[Samsung Galaxy S II Plus] Ext3h:
Said ahead, I would have posted this in http://xdaforums.com/galaxy-s2-plus/orig-development/rom-cyanogenmod-12-1-t3084287 where it belonged, since the bug was reproduced on that ROM, if it wasn't for that stupid "You must spam 10 times before you may properly report bugs" setting on this forum.

There appears to be some crashes in Chromium in >4.4.4 ROMs, related to this:

https://code.google.com/p/chromium/...er_bug_list_json.cc&sq=package:chromium&l=913

These crashes can be triggered by aggressive scrolling in either Chromium itself or any application utilizing libwebviewchromium.so. It will produce something along the lines of:

E/chromium( 4906): [ERROR:gl_renderer.cc(466)] Reached limit of pending sync queries.
--- snip, several repetions ---
E/chromium( 4906): [ERROR:gl_renderer.cc(466)] Reached limit of pending sync queries.
E/chromium( 4906): [ERROR:gl_fence_egl.cc(34)] Failed to get EGLSync attribute. error code:12300
E/chromium( 4906): [ERROR:gl_fence_egl.cc(50)] Failed to wait for EGLSync. error:EGL_BAD_PARAMETER
F/chromium( 4906): [FATAL:gl_fence_egl.cc(52)] Check failed: g_ignore_egl_sync_failures.
W/google-breakpad( 5032): -----BEGIN BREAKPAD MICRODUMP-----
W/google-breakpad( 5032): V WebView:45.0.2454.95
--- snip ---
F/libc ( 4906): Fatal signal 6 (SIGABRT), code -6 in tid 4961 (RenderThread)
I/DEBUG ( 146): property debug.db.uid not set; NOT waiting for gdb.
I/DEBUG ( 146): HINT: adb shell setprop debug.db.uid 100000
I/DEBUG ( 146): HINT: adb forward tcp:5039 tcp:5039
I/DEBUG ( 146): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 146): Build fingerprint: 'samsung/s2vepxx/s2vep:4.2.2/JDQ39/I9105PXXUBNG1:user/release-keys'
I/DEBUG ( 146): Revision: '5'
I/DEBUG ( 146): ABI: 'arm'
I/DEBUG ( 146): pid: 4906, tid: 4961, name: RenderThread >>> com.google.android.gm <<<
I/DEBUG ( 146): signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
I/DEBUG ( 146): Abort message: '[FATAL:gl_fence_egl.cc(52)] Check failed: g_ignore_egl_sync_failures.
I/DEBUG ( 146): '
I/DEBUG ( 146): r0 00000000 r1 00001361 r2 00000006 r3 00000000
I/DEBUG ( 146): r4 52ea8dd8 r5 00000006 r6 00000016 r7 0000010c
I/DEBUG ( 146): r8 402c4de4 r9 52ea7ff4 sl 00000000 fp 000001eb
I/DEBUG ( 146): ip 00001361 sp 52ea7b48 lr 40280c59 pc 402a67fc cpsr 600f0010
I/DEBUG ( 146):
I/DEBUG ( 146): backtrace:
I/DEBUG ( 146): #00 pc 000397fc /system/lib/libc.so (tgkill+12)
I/DEBUG ( 146): #01 pc 00013c55 /system/lib/libc.so (pthread_kill+52)
I/DEBUG ( 146): #02 pc 000149b3 /system/lib/libc.so (raise+10)
I/DEBUG ( 146): #03 pc 000110ed /system/lib/libc.so (__libc_android_abort+36)
I/DEBUG ( 146): #04 pc 0000f5cc /system/lib/libc.so (abort+4)
I/DEBUG ( 146): #05 pc 002b8bf9 /data/app/com.google.android.webview-1/lib/arm/libwebviewchromium.so

The "EGL_KHR_fence_sync" EGL extension is supposed to be fixed in all Broadcom based devices shipping with Android >4.4.4. Obviously this isn't the case with this platform, as the driver fix got never backported.

There is no point in reporting this upstream to the Chromium team. So .... what to do?

EDIT:

OK....

The broken extension is announced in /vendor/lib/egl/libGLES_vc4.so @0x6F78A-0x6F79C

Somebody is probably going to smack me for suggesting to fiddle around in binary content, but it looks like the sanest approach to fix the bug.

Copy 0x1F bytes from (src start) 0x6F79D to (dest start) 0x6F78A (beware of overlap when performing the copy)

Set 0x13 bytes to 0x00 at (start) 0x6F7A9

That removes the extension from the string, moves the trailing extension list forward, and fills the resulting gap with null bytes in order not to break alignment.

The extension isn't mandatory, the existing implementation is broken, so let's just get rid of that thing.

Change is not tested yet. Someone feel like trying?

EDIT2:

That thing isn't as easy to deactivate as I expected. And it turns out, it actually is a mandatory feature in EGL 1.5 ...

But if the driver isn't announcing it any longer, who is then? Broken software emulation as well?

Next step: Patching it out of libwebviewchromium.so, getting that Android <=4.4.4 workaround back in.

EDIT3:

Meh, too much work for me. Then it's back to <=4..4.4 for me. May someone else try to work around that bug.