Closed Bug 1018129 Opened 11 years ago Closed 11 years ago

[dolphin] crash at GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak()

Categories

(Firefox OS Graveyard :: Vendcom, defect)

Product:
Firefox OS Graveyard
Component:
Vendcom
Platform:
Other
Other
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: angelc04, Assigned: Dafeng.Xu)

References

Details

(Keywords: crash, Whiteboard: [sprd313633][partner-blocker][b2g-crash][POVB])

Crash Data

This crash was found by partner. Here is the steps they provide. And the reproduce rate is 1/10. 1. Launch Camera and take pic 2. Switch Camera to front camera 3. Switch to video mode and take a video 4. Send several SMS to test device --> Camera will crash. I was unable to reproduce on Flame v1.4. Here is the crash callstack. ----------------------------------------------------------------------------- Operating system: Android 0.0.0 Linux 3.10.17 #1 PREEMPT Tue May 13 06:17:35 CST 2014 armv7l Spreadtrum/scx15_sp7715gaplus/scx15_sp7715ga:4.4.2/KOT49H/89:userdebug/test-keys CPU: arm 1 CPU Crash reason: SIGSEGV Crash address: 0x0 Thread 6 (crashed) 0 libxul.so!mozalloc_abort(char const*) [mozalloc_abort.cpp : 30 + 0x4] r4 = 0x00000000 r5 = 0x00000001 r6 = 0xb3b0175c r7 = 0xffffffff r8 = 0xb6f3322c r9 = 0xb686a195 r10 = 0x00000000 fp = 0x00000000 sp = 0xb3b01720 lr = 0xb66f3c17 pc = 0xb66f3c1a Found by: given as instruction pointer in context 1 libxul.so!NS_DebugBreak [nsDebugImpl.cpp : 421 + 0x5] r4 = 0x00000000 r5 = 0x00000001 r6 = 0xb3b0175c r7 = 0xffffffff r8 = 0xb6f3322c r9 = 0xb686a195 r10 = 0x00000000 fp = 0x00000000 sp = 0xb3b01728 pc = 0xb56c3ce9 Found by: call frame info 2 libxul.so!mozilla::Logger::~Logger() [logging.cc : 47 + 0xd] r4 = 0xb3b01b90 r5 = 0x00000000 r6 = 0x00000000 r7 = 0x00000020 r8 = 0xb2f4d560 r9 = 0xb3b01b88 r10 = 0xb3b01c48 fp = 0xb6f352ec sp = 0xb3b01b70 pc = 0xb5812401 Found by: call frame info 3 libxul.so!mozilla::LogWrapper::~LogWrapper() [logging.h : 59 + 0x5] r4 = 0xb3b01b90 r5 = 0x00000000 r6 = 0x00000000 r7 = 0x00000020 r8 = 0xb2f4d560 r9 = 0xb3b01b88 r10 = 0xb3b01c48 fp = 0xb6f352ec sp = 0xb3b01b80 pc = 0xb57b9179 Found by: call frame info 4 libxul.so!android::GonkCameraSource::dataCallbackTimestamp(long long, int, android::sp<android::IMemory> const&) [GonkCameraSource.cpp : 700 + 0x3] r4 = 0xd301cc46 r5 = 0x00000000 r6 = 0x00000000 r7 = 0x00000020 r8 = 0xb2f4d560 r9 = 0xb3b01b88 r10 = 0xb3b01c48 fp = 0xb6f352ec sp = 0xb3b01b88 pc = 0xb5dc6a2d Found by: call frame info 5 libxul.so!android::GonkCameraSourceListener::postDataTimestamp(long long, int, android::sp<android::IMemory> const&) [GonkCameraSource.cpp : 103 + 0x21] r4 = 0xb2f4d560 r5 = 0xb6c5dfd4 r6 = 0xb3b01c48 r7 = 0x00000020 r8 = 0x00000304 r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01bc0 pc = 0xb5dc61ab Found by: call frame info 6 libxul.so!android::GonkCameraHardware::postDataTimestamp(long long, int, android::sp<android::IMemory> const&) [GonkCameraHwMgr.cpp : 123 + 0xb] r4 = 0xb302d4c0 r5 = 0x00000020 r6 = 0xb3b01c48 r7 = 0x00000020 r8 = 0x00000304 r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01be8 pc = 0xb5dc4501 Found by: call frame info 7 libcamera_client.so!android::Camera::dataCallbackTimestamp(long long, int, android::sp<android::IMemory> const&) [Camera.cpp : 312 + 0x9] r4 = 0xb2ffd540 r5 = 0xb2ffd544 r6 = 0xb3b01c48 r7 = 0x00000020 r8 = 0x00000304 r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01c00 pc = 0xb50ea119 Found by: call frame info 8 libcamera_client.so!android::BnCameraClient::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int) [ICameraClient.cpp : 121 + 0xf] r4 = 0xb3b01c48 r5 = 0xb2ffd558 r6 = 0x00000020 r7 = 0xb3b01ca4 r8 = 0x00000304 r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01c38 pc = 0xb50ec8c9 Found by: call frame info 9 libbinder.so!android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int) [Binder.cpp : 108 + 0x11] r4 = 0xb3b01cd4 r5 = 0xb2ffd55c r6 = 0x00000003 r7 = 0xb3b01ca4 r8 = 0x00000304 r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01c68 pc = 0xb51462db Found by: call frame info 10 libbinder.so!android::IPCThreadState::executeCommand(int) [IPCThreadState.cpp : 1074 + 0x11] r4 = 0xb3ffbed0 r5 = 0xb3b01ca0 r6 = 0xb6f37384 r7 = 0x00002a14 r8 = 0x00000304 r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01c88 pc = 0xb514a84f Found by: call frame info 11 libbinder.so!android::IPCThreadState::getAndExecuteCommand() [IPCThreadState.cpp : 436 + 0x5] r4 = 0xb3ffbed0 r5 = 0x00000000 r6 = 0xb3ffbf00 r7 = 0xb51599e4 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01d48 pc = 0xb514abcf Found by: call frame info 12 libbinder.so!android::IPCThreadState::joinThreadPool(bool) [IPCThreadState.cpp : 490 + 0x5] r4 = 0xb3ffbed0 r5 = 0xb3ffbf30 r6 = 0x00000001 r7 = 0xb51599e4 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01d58 pc = 0xb514ac45 Found by: call frame info 13 libbinder.so!android::PoolThread::threadLoop() [ProcessState.cpp : 67 + 0xb] r4 = 0xb3d01d60 r5 = 0xb3b01d78 r6 = 0x00000001 r7 = 0xb51599e4 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01d70 pc = 0xb514f281 Found by: call frame info 14 libutils.so!android::Thread::_threadLoop(void*) [Threads.cpp : 767 + 0x7] r4 = 0xb3d01d60 r5 = 0xb3b01d78 r6 = 0x00000001 r7 = 0xb51599e4 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01d78 pc = 0xb5119a03 Found by: call frame info 15 libutils.so!thread_data_t::trampoline(thread_data_t const*) [Threads.cpp : 95 + 0x3] r4 = 0xb3d09770 r5 = 0x00000000 r6 = 0xb5119929 r7 = 0xb3d01d60 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01da0 pc = 0xb5119535 Found by: call frame info 16 libc.so!__thread_entry [pthread_create.cpp : 105 + 0x6] r4 = 0xb3b01dd0 r5 = 0x0061c780 r6 = 0xb51194fd r7 = 0xb3d09760 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01db8 pc = 0xb6ef621c Found by: call frame info 17 libc.so!pthread_create [pthread_create.cpp : 224 + 0x12] r4 = 0x0061c780 r5 = 0xb3b01dd0 r6 = 0x00000000 r7 = 0x00000078 r8 = 0xb51194fd r9 = 0xb3a04000 r10 = 0xbe956c84 fp = 0xb6f352ec sp = 0xb3b01dd0 pc = 0xb6ef63b8 Found by: call frame info
Here is the log which triggered this crash. 05-17 14:18:33.815 104 2291 I SprdCameraHardware: test timestamp = 3540110406000, mIsStoreMetaData: 1. buffer_id 0x1 05-17 14:18:33.815 104 2291 D CameraClient: dataCallbackTimestamp(32) 05-17 14:18:33.815 772 778 I Gecko : [Child 772] ###!!! ABORT: file ../../../gecko/dom/camera/GonkCameraSource.cpp, line 700 05-17 14:18:33.815 772 778 E Gecko : mozalloc_abort: [Child 772] ###!!! ABORT: file ../../../gecko/dom/camera/GonkCameraSource.cpp, line 700
Whiteboard: [sprd313633][partner-blocker]
blocking-b2g: --- → 1.4?
Summary: [dolphin] crash at libxul.so!mozalloc_abort(char const*) [mozalloc_abort.cpp : 30 + 0x4] → [dolphin] crash at GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak()
Mike Is this actionable? What is the user impact here?
Component: General → Gaia::Camera
Flags: needinfo?(mhabicher)
Preeti, it looks like we're getting an incorrect value back from the camera library/driver: CHECK(timestampUs > mLastFrameTimestampUs); In particular, this failing CHECK() seems to suggest that a video frame is coming in that has an earlier timestamp than the previous one. The vendor should look into why this is happening.
Flags: needinfo?(mhabicher)
Keywords: crash
Whiteboard: [sprd313633][partner-blocker] → [sprd313633][partner-blocker][b2g-crash]
Crash Signature: [@ GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak() ]
Hi James, Based on comment 5, please mind if you can find someone in your team to take a look this issue. Thanks!
Flags: needinfo?(james.zhang)
Dafeng, please
Assignee: nobody → Dafeng.Xu
Flags: needinfo?(james.zhang)
Whiteboard: [sprd313633][partner-blocker][b2g-crash] → [sprd313633][partner-blocker][b2g-crash][POVB]
blocking-b2g: 1.4? → ---
Component: Gaia::Camera → Vendcom
Flags: needinfo?(ttsai)
Assignee: Dafeng.Xu → ming.li
Fixed on my side. see kernel commit bd1f93222e61597b719fe8da0585f8c34e992115 Merge: f511e74 f6e3edf Author: james.zhang <james.zhang@spreadtrum.com> Date: Wed Jun 25 11:12:06 2014 +0800 Merge "Bug#313633 cherry-pick Bug#302240 swap back to use aon pclk timer as clocksource" into sprdb2g_gonk4.4 commit f6e3edf2c82c3280c7956ee785ad4b2d47c54517 Author: wei.qiao <wei.qiao@spreadtrum.com> Date: Mon Apr 21 12:47:16 2014 +0800 Bug#313633 cherry-pick Bug#302240 swap back to use aon pclk timer as clocksource [bug number ] 302240 [root cause ] aon timer1 is not suitable because its counter register value is not stable when reading it [changes ] swap back to use aon pclk timer as clocksource [side effects] not support idle deep mode [self test ] pass on 7715ga [whether AOB ] no [reviewers ] geng.ren;mark.yang;xi.zhang;miller.song Change-Id: I325806d1c6a359b8ba1d245aa2c2713273edaef6
Assignee: ming.li → Dafeng.Xu
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Flags: needinfo?(ttsai)
You need to log in before you can comment on or make changes to this bug.