Skip to content
This repository has been archived by the owner on Aug 8, 2023. It is now read-only.

Crash rendering the map — mbgl::FillBucket::drawElements, glrAGXRenderVertexArray #5731

Closed
MikeKasperlik opened this issue Jul 20, 2016 · 42 comments
Labels
Core The cross-platform C++ core, aka mbgl crash iOS Mapbox Maps SDK for iOS
Milestone

Comments

@MikeKasperlik
Copy link

MikeKasperlik commented Jul 20, 2016

Platform: iOS
Mapbox SDK version: 3.3.1

We see a high crash rate for this on fabric.

I can't reproduce this crash but it happens randomly when the app is in foreground and doing something with the map.

We use a custom style & draw a single polyline on the map

Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x181e5a2a0 _platform_memmove + 176
1  AGXGLDriver                    0x193d93f6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
2  AGXGLDriver                    0x193d93f6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
3  GLEngine                       0x194b36ea4 glDrawElements_ACC_ES2Exec
4  Mapbox                         0x1017739e4 mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) + 284
5  Mapbox                         0x10177dd7c mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) + 3852
6  Mapbox                         0x10177abb0 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) + 688
7  Mapbox                         0x10177a244 mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 1424
8  Mapbox                         0x1017682ac mbgl::Map::Impl::render() + 160
9  Mapbox                         0x10176811c mbgl::Map::render() + 128
10 Mapbox                         0x1016ec2a8 -[MGLMapView glkView:drawInRect:] + 48
11 GLKit                          0x18a89136c -[GLKView _display:] + 332
12 Mapbox                         0x1016eca44 -[MGLMapView updateFromDisplayLink] + 68
13 QuartzCore                     0x184d38234 CA::Display::DisplayLinkItem::dispatch() + 40
14 QuartzCore                     0x184d380e8 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 424
15 IOKit                          0x182475e54 IODispatchCalloutFromCFMessage + 372
16 CoreFoundation                 0x18219d030 __CFMachPortPerform + 180
17 CoreFoundation                 0x1821b57d4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
18 CoreFoundation                 0x1821b4f0c __CFRunLoopDoSource1 + 436
19 CoreFoundation                 0x1821b2c64 __CFRunLoopRun + 1800
20 CoreFoundation                 0x1820dcc50 CFRunLoopRunSpecific + 384
21 GraphicsServices               0x1839c4088 GSEventRunModal + 180
22 UIKit                          0x1873c6088 UIApplicationMain + 204
23 PACEApp                        0x1001b9ba8 main (AppDelegate.swift:27)
24 libdispatch.dylib              0x181c7a8b8 (Missing)

Other Threads:

DefaultFileSource
0  libsystem_kernel.dylib         0x181d7cfd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x181d7ce54 mach_msg + 72
2  CoreFoundation                 0x1821b4c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1821b2964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x1820dcc50 CFRunLoopRunSpecific + 384
5  CoreFoundation                 0x18212a3a4 CFRunLoopRun + 112
6  Mapbox                         0x10181b438 void mbgl::util::Thread<mbgl::DefaultFileSource::Impl>::run<std::__1::tuple<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned long long&>, 0ul, 1ul>(std::__1::tuple<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned long long&>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 156
7  Mapbox                         0x10181b358 std::__1::__thread_proxy<std::__1::tuple<mbgl::util::Thread<mbgl::DefaultFileSource::Impl>::Thread<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, unsigned long long&>(mbgl::util::ThreadContext const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&&&, unsigned long long&&&)::'lambda'()> >(void*, void*) + 136
8  libsystem_pthread.dylib        0x181e63b28 _pthread_body + 156
9  libsystem_pthread.dylib        0x181e63a8c _pthread_body + 154
10 libsystem_pthread.dylib        0x181e61028 thread_start + 4
AssetFileSource
0  libsystem_kernel.dylib         0x181d7cfd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x181d7ce54 mach_msg + 72
2  CoreFoundation                 0x1821b4c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1821b2964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x1820dcc50 CFRunLoopRunSpecific + 384
5  CoreFoundation                 0x18212a3a4 CFRunLoopRun + 112
6  Mapbox                         0x101816150 void mbgl::util::Thread<mbgl::AssetFileSource::Impl>::run<std::__1::tuple<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>, 0ul>(std::__1::tuple<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>&&, std::__1::integer_sequence<unsigned long, 0ul>) + 104
7  Mapbox                         0x1018160a4 std::__1::__thread_proxy<std::__1::tuple<mbgl::util::Thread<mbgl::AssetFileSource::Impl>::Thread<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&>(mbgl::util::ThreadContext const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&&&)::'lambda'()> >(void*, void*) + 136
8  libsystem_pthread.dylib        0x181e63b28 _pthread_body + 156
9  libsystem_pthread.dylib        0x181e63a8c _pthread_body + 154
10 libsystem_pthread.dylib        0x181e61028 thread_start + 4

And a lot of worker threads that all look the same

Worker
0  libsystem_kernel.dylib         0x181d7cfd8 mach_msg_trap + 8
1  libsystem_kernel.dylib         0x181d7ce54 mach_msg + 72
2  CoreFoundation                 0x1821b4c60 __CFRunLoopServiceMachPort + 196
3  CoreFoundation                 0x1821b2964 __CFRunLoopRun + 1032
4  CoreFoundation                 0x1820dcc50 CFRunLoopRunSpecific + 384
5  CoreFoundation                 0x18212a3a4 CFRunLoopRun + 112
6  Mapbox                         0x10180c924 void mbgl::util::Thread<mbgl::Worker::Impl>::run<std::__1::tuple<> >(std::__1::tuple<>&&, std::__1::integer_sequence<unsigned long>) + 88
7  Mapbox                         0x10180c888 std::__1::__thread_proxy<std::__1::tuple<mbgl::util::Thread<mbgl::Worker::Impl>::Thread<>(mbgl::util::ThreadContext const&)::'lambda'()> >(void*, void*) + 136
8  libsystem_pthread.dylib        0x181e63b28 _pthread_body + 156
9  libsystem_pthread.dylib        0x181e63a8c _pthread_body + 154
10 libsystem_pthread.dylib        0x181e61028 thread_start + 4
@1ec5 1ec5 added iOS Mapbox Maps SDK for iOS crash labels Jul 20, 2016
@1ec5
Copy link
Contributor

1ec5 commented Jul 23, 2016

We’ve seen some reports of this exact crash as well, on iOS 9.2.1 on an iPhone 6, several minutes after launch. It looks vaguely similar to #1792. From your crash logs, are you able to tell whether the application is in the foreground, background, or background mode? Never mind, you said foreground already.

@1ec5 1ec5 changed the title Crash in AGXGLDriver Crash rendering the map — mbgl::FillBucket::drawElements, glrAGXRenderVertexArray Jul 23, 2016
@1ec5 1ec5 added the Core The cross-platform C++ core, aka mbgl label Jul 23, 2016
@1ec5
Copy link
Contributor

1ec5 commented Jul 23, 2016

Also, does anything appear in the console around the time of the crash, as suggested in this Apple Developer Forums thread?

/cc @kkaefer @brunoabinader @jfirebaugh

@1ec5 1ec5 added this to the ios-v3.4.0 milestone Jul 23, 2016
@1ec5
Copy link
Contributor

1ec5 commented Jul 27, 2016

Based on other reports we’ve received, as well as some automated reports via an internal testing tool, this issue appears to be triggered or exacerbated by continuous animation of the viewport for long stretches of time. Does that describe your situation, @MikeKasperlik?

@MikeKasperlik
Copy link
Author

We animate the viewport, but not for a long time. Based on what the user does, it can happen that the viewport gets animated often, but that are separate animations. I checked the logs and in some cases we do had similar entries as described in the developer thread.

@incanus
Copy link
Contributor

incanus commented Aug 22, 2016

@MikeKasperlik Any chance you can share a minimal piece of code that triggers (always or frequently) this problem? Going to start looking into this.

@incanus incanus self-assigned this Aug 22, 2016
@incanus
Copy link
Contributor

incanus commented Aug 22, 2016

Going to try to repro myself and investigate.

@incanus
Copy link
Contributor

incanus commented Aug 22, 2016

Also @MikeKasperlik more info welcome on device and/or version. Haven't documented this on devices newer than iPhone 6 or iOS later than 9.2.1 yet.

@1ec5
Copy link
Contributor

1ec5 commented Aug 22, 2016

Actually, we’re seeing some reports internally of similar crashes on iOS 9.3.3 on iPhone 6 Plus.

@MikeKasperlik
Copy link
Author

@incanus I can't say whats triggering this unfortunately. I do can provide you some more information:

Device stats:

iPhone 6 - 53%
iPhone 6 Plus -31%
iPhone 6s - 12%
Other… - 4%

Operating system:

9.3.3 - 69%
9.3.4 - 31%

Device status:

App in-focus - 100%

What's strange about this is, that we received quite a lot crashes until August 18th. Since then not a single crash without updating our app - maybe something with the delivered tiles ?

@incanus
Copy link
Contributor

incanus commented Aug 23, 2016

Trying varying things (mostly a modified "world tour" functionality) to repro this, but no luck yet.

@incanus
Copy link
Contributor

incanus commented Aug 23, 2016

I've been running through this using a database of 1,250 of the world's largest cities and a zoom level appropriate for heavy fill drawing, but still no luck reproducing. @MikeKasperlik any way you can provide more info on at least one crash location (geographically) so that I can get an idea of what might be drawing when this occurs?

@incanus
Copy link
Contributor

incanus commented Aug 24, 2016

Possible lead: https://forums.developer.apple.com/thread/9589

@MikeKasperlik
Copy link
Author

I have no records of the exact crash locations, but most of them happened in Germany (I think that's because most of our users are located there). The most recent crash was somewhere around here:

Lat: 24.710763931274414, Lon: 59.42807388305664

@alexeyismirnov
Copy link

alexeyismirnov commented Aug 30, 2016

I just had same kind of crash in my app! Device: iPad mini 2, iOS 9.3.4.
Mapbox SDK: 3.3.3

Location: http://www.openstreetmap.org/#map=16/24.8033/121.0368

@incanus
Copy link
Contributor

incanus commented Aug 30, 2016

Really not getting anywhere on repro of this, but still working on it.

@yarry
Copy link

yarry commented Sep 3, 2016

Probably same crash
Mapbox 3.3.4, iOS 9.3.4, iPad 4
Soon after memory warning.
Location somewhere near 55.74,37.60 zoom 17-18

Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x2422a9a0 _platform_memmove + 159
1  IMGSGX554GLDriver              0x33c1d9cf (Missing)
2  GLEngine                       0x3418de51 glDrawElements_ACC_ES2Exec
3  OpenGLES                       0x262b3e13 glDrawElements + 38
4  Mapbox                         0x1a1c703 mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) (memory:2693)
5  Mapbox                         0x1a26ad3 mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) (painter_fill.cpp:176)
6  Mapbox                         0x1a24259 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) (painter.cpp:272)
7  Mapbox                         0x1a2372b mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) (vector:1472)
8  Mapbox                         0x1a0f06d mbgl::Map::Impl::render() (map.cpp:267)
9  Mapbox                         0x1a0edff mbgl::Map::render() (memory:2693)
10 Mapbox                         0x198a75f -[MGLMapView glkView:drawInRect:] (MGLMapView.mm:859)
11 GLKit                          0x2bb2454f -[GLKView _display:] + 278
12 Mapbox                         0x198b0fd -[MGLMapView updateFromDisplayLink] (MGLMapView.mm:984)
13 QuartzCore                     0x26b909a7 CA::Display::DisplayLinkItem::dispatch() + 106
14 QuartzCore                     0x26b907f7 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 594
15 IOMobileFramebuffer            0x2626f513 IOMobileFramebufferVsyncNotifyFunc + 86
16 IOKit                          0x2474f5e5 IODispatchCalloutFromCFMessage + 256
17 CoreFoundation                 0x244abe8d __CFMachPortPerform + 132
18 CoreFoundation                 0x244c019b __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 34
19 CoreFoundation                 0x244bf8af __CFRunLoopDoSource1 + 342
20 CoreFoundation                 0x244bdcc1 __CFRunLoopRun + 1704
21 CoreFoundation                 0x2440c1c9 CFRunLoopRunSpecific + 516
22 CoreFoundation                 0x2440bfbd CFRunLoopRunInMode + 108
23 GraphicsServices               0x25a28af9 GSEventRunModal + 160
24 UIKit                          0x28b3f435 UIApplicationMain + 144
25 AzboAudioTour                  0x1c4077 main (main.m:18)
26 libdispatch.dylib              0x240b8873 (Missing)

@bloemy7
Copy link

bloemy7 commented Sep 14, 2016

I'm having more and more MapBox related crashes...recently:
mbgl::gl::ObjectStore::performCleanup()

With the thread:

Crashed: com.apple.main-thread
0  libGPUSupportMercury.dylib     0x18fe6df28 gpus_ReturnGuiltyForHardwareRestart
1  libGPUSupportMercury.dylib     0x18fe6eec4 gpusSubmitDataBuffers
2  GLEngine                       0x194178dc4 gleUnbindBufferObject
3  GLEngine                       0x19418789c gleUnbindDeleteHashNameAndObject
4  GLEngine                       0x194121b18 glDeleteBuffers_Exec
5  infinight                      0x100396ac0 mbgl::gl::ObjectStore::performCleanup()
6  infinight                      0x100397cb4 mbgl::Map::Impl::render()
7  infinight                      0x100397a94 mbgl::Map::render()
8  infinight                      0x100336a70 -[MGLMapView glkView:drawInRect:]
9  GLKit                          0x189f4536c -[GLKView _display:]
10 infinight                      0x10033720c -[MGLMapView updateFromDisplayLink]
11 QuartzCore                     0x1843e422c CA::Display::DisplayLinkItem::dispatch()
12 QuartzCore                     0x1843e40e0 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long)
13 IOKit                          0x181b21e54 IODispatchCalloutFromCFMessage
14 CoreFoundation                 0x181849030 __CFMachPortPerform
15 CoreFoundation                 0x1818617d4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__
16 CoreFoundation                 0x181860f0c __CFRunLoopDoSource1
17 CoreFoundation                 0x18185ec64 __CFRunLoopRun
18 CoreFoundation                 0x181788c50 CFRunLoopRunSpecific
19 GraphicsServices               0x183070088 GSEventRunModal
20 UIKit                          0x186a76088 UIApplicationMain
21 infinight                      0x100197b04 main (main.m:16)
22 libdispatch.dylib              0x1813268b8 (Missing)

And mbgl::FrameHistory::upload(mbgl::gl::ObjectStore&)

With the thread:

Crashed: com.apple.main-thread
0  libGPUSupportMercury.dylib     0x2ec702fa gpus_ReturnGuiltyForHardwareRestart
1  libGPUSupportMercury.dylib     0x2ec70dc7 gpusSubmitDataBuffers
2  IMGSGX543GLDriver              0x319ddfd3 glrFinishContextResource
3  IMGSGX543GLDriver              0x319ea69b glrWriteTextureData
4  GLEngine                       0x31f2b92b glTexSubImage2D_Exec
5  OpenGLES                       0x241ae705 glTexSubImage2D + 68
6  infinight                      0x2db801 mbgl::FrameHistory::upload(mbgl::gl::ObjectStore&) + 2869249
7  infinight                      0x2de8fb mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 2881787
8  infinight                      0x2cf449 mbgl::Map::Impl::render() + 2819145
9  infinight                      0x2cf2d1 mbgl::Map::render() + 2818769
10 infinight                      0x266323 -[MGLMapView glkView:drawInRect:] + 2388771
11 GLKit                          0x299b5523 -[GLKView _display:] + 278
12 infinight                      0x266cc9 -[MGLMapView updateFromDisplayLink] + 2391241
13 infinight                      0x266feb -[MGLMapView validateDisplayLink] + 2392043
14 infinight                      0x26708f -[MGLMapView didMoveToWindow] + 2392207
15 UIKit                          0x2698f289 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 1520
16 UIKit                          0x2698ef97 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 766
17 UIKit                          0x2698ef97 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 766
18 UIKit                          0x2698ef97 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 766
19 UIKit                          0x2698ef97 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 766
20 UIKit                          0x269b3fa1 -[UIScrollView _didMoveFromWindow:toWindow:] + 68
21 UIKit                          0x2698ef97 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 766
22 UIKit                          0x2698ef97 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 766
23 UIKit                          0x2698e6e9 __45-[UIView(Hierarchy) _postMovedFromSuperview:]_block_invoke + 124
24 UIKit                          0x2698e597 -[UIView(Hierarchy) _postMovedFromSuperview:] + 426
25 UIKit                          0x2699b5bd -[UIView(Internal) _addSubview:positioned:relativeTo:] + 1660
26 UIKit                          0x2699af3b -[UIView(Hierarchy) addSubview:] + 30
27 UIKit                          0x26c2517d __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke_2 + 1644
28 UIKit                          0x269a2471 +[UIView(Animation) performWithoutAnimation:] + 72
29 UIKit                          0x26b87891 __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke + 188
30 UIKit                          0x26c9df75 +[UIView(Internal) _performBlockDelayingTriggeringResponderEvents:] + 208
31 UIKit                          0x26b874c3 -[_UINavigationParallaxTransition animateTransition:] + 986
32 UIKit                          0x26b42ac5 -[UINavigationController _startCustomTransition:] + 3568
33 UIKit                          0x26a503d7 -[UINavigationController _startDeferredTransitionIfNeeded:] + 650
34 UIKit                          0x26a500e5 -[UINavigationController __viewWillLayoutSubviews] + 52
35 UIKit                          0x26a5005b -[UILayoutContainerView layoutSubviews] + 214
36 UIKit                          0x2698f9a3 -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 714
37 QuartzCore                     0x24a35b4d -[CALayer layoutSublayers] + 128
38 QuartzCore                     0x24a31225 CA::Layer::layout_if_needed(CA::Transaction*) + 348
39 QuartzCore                     0x24a310b9 CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 16
40 QuartzCore                     0x24a30581 CA::Context::commit_transaction(CA::Transaction*) + 368
41 QuartzCore                     0x24a30233 CA::Transaction::commit() + 614
42 QuartzCore                     0x24a2988b CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) + 138
43 CoreFoundation                 0x223e9739 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 20
44 CoreFoundation                 0x223e7a3d __CFRunLoopDoObservers + 280
45 CoreFoundation                 0x223e7e6f __CFRunLoopRun + 958
46 CoreFoundation                 0x223372e9 CFRunLoopRunSpecific + 520
47 CoreFoundation                 0x223370d5 CFRunLoopRunInMode + 108
48 GraphicsServices               0x23927ac9 GSEventRunModal + 160
49 UIKit                          0x269fc0b9 UIApplicationMain + 144
50 infinight                      0xdb1e9 main (main.m:16)
51 libdispatch.dylib              0x21fdf873 (Missing)

@1ec5
Copy link
Contributor

1ec5 commented Sep 14, 2016

@YBthebest, based on the stack trace, #5731 (comment) looks more like #1509, which was originally reported long before this issue. (gpus_ReturnGuiltyForHardwareRestart versus glrAGXRenderVertexArray.) We’ve seen a recent uptick in reports of both crashes, so they may be related, but it’s best to track the two issues separately for now in case they have different root causes.

@1ec5
Copy link
Contributor

1ec5 commented Sep 14, 2016

Based on #5731 (comment), one lead we’re investigating is that the number of OpenGL drawing calls is indeed very high. We’re looking into whether there was a significant increase recently, and whether turning off complex layers such as landcover alleviates the issue. We did make some major changes to map rendering in v3.3.0, including switching to a new tesselation library (#2444), but it remains to be seen whether those changes had any impact on the volume of drawing calls.

@incanus
Copy link
Contributor

incanus commented Sep 16, 2016

Looked a bit into this without luck yet, but I'm wondering if we can put in some live-running counts of draw calls per frame (along with FPS) as a debug mechanism here post-mortem? Not finding anything in OpenGL for this yet—all we've seen is using Xcode's GPU frame capture, which is one time and then outputs the draw call count (among many other statistics).

@incanus
Copy link
Contributor

incanus commented Sep 16, 2016

whether turning off complex layers such as landcover alleviates the issue

Really weird, but simple testing here removing the four default landcover layers takes me from 6,270 draw calls down to 6,266 in a quick test. Negligible.

@incanus
Copy link
Contributor

incanus commented Sep 16, 2016

Oddly, I'm still seeing draw calls for landcover layers even without them in the style—about 337 draw calls though.

screen shot 2016-09-16 at 1 50 13 pm

@yarry
Copy link

yarry commented Sep 20, 2016

I guess it has something to do with memory warning handling.
The crash haven’t resurfaced since I commented out _mbglMap->onLowMemory() in MGLMapView

@bloemy7
Copy link

bloemy7 commented Sep 20, 2016

Could this be a concrete solution?

@kkaefer
Copy link
Contributor

kkaefer commented Sep 21, 2016

I tried to replicate this crash, in particular focusing on onLowMemory(), but was unable to trigger a crash.

@cellininicholas
Copy link

cellininicholas commented Sep 22, 2016

We've been experiencing a similar crash through our app (reported through Fabric)
All occurrences seem to happen when the devices are low on memory (<8% free)
We do actually do a decent amount of MapView frame animation in our app, is that potentially an issue?

Here's the main thread stacktrace:

Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x180db62a0 _platform_memmove + 176
1  AGXGLDriver                    0x192c4ff6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
2  AGXGLDriver                    0x192c4ff6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
3  GLEngine                       0x1939f2ea4 glDrawElements_ACC_ES2Exec
4  Mapbox                         0x100927258 mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) (__hidden#783_:2693)
5  Mapbox                         0x100931544 mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) (__hidden#13260_:176)
6  Mapbox                         0x10092e144 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) (__hidden#13033_:240)
7  Mapbox                         0x10092dc7c mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) (__hidden#740_:1472)
8  Mapbox                         0x10091bf30 mbgl::Map::Impl::render() (__hidden#12086_:267)
9  Mapbox                         0x10091bda0 mbgl::Map::render() (__hidden#783_:2693)
10 Mapbox                         0x10089c174 __hidden#2380_ (__hidden#4671_:859)
11 GLKit                          0x1897ed36c -[GLKView _display:] + 332
12 Mapbox                         0x10089c910 __hidden#2387_ (__hidden#4671_:984)
13 QuartzCore                     0x183c94234 CA::Display::DisplayLinkItem::dispatch() + 40
14 QuartzCore                     0x183c940e8 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 424
15 IOKit                          0x1813d1e54 IODispatchCalloutFromCFMessage + 372
16 CoreFoundation                 0x1810f9030 __CFMachPortPerform + 180
17 CoreFoundation                 0x1811117d4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
18 CoreFoundation                 0x181110f0c __CFRunLoopDoSource1 + 436
19 CoreFoundation                 0x18110ec64 __CFRunLoopRun + 1800
20 CoreFoundation                 0x181038c50 CFRunLoopRunSpecific + 384
21 GraphicsServices               0x182920088 GSEventRunModal + 180
22 UIKit                          0x186322088 UIApplicationMain + 204
23 Campus Maps                    0x10014d7bc main (main.m:16)
24 libdispatch.dylib              0x180bd68b8 (Missing)

Another similar crash:

Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x25ddc9a0 _platform_memmove + 159
1  IMGSGX543RC2GLDriver           0x350d3f33 (Missing)
2  GLEngine                       0x3585ee71 glDrawElements_ACC_ES2Exec
3  OpenGLES                       0x27a8dedb glDrawElements + 38
4  Mapbox                         0x8957d3 mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) (__hidden#780_:2693)
5  Mapbox                         0x89eecb mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) (__hidden#13164_:176)
6  Mapbox                         0x89c3d7 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) (__hidden#12936_:272)
7  Mapbox                         0x89bf95 mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) (__hidden#737_:1472)
8  Mapbox                         0x88a845 mbgl::Map::Impl::render() (__hidden#11997_:267)
9  Mapbox                         0x88a6cd mbgl::Map::render() (__hidden#780_:2693)
10 Mapbox                         0x806907 __hidden#2371_ (__hidden#4660_:859)
11 GLKit                          0x2d14655f -[GLKView _display:] + 278
12 Mapbox                         0x807291 __hidden#2378_ (__hidden#4660_:984)
13 QuartzCore                     0x2836682f CA::Display::DisplayLinkItem::dispatch() + 106
14 QuartzCore                     0x2836667f CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 594
15 IOMobileFramebuffer            0x27a4958b IOMobileFramebufferVsyncNotifyFunc + 86
16 IOKit                          0x262f925d IODispatchCalloutFromCFMessage + 256
17 CoreFoundation                 0x2605b5e9 __CFMachPortPerform + 132
18 CoreFoundation                 0x2606da0b __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 34
19 CoreFoundation                 0x2606d11f __CFRunLoopDoSource1 + 342
20 CoreFoundation                 0x2606b531 __CFRunLoopRun + 1704
21 CoreFoundation                 0x25fbdbb9 CFRunLoopRunSpecific + 516
22 CoreFoundation                 0x25fbd9ad CFRunLoopRunInMode + 108
23 GraphicsServices               0x27237af9 GSEventRunModal + 160
24 UIKit                          0x2a2a9fb5 UIApplicationMain + 144
25 Campus Maps                    0xc38d7 main (main.m:16)
26 libdispatch.dylib              0x25c70873 (Missing)

@kkaefer
Copy link
Contributor

kkaefer commented Sep 22, 2016

@cellininicholas what device/OS version are you using? are you referring to free storage space or free RAM?

@cellininicholas
Copy link

The crash I mentioned above has come in numerous times (48 in a short space of time, during a period where we don't have many users) through Crashlytics. 52% on iOS 9, 46% on iOS 10. Of all the iPhone crashes, 33% were iPhone 6, 19% where iPhone 6s Plus, 19% were iPhone 5s, 29% were Other... All of iPad crashes were on an iPad Air.

I was referring to the free RAM when the crashes occurred. All seem to have occurred when there was <8% RAM free on the device.

Hope some of this might be helpful?

@Jackhammer42
Copy link

I see a similar crash in our app.

Last occured on an iPhone 5 (iOS 9.3.5) MapBox Version 3.3.1.

According to Crashlytics, 62 MB free RAM.

0. Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x21c9e966 _platform_memmove + 101
1  IMGSGX543RC2GLDriver           0x317aff33 (Missing)
2  IMGSGX543RC2GLDriver           0x317aff33 (Missing)
3  GLEngine                       0x31d20e51 glDrawElements_ACC_ES2Exec
4  OpenGLES                       0x23d27e13 glDrawElements + 38
5  Mapbox                         0x9faa17 mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) + 188
6  Mapbox                         0xa0403b mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) + 1330
7  Mapbox                         0xa01829 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) + 592
8  Mapbox                         0xa00eff mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 1582
9  Mapbox                         0x9ef999 mbgl::Map::Impl::render() + 216
10 Mapbox                         0x9ef821 mbgl::Map::render() + 76
11 Mapbox                         0x96d013 -[MGLMapView glkView:drawInRect:] + 50
12 GLKit                          0x2959f54f -[GLKView _display:] + 278
13 Mapbox                         0x96d9b9 -[MGLMapView updateFromDisplayLink] + 148
14 Mapbox                         0x96dcdb -[MGLMapView validateDisplayLink] + 434
15 Mapbox                         0x96dd7f -[MGLMapView didMoveToWindow] + 26
16 UIKit                          0x2654cfe1 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 1532
17 UIKit                          0x2654cce9 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 772
18 UIKit                          0x2654cce9 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 772
19 UIKit                          0x2654c435 __45-[UIView(Hierarchy) _postMovedFromSuperview:]_block_invoke + 124
20 Foundation                     0x2270b07d -[NSISEngine withBehaviors:performModifications:] + 256
21 UIKit                          0x2654c2ff -[UIView(Hierarchy) _postMovedFromSuperview:] + 454
22 UIKit                          0x2655937b -[UIView(Internal) _addSubview:positioned:relativeTo:] + 1658
23 UIKit                          0x26558cf7 -[UIView(Hierarchy) addSubview:] + 30
24 UIKit                          0x267e5225 __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke_2 + 1628
25 UIKit                          0x26560275 +[UIView(Animation) performWithoutAnimation:] + 72
26 UIKit                          0x267471e9 __53-[_UINavigationParallaxTransition animateTransition:]_block_invoke + 188
27 UIKit                          0x2685e415 +[UIView(Internal) _performBlockDelayingTriggeringResponderEvents:] + 208
28 UIKit                          0x26746e25 -[_UINavigationParallaxTransition animateTransition:] + 996
29 UIKit                          0x26701f45 -[UINavigationController _startCustomTransition:] + 3584
30 UIKit                          0x2660e9ef -[UINavigationController _startDeferredTransitionIfNeeded:] + 650
31 UIKit                          0x2660e701 -[UINavigationController __viewWillLayoutSubviews] + 52
32 UIKit                          0x2660e677 -[UILayoutContainerView layoutSubviews] + 214
33 UIKit                          0x2654d6fb -[UIView(CALayerDelegate) layoutSublayersOfLayer:] + 714
34 QuartzCore                     0x245bd569 -[CALayer layoutSublayers] + 128
35 QuartzCore                     0x245b8d2d CA::Layer::layout_if_needed(CA::Transaction*) + 352
36 QuartzCore                     0x245b8bbd CA::Layer::layout_and_display_if_needed(CA::Transaction*) + 16
37 QuartzCore                     0x245b8081 CA::Context::commit_transaction(CA::Transaction*) + 368
38 QuartzCore                     0x245b7d55 CA::Transaction::commit() + 520
39 QuartzCore                     0x245b14ff CA::Transaction::observer_callback(__CFRunLoopObserver*, unsigned long, void*) + 138
40 CoreFoundation                 0x21f332b1 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 20
41 CoreFoundation                 0x21f315a7 __CFRunLoopDoObservers + 282
42 CoreFoundation                 0x21f319e5 __CFRunLoopRun + 972
43 CoreFoundation                 0x21e801c9 CFRunLoopRunSpecific + 516
44 CoreFoundation                 0x21e7ffbd CFRunLoopRunInMode + 108
45 GraphicsServices               0x2349caf9 GSEventRunModal + 160
46 UIKit                          0x265ba435 UIApplicationMain + 144
47 henkel                         0x2b9ca4 main (AppDelegate.swift:70)
48 libdispatch.dylib              0x21b2c873 (Missing)

@u10int
Copy link

u10int commented Oct 7, 2016

This is by far one of the most frequent crashes we're also seeing within our app since upgrading to v3.3.x of the Mapbox iOS SDK, among many other OpenGL-related crashes. Others have provided similar stacktraces related to this same issue, but here's another from our app which is using v3.3.4 of the SDK:

Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x1821de2a0 _platform_memmove + 176
1  AGXGLDriver                    0x19412bf6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
2  AGXGLDriver                    0x19412bf6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
3  GLEngine                       0x194eceea4 glDrawElements_ACC_ES2Exec
4  Mapbox                         0x100c9b94c mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) + 284
5  Mapbox                         0x100ca5ce4 mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) + 3852
6  Mapbox                         0x100ca2b18 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) + 688
7  Mapbox                         0x100ca21ac mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 1424
8  Mapbox                         0x100c901d8 mbgl::Map::Impl::render() + 160
9  Mapbox                         0x100c90048 mbgl::Map::render() + 128
10 Mapbox                         0x100c14270 -[MGLMapView glkView:drawInRect:] + 48
11 GLKit                          0x18ac1d36c -[GLKView _display:] + 332
12 Mapbox                         0x100c14a0c -[MGLMapView updateFromDisplayLink] + 68
13 QuartzCore                     0x1850bc22c CA::Display::DisplayLinkItem::dispatch() + 40
14 QuartzCore                     0x1850bc0e0 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 424
15 IOKit                          0x1827f9e54 IODispatchCalloutFromCFMessage + 372
16 CoreFoundation                 0x182521030 __CFMachPortPerform + 180
17 CoreFoundation                 0x1825397d4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
18 CoreFoundation                 0x182538f0c __CFRunLoopDoSource1 + 436
19 CoreFoundation                 0x182536c64 __CFRunLoopRun + 1800
20 CoreFoundation                 0x182460c50 CFRunLoopRunSpecific + 384
21 GraphicsServices               0x183d48088 GSEventRunModal + 180
22 UIKit                          0x18774e088 UIApplicationMain + 204
23 TheOutbound                    0x1001aa050 main (AppDelegate.swift:19)
24 libdispatch.dylib              0x181ffe8b8 (Missing)

Haven't really seen any of these crashes come in for iOS 10 yet as most are from iOS 9.0. Also, it doesn't appear as if it's memory-related as several crashes were reporting free RAM > 15%.

@jfirebaugh
Copy link
Contributor

A common thread in all the stack traces is that the crash occurs when rendering the opaque pass for a fill layer. (You can tell it's the opaque pass because Painter::renderPass is specialized for reverse_iterator in the stack trace.) And from a couple complete crash logs, it appears to be a SIGSEGV on 0x0.

I saw a crash like this when working on #6468. It happened when I introduced a bug that resulted in calling glDrawElements when the currently-bound VAO had no element buffer binding. This is equivalent to calling glDrawElements with no element buffer bound, in which case it interprets the final argument (whose value is usually (void*)0) as a pointer to CPU memory and tries to read from it.

As a test, I reintroduced the bug in #6468 and I get almost exactly the same stack trace as seen here. In particular, the top of the stack trace is _platform_memmove + 176 -- the same symbol and offset. So I'm somewhat confident this crash is caused by calling glDrawElements with a VAO in which no element buffer is bound.

How would this happen? A VAO will have an unbound element buffer if:

  1. You forget to call glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, …) after binding the VAO. (This was what the bug in C++ bindings for OpenGL #6468 was.)
  2. You call glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, 0) with the VAO bound.
  3. You call glDeleteBuffers(…) on the bound buffer, with the VAO bound.
  4. You call glDeleteBuffers(…) on the bound buffer, without the VAO bound. (This is supposedly ok per the spec but problematic in practice.)

I think this list is exhaustive. @kkaefer @ansis Can you think of anything I'm missing?

I've combed through the code, and I can't see where any of these issues are present. In particular:

  • We always immediately bind an element buffer after creating a new VAO. I don't see any way in which this would be short circuited. So (1) seems very unlikely.
  • We delete the relevant element buffer only when we're also deleting the VAO in which it's bound. So (3) and (4) seem unlikely.
  • (2) seems like a more plausible cause -- we leave the VAO bound until the next VAO binding, or until the end of the current frame. So, if there is some code that is unaware that a VAO is bound, it could potentially unbind the current element buffer, which would affect the VAO. However, the only way I can see that being possible is with a custom layer, and we do unbind the VAO before rendering custom layers.
  • The only other place in the code that even calls glBindBuffer is Buffer::bind. Is it somehow possible that Buffer::buffer winds up containing a gl::UniqueBuffer value of 0? That would happen if glGenBuffers produced 0, or merely did not overwrite the 0 that we initialize to. However, this seems implausible; I can't find any indications that glGenBuffers can really "fail".

Another question that might be the key to unravelling this is: why do we only see crashes in fill layers, and not any other layer type? If it was really a bug with VAO state, I'd expect at least some crashes on other layer types, since our use of VAOs isn't specific to fill layers.

@jfirebaugh
Copy link
Contributor

Other hypotheses explored, none of which seem plausible:

  • The call to VertexArrayObject::bind in question is sometimes called with 4 arguments (no element buffer) and sometimes 5. Doesn't seem to be the case.
  • Multiple VertexArrayObjects are somehow improperly sharing a single VAO id. Implausible.
  • Third party GL code is getting injected somehow and running on the main thread while our GL context is active. Implausible.
  • glGenVertexArrays or glBindVertexArray fail, producing VAO id 0 or an unbound VAO. In this situation, the first call to glDrawElements would work: VertexArrayObject::bind would bind the necessary buffers, and it would look to glDrawElements like you're simply not using a VAO. But then the second time glDrawElements was called, VertexArrayObject::bound_shader would be non-zero so VertexArrayObject::bind wouldn't do anything.

Perhaps if a build that calls glGetError after every GL API call were widely distributed (i.e. define MBGL_CHECK_ERROR even in Release configuration), we would catch some invalid API use that precedes the crash.

@aish504
Copy link

aish504 commented Oct 13, 2016

Hi Mapbox,
We got the same crash, caught in Crashlytics

Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x18248e2a0 _platform_memmove + 176
1  AGXGLDriver                    0x19429bf6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
2  AGXGLDriver                    0x19429bf6c glrAGXRenderVertexArray(GLDContextRec*, unsigned int, unsigned int, int, int, unsigned int, void const*, int, void const*)
3  GLEngine                       0x19503eea4 glDrawElements_ACC_ES2Exec
4  Mapbox                         0x100f4b94c mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) + 284
5  Mapbox                         0x100f55ce4 mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) + 3852
6  Mapbox                         0x100f52b18 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) + 688
7  Mapbox                         0x100f521ac mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 1424
8  Mapbox                         0x100f401d8 mbgl::Map::Impl::render() + 160
9  Mapbox                         0x100f40048 mbgl::Map::render() + 128
10 Mapbox                         0x100ec4270 -[MGLMapView glkView:drawInRect:] + 48
11 GLKit                          0x18aec536c -[GLKView _display:] + 332
12 Mapbox                         0x100ec4a0c -[MGLMapView updateFromDisplayLink] + 68
13 QuartzCore                     0x18536422c CA::Display::DisplayLinkItem::dispatch() + 40
14 QuartzCore                     0x1853640e0 CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 424
15 IOKit                          0x182aa9e54 IODispatchCalloutFromCFMessage + 372
16 CoreFoundation                 0x1827d1030 __CFMachPortPerform + 180
17 CoreFoundation                 0x1827e97d4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
18 CoreFoundation                 0x1827e8f0c __CFRunLoopDoSource1 + 436
19 CoreFoundation                 0x1827e6c64 __CFRunLoopRun + 1800
20 CoreFoundation                 0x182710c50 CFRunLoopRunSpecific + 384
21 GraphicsServices               0x183ff8088 GSEventRunModal + 180
22 UIKit                          0x1879f6088 UIApplicationMain + 204
23 ABAS Beta                      0x1001208d0 main (main.m:14)
24 libdispatch.dylib              0x1822ae8b8 (Missing)

Any immediate fix?

@jfirebaugh
Copy link
Contributor

As a data-gathering mechanism, 596f9c5 enables error checking for all GL calls. We're not going to apply it in mainline releases because there may be usage scenarios where it would have a performance impact, but we can make targeted test builds that include it and see if they reveal anything interesting.

/cc @frederoni

@MarcosMunoz
Copy link

MarcosMunoz commented Oct 21, 2016

For us it is happening very often in different devices, we use a map with a custom style.

#0. Crashed: com.apple.main-thread
0  libsystem_platform.dylib       0x189b26e30 _platform_memmove + 48
1  AppleMetalGLRenderer           0x1a5df89e4 (Missing)
2  AppleMetalGLRenderer           0x1a5df89e4 (Missing)
3  AppleMetalGLRenderer           0x1a5df91cc (Missing)
4  GLEngine                       0x19f46611c glDrawElements_ACC_ES2Exec
5  Mapbox                         0x101f0b94c mbgl::FillBucket::drawElements(mbgl::PlainShader&, mbgl::gl::ObjectStore&) + 284
6  Mapbox                         0x101f15ce4 mbgl::Painter::renderFill(mbgl::FillBucket&, mbgl::style::FillLayer const&, mbgl::UnwrappedTileID const&, std::__1::array<double, 16ul> const&) + 3852
7  Mapbox                         0x101f12b18 void mbgl::Painter::renderPass<std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> > >(mbgl::RenderPass, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, std::__1::reverse_iterator<std::__1::__wrap_iter<mbgl::RenderItem const*> >, int, signed char) + 688
8  Mapbox                         0x101f121ac mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 1424
9  Mapbox                         0x101f001d8 mbgl::Map::Impl::render() + 160
10 Mapbox                         0x101f00048 mbgl::Map::render() + 128
11 Mapbox                         0x101e84270 -[MGLMapView glkView:drawInRect:] + 48
12 GLKit                          0x19499bb50 -[GLKView _display:] + 216
13 Mapbox                         0x101e84a0c -[MGLMapView updateFromDisplayLink] + 68
14 QuartzCore                     0x18dc9f640 CA::Display::DisplayLinkItem::dispatch(unsigned long long) + 44
15 QuartzCore                     0x18dc9f4ec CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 444
16 IOKit                          0x18ad08570 IODispatchCalloutFromCFMessage + 372
17 CoreFoundation                 0x18aa3256c __CFMachPortPerform + 180
18 CoreFoundation                 0x18aa4a934 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
19 CoreFoundation                 0x18aa4a0e8 __CFRunLoopDoSource1 + 436
20 CoreFoundation                 0x18aa47bcc __CFRunLoopRun + 1840
21 CoreFoundation                 0x18a976048 CFRunLoopRunSpecific + 444
22 GraphicsServices               0x18c3f9198 GSEventRunModal + 180
23 UIKit                          0x190950628 -[UIApplication _run] + 684
24 UIKit                          0x19094b360 UIApplicationMain + 208
25 CycleWE                        0x1004076e4 main (AppDelegate.swift:18)
26 libdispatch.dylib              0x1899585b8 (Missing)

@jfirebaugh
Copy link
Contributor

jfirebaugh commented Nov 9, 2016

I was finally able to reproduce the bug locally and determine the cause. The crash is triggered when an application which uses multiple map views encounters a low-memory situation. In such a situation, Map::onLowMemory() is called for each map. This method in turn calls a function which deletes unused but not yet deleted OpenGL resources, including VAOs.

However, Map::onLowMemory() failed to ensure the activation of the GL context to which those resources belong. Thus, the resources would get deleted in whichever context happens to be current at the time, most likely a context belonging to one of the other maps, which may be actively using identically-numbered resources. When this context subsequently attempts to use those resources, an error occurs. The error that I observed was glBindVertexArray returning GL_INVALID_OPERATION -- we didn't observe this in the wild, but 596f9c5 was on the right track and may have eventually helped. In the absence of that change, the glBindVertexArray failure would have gone unnoticed, and I can easily see ways in which a subsequent draw operation with an unbound element buffer could occur.

The fix is simple: #6972. We'll need to cherry pick this to the iOS and Android release branches, and should also consider an iOS 3.3.6 release that includes it -- I'm not sure that 057b7b7 will end up helping much.

@1ec5
Copy link
Contributor

1ec5 commented Nov 9, 2016

I'm not sure that 057b7b7 will end up helping much.

Should we revert 057b7b7 for v3.3.6?

@jfirebaugh
Copy link
Contributor

Yep.

@boundsj
Copy link
Contributor

boundsj commented Nov 10, 2016

Published ios-v3.3.6

@volonbolon
Copy link

volonbolon commented Nov 14, 2016

Upgraded to 3.3.6 and still crashing

* thread #1: tid = 0xafecb, 0x00000001026bbc2c Mapbox`mbgl::LineAtlas::upload(mbgl::gl::ObjectStore&), queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x567b0a78c6f5)
    frame #0: 0x00000001026bbc2c Mapbox`mbgl::LineAtlas::upload(mbgl::gl::ObjectStore&)
    frame #1: 0x00000001026d15e0 Mapbox`mbgl::Painter::render(mbgl::style::Style const&, mbgl::FrameData const&, mbgl::SpriteAtlas&) + 360
    frame #2: 0x00000001026bf9e8 Mapbox`mbgl::Map::Impl::render() + 160
    frame #3: 0x00000001026bf858 Mapbox`mbgl::Map::render() + 128
    frame #4: 0x00000001026437f4 Mapbox`___lldb_unnamed_function437$$Mapbox + 48
    frame #5: 0x0000000194b44b50 GLKit`-[GLKView _display:] + 216
    frame #6: 0x0000000102643f90 Mapbox`___lldb_unnamed_function444$$Mapbox + 68
    frame #7: 0x0000000103087b1c GPUToolsCore`-[DYDisplayLinkInterposer forwardDisplayLinkCallback:] + 176
    frame #8: 0x000000018dde71bc QuartzCore`CA::Display::DisplayLinkItem::dispatch(unsigned long long) + 44
    frame #9: 0x000000018dde7068 QuartzCore`CA::Display::DisplayLink::dispatch_items(unsigned long long, unsigned long long, unsigned long long) + 444
    frame #10: 0x000000018ae47138 IOKit`IODispatchCalloutFromCFMessage + 372
    frame #11: 0x000000018ab7056c CoreFoundation`__CFMachPortPerform + 180
    frame #12: 0x000000018ab88934 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 56
    frame #13: 0x000000018ab880e8 CoreFoundation`__CFRunLoopDoSource1 + 436
    frame #14: 0x000000018ab85bcc CoreFoundation`__CFRunLoopRun + 1840
    frame #15: 0x000000018aab4048 CoreFoundation`CFRunLoopRunSpecific + 444
    frame #16: 0x000000018c53a198 GraphicsServices`GSEventRunModal + 180
    frame #17: 0x0000000190aa02fc UIKit`-[UIApplication _run] + 684
    frame #18: 0x0000000190a9b034 UIKit`UIApplicationMain + 208
  * frame #19: 0x00000001000b8c74 Vigilante`main + 144 at AppDelegate.swift:18
    frame #20: 0x0000000189a985b8 libdyld.dylib`start + 4
(lldb) 

@jfirebaugh
Copy link
Contributor

@volonbolon That is a different crash signature, one that I don't believe we've seen before. Can you please open a separate issue?

@volonbolon
Copy link

Sure

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Core The cross-platform C++ core, aka mbgl crash iOS Mapbox Maps SDK for iOS
Projects
None yet
Development

No branches or pull requests