mitigations

    fe30a87
  20. calyxos-gerrit
    added a commit that references this issue on Mar 31, 2023

    AImageReader CFI crash mitigations

    81d85e1
  21. calyxos-gerrit
    added a commit that references this issue on May 1, 2023

    AImageReader CFI crash mitigations

    3c7f37b
  22. calyxos-gerrit
    added 2 commits that reference this issue on May 29, 2023

    AImageReader CFI crash mitigations

    d11a36f

    AImageReader CFI crash mitigations

    b111493
  23. calyxos-gerrit
    added a commit that references this issue on Jul 14, 2023

    AImageReader CFI crash mitigations

    c948cde
  24. calyxos-gerrit
    added a commit that references this issue on Sep 12, 2023

    AImageReader CFI crash mitigations

    1deda42
  25. calyxos-gerrit
    added a commit that references this issue on Oct 11, 2023

    AImageReader CFI crash mitigations

    08b8f72
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugupstreambugs which are identified in upstream Chromium

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions