855062 - B2G Desktop crashes on shutdown when bluetooth on

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Only repro so far is

- Bring up B2G desktop with bluetooth already on
- Shutdown B2G Desktop

Crash stack, main thread:

#0  0x00007f867416483d in nanosleep () at ../sysdeps/unix/syscall-template.S:82
#1  0x00007f86741646dc in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:138
#2  0x00007f867016be22 in ah_crap_handler (signum=11) at /share/code/mozbuild/mozilla-central/toolkit/xre/nsSigHandlers.cpp:88
#3  0x00007f86701703fa in nsProfileLock::FatalSignalHandler (signo=11, info=0x7fff51cd65f0, context=<optimized out>) at /share/code/mozbuild/mozilla-central/obj-debug/toolkit/profile/nsProfileLock.cpp:190
#4  <signal handler called>
#5  FireSuccessAsyncTask::FireSuccessAsyncTask (this=0x1f5ca00, aRequest=<optimized out>, aResult=...) at /share/code/mozbuild/mozilla-central/dom/base/DOMRequest.cpp:255
#6  0x00007f867099209d in mozilla::dom::DOMRequestService::FireSuccessAsync (this=<optimized out>, aRequest=0x22e2160, aResult=...) at /share/code/mozbuild/mozilla-central/dom/base/DOMRequest.cpp:313
#7  0x00007f8670b7de66 in mozilla::dom::bluetooth::BluetoothReplyRunnable::FireReply (this=0x2399870, aVal=...) at /share/code/mozbuild/mozilla-central/dom/bluetooth/BluetoothReplyRunnable.cpp:42
#8  0x00007f8670b7e023 in mozilla::dom::bluetooth::BluetoothReplyRunnable::Run (this=0x2399870) at /share/code/mozbuild/mozilla-central/dom/bluetooth/BluetoothReplyRunnable.cpp:71
#9  0x00007f86714588b5 in nsThread::ProcessNextEvent (this=0xb2a440, mayWait=false, result=0x7fff51cd6aef) at /share/code/mozbuild/mozilla-central/xpcom/threads/nsThread.cpp:627
#10 0x00007f8671413cd6 in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=false) at /share/code/mozbuild/mozilla-central/obj-debug/xpcom/build/nsThreadUtils.cpp:238
#11 0x00007f86710d4de0 in mozilla::ipc::MessagePump::Run (this=0xad4300, aDelegate=0xb29440) at /share/code/mozbuild/mozilla-central/ipc/glue/MessagePump.cpp:82
#12 0x00007f8671489ec6 in MessageLoop::RunInternal (this=0xb29440) at /share/code/mozbuild/mozilla-central/ipc/chromium/src/base/message_loop.cc:216
#13 0x00007f8671489eee in RunHandler (this=0xb29440) at /share/code/mozbuild/mozilla-central/ipc/chromium/src/base/message_loop.cc:209
#14 MessageLoop::Run (this=0xb29440) at /share/code/mozbuild/mozilla-central/ipc/chromium/src/base/message_loop.cc:183
#15 0x00007f8670fdb95f in nsBaseAppShell::Run (this=0xe70f80) at /share/code/mozbuild/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:163
#16 0x00007f8670e98fdc in nsAppStartup::Run (this=0xe719b0) at /share/code/mozbuild/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:288
#17 0x00007f8670166e0f in XREMain::XRE_mainRun (this=0x7fff51cd6ec0) at /share/code/mozbuild/mozilla-central/toolkit/xre/nsAppRunner.cpp:3880
#18 0x00007f8670167126 in XREMain::XRE_main (this=0x7fff51cd6ec0, argc=<optimized out>, argv=0x7fff51cd92c8, aAppData=<optimized out>) at /share/code/mozbuild/mozilla-central/toolkit/xre/nsAppRunner.cpp:3947
#19 0x00007f8670167392 in XRE_main (argc=3, argv=0x7fff51cd92c8, aAppData=0x612c90, aFlags=<optimized out>) at /share/code/mozbuild/mozilla-central/toolkit/xre/nsAppRunner.cpp:4152
#20 0x0000000000401c45 in do_main (argv=0x7fff51cd92c8, argc=3) at /share/code/mozbuild/mozilla-central/b2g/app/nsBrowserApp.cpp:168
#21 main (argc=<optimized out>, argv=<optimized out>) at /share/code/mozbuild/mozilla-central/b2g/app/nsBrowserApp.cpp:261

Comment 1

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Just saw this again. Looks like we're having problems creating an AutoPushJSContext while in shutdown.

Comment 2

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Attachment: Patch 1 (v1) - Add initialization function for DOMRequest FireSuccessAsync

Since pulling a JS Context can fail during shutdown, move context building to an initialization function, and check for initialization success during destruction.

Comment 3

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Attachment: Patch 1 (v2) - Add initialization function for DOMRequest FireSuccessAsync

Decoupled destructor assert so we assert instead of crashing on invalid context.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 737656 [details] [diff] [review]
Patch 1 (v2) - Add initialization function for DOMRequest FireSuccessAsync

Review of attachment 737656 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/DOMRequest.cpp
@@ +256,3 @@
>      nsresult rv;
>      nsIScriptContext* sc = mReq->GetContextForEventHandlers(&rv);
> +    if(!NS_SUCCEEDED(rv)) {

NS_ENSURE_SUCCESS(rv, rv)?

@@ +261,2 @@
>      AutoPushJSContext cx(sc->GetNativeContext());
> +    if(!cx) {

Nit: Space after if.

@@ +275,5 @@
> +  Dispatch(DOMRequest* aRequest,
> +           const JS::Value& aResult)
> +  {
> +    NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
> +    nsCOMPtr<FireSuccessAsyncTask> asyncTask = new FireSuccessAsyncTask(aRequest, aResult);

nsRefPtr for concrete classes.

Comment 5

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Attachment: Patch 1 (v3) - Add initialization function for DOMRequest FireSuccessAsync; r=mrbkap

Nits picked

Comment 6

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

https://tbpl.mozilla.org/?tree=Try&rev=4d382b913e01

Comment 7

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4b7551f945cc

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4b7551f945cc