1018129 - [dolphin] crash at GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak()

Peipei Cheng (needinfo if you need my action)

Reporter

Description

•

10 years ago

This crash was found by partner. Here is the steps they provide. And the reproduce rate is 1/10.
1. Launch Camera and take pic
2. Switch Camera to front camera
3. Switch to video mode and take a video
4. Send several SMS to test device
   --> Camera will crash.

I was unable to reproduce on Flame v1.4. Here is the crash callstack.

-----------------------------------------------------------------------------

Operating system: Android
                  0.0.0 Linux 3.10.17 #1 PREEMPT Tue May 13 06:17:35 CST 2014 armv7l Spreadtrum/scx15_sp7715gaplus/scx15_sp7715ga:4.4.2/KOT49H/89:userdebug/test-keys
CPU: arm
     1 CPU

Crash reason:  SIGSEGV
Crash address: 0x0

Thread 6 (crashed)
 0  libxul.so!mozalloc_abort(char const*) [mozalloc_abort.cpp : 30 + 0x4]
     r4 = 0x00000000    r5 = 0x00000001    r6 = 0xb3b0175c    r7 = 0xffffffff
     r8 = 0xb6f3322c    r9 = 0xb686a195   r10 = 0x00000000    fp = 0x00000000
     sp = 0xb3b01720    lr = 0xb66f3c17    pc = 0xb66f3c1a
    Found by: given as instruction pointer in context
 1  libxul.so!NS_DebugBreak [nsDebugImpl.cpp : 421 + 0x5]
     r4 = 0x00000000    r5 = 0x00000001    r6 = 0xb3b0175c    r7 = 0xffffffff
     r8 = 0xb6f3322c    r9 = 0xb686a195   r10 = 0x00000000    fp = 0x00000000
     sp = 0xb3b01728    pc = 0xb56c3ce9
    Found by: call frame info
 2  libxul.so!mozilla::Logger::~Logger() [logging.cc : 47 + 0xd]
     r4 = 0xb3b01b90    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x00000020
     r8 = 0xb2f4d560    r9 = 0xb3b01b88   r10 = 0xb3b01c48    fp = 0xb6f352ec
     sp = 0xb3b01b70    pc = 0xb5812401
    Found by: call frame info
 3  libxul.so!mozilla::LogWrapper::~LogWrapper() [logging.h : 59 + 0x5]
     r4 = 0xb3b01b90    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x00000020
     r8 = 0xb2f4d560    r9 = 0xb3b01b88   r10 = 0xb3b01c48    fp = 0xb6f352ec
     sp = 0xb3b01b80    pc = 0xb57b9179
    Found by: call frame info
 4  libxul.so!android::GonkCameraSource::dataCallbackTimestamp(long long, int, android::sp<android::IMemory> const&) [GonkCameraSource.cpp : 700 + 0x3]
     r4 = 0xd301cc46    r5 = 0x00000000    r6 = 0x00000000    r7 = 0x00000020
     r8 = 0xb2f4d560    r9 = 0xb3b01b88   r10 = 0xb3b01c48    fp = 0xb6f352ec
     sp = 0xb3b01b88    pc = 0xb5dc6a2d
    Found by: call frame info
 5  libxul.so!android::GonkCameraSourceListener::postDataTimestamp(long long, int, android::sp<android::IMemory> const&) [GonkCameraSource.cpp : 103 + 0x21]
     r4 = 0xb2f4d560    r5 = 0xb6c5dfd4    r6 = 0xb3b01c48    r7 = 0x00000020
     r8 = 0x00000304    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01bc0    pc = 0xb5dc61ab
    Found by: call frame info
 6  libxul.so!android::GonkCameraHardware::postDataTimestamp(long long, int, android::sp<android::IMemory> const&) [GonkCameraHwMgr.cpp : 123 + 0xb]
     r4 = 0xb302d4c0    r5 = 0x00000020    r6 = 0xb3b01c48    r7 = 0x00000020
     r8 = 0x00000304    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01be8    pc = 0xb5dc4501
    Found by: call frame info
 7  libcamera_client.so!android::Camera::dataCallbackTimestamp(long long, int, android::sp<android::IMemory> const&) [Camera.cpp : 312 + 0x9]
     r4 = 0xb2ffd540    r5 = 0xb2ffd544    r6 = 0xb3b01c48    r7 = 0x00000020
     r8 = 0x00000304    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01c00    pc = 0xb50ea119
    Found by: call frame info
 8  libcamera_client.so!android::BnCameraClient::onTransact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int) [ICameraClient.cpp : 121 + 0xf]
     r4 = 0xb3b01c48    r5 = 0xb2ffd558    r6 = 0x00000020    r7 = 0xb3b01ca4
     r8 = 0x00000304    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01c38    pc = 0xb50ec8c9
    Found by: call frame info
 9  libbinder.so!android::BBinder::transact(unsigned int, android::Parcel const&, android::Parcel*, unsigned int) [Binder.cpp : 108 + 0x11]
     r4 = 0xb3b01cd4    r5 = 0xb2ffd55c    r6 = 0x00000003    r7 = 0xb3b01ca4
     r8 = 0x00000304    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01c68    pc = 0xb51462db
    Found by: call frame info
10  libbinder.so!android::IPCThreadState::executeCommand(int) [IPCThreadState.cpp : 1074 + 0x11]
     r4 = 0xb3ffbed0    r5 = 0xb3b01ca0    r6 = 0xb6f37384    r7 = 0x00002a14
     r8 = 0x00000304    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01c88    pc = 0xb514a84f
    Found by: call frame info
11  libbinder.so!android::IPCThreadState::getAndExecuteCommand() [IPCThreadState.cpp : 436 + 0x5]
     r4 = 0xb3ffbed0    r5 = 0x00000000    r6 = 0xb3ffbf00    r7 = 0xb51599e4
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01d48    pc = 0xb514abcf
    Found by: call frame info
12  libbinder.so!android::IPCThreadState::joinThreadPool(bool) [IPCThreadState.cpp : 490 + 0x5]
     r4 = 0xb3ffbed0    r5 = 0xb3ffbf30    r6 = 0x00000001    r7 = 0xb51599e4
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01d58    pc = 0xb514ac45
    Found by: call frame info
13  libbinder.so!android::PoolThread::threadLoop() [ProcessState.cpp : 67 + 0xb]
     r4 = 0xb3d01d60    r5 = 0xb3b01d78    r6 = 0x00000001    r7 = 0xb51599e4
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01d70    pc = 0xb514f281
    Found by: call frame info
14  libutils.so!android::Thread::_threadLoop(void*) [Threads.cpp : 767 + 0x7]
     r4 = 0xb3d01d60    r5 = 0xb3b01d78    r6 = 0x00000001    r7 = 0xb51599e4
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01d78    pc = 0xb5119a03
    Found by: call frame info
15  libutils.so!thread_data_t::trampoline(thread_data_t const*) [Threads.cpp : 95 + 0x3]
     r4 = 0xb3d09770    r5 = 0x00000000    r6 = 0xb5119929    r7 = 0xb3d01d60
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01da0    pc = 0xb5119535
    Found by: call frame info
16  libc.so!__thread_entry [pthread_create.cpp : 105 + 0x6]
     r4 = 0xb3b01dd0    r5 = 0x0061c780    r6 = 0xb51194fd    r7 = 0xb3d09760
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01db8    pc = 0xb6ef621c
    Found by: call frame info
17  libc.so!pthread_create [pthread_create.cpp : 224 + 0x12]
     r4 = 0x0061c780    r5 = 0xb3b01dd0    r6 = 0x00000000    r7 = 0x00000078
     r8 = 0xb51194fd    r9 = 0xb3a04000   r10 = 0xbe956c84    fp = 0xb6f352ec
     sp = 0xb3b01dd0    pc = 0xb6ef63b8
    Found by: call frame info

Peipei Cheng (needinfo if you need my action)

Reporter

Comment 1

•

10 years ago

Here is the log which triggered this crash.

05-17 14:18:33.815   104  2291 I SprdCameraHardware: test timestamp = 3540110406000, mIsStoreMetaData: 1. buffer_id 0x1
05-17 14:18:33.815   104  2291 D CameraClient: dataCallbackTimestamp(32)
05-17 14:18:33.815   772   778 I Gecko   : [Child 772] ###!!! ABORT: file ../../../gecko/dom/camera/GonkCameraSource.cpp, line 700
05-17 14:18:33.815   772   778 E Gecko   : mozalloc_abort: [Child 772] ###!!! ABORT: file ../../../gecko/dom/camera/GonkCameraSource.cpp, line 700

Peipei Cheng (needinfo if you need my action)

Reporter

Updated

•

10 years ago

Whiteboard: [sprd313633][partner-blocker]

Peipei Cheng (needinfo if you need my action)

Reporter

Comment 2

•

10 years ago

Please find the logs here: https://www.dropbox.com/s/q5eak5mjd7878gn/1018129.zip

Mike Habicher [:mikeh] (high bugzilla latency)

Comment 3

•

10 years ago

This is the assertion that's failing:
http://dxr.mozilla.org/mozilla-central/source/dom/camera/GonkCameraSource.cpp#700

Peipei Cheng (needinfo if you need my action)

Reporter

Updated

•

10 years ago

blocking-b2g: --- → 1.4?

Mike Habicher [:mikeh] (high bugzilla latency)

Updated

•

10 years ago

Summary: [dolphin] crash at libxul.so!mozalloc_abort(char const*) [mozalloc_abort.cpp : 30 + 0x4] → [dolphin] crash at GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak()

Preeti Raghunath(:Preeti)

Comment 4

•

10 years ago

Mike

Is this actionable? What is the user impact here?

Component: General → Gaia::Camera

Flags: needinfo?(mhabicher)

Mike Habicher [:mikeh] (high bugzilla latency)

Comment 5

•

10 years ago

Preeti, it looks like we're getting an incorrect value back from the camera library/driver:
  CHECK(timestampUs > mLastFrameTimestampUs);

In particular, this failing CHECK() seems to suggest that a video frame is coming in that has an earlier timestamp than the previous one.

The vendor should look into why this is happening.

Flags: needinfo?(mhabicher)

Naoki Hirata :nhirata (please use needinfo instead of cc)

Updated

•

10 years ago

Keywords: crash

Whiteboard: [sprd313633][partner-blocker] → [sprd313633][partner-blocker][b2g-crash]

Naoki Hirata :nhirata (please use needinfo instead of cc)

Updated

•

10 years ago

Crash Signature: [@ GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak() ]

Ivan Tsay (:ITsay)

Comment 6

•

10 years ago

Hi James,

Based on comment 5, please mind if you can find someone in your team to take a look this issue. Thanks!

Flags: needinfo?(james.zhang)

James Zhang (Spreadtrum)

Comment 7

•

10 years ago

Dafeng, please

Assignee: nobody → Dafeng.Xu

Flags: needinfo?(james.zhang)

Peipei Cheng (needinfo if you need my action)

Reporter

Updated

•

10 years ago

Whiteboard: [sprd313633][partner-blocker][b2g-crash] → [sprd313633][partner-blocker][b2g-crash][POVB]

Preeti Raghunath(:Preeti)

Updated

•

10 years ago

blocking-b2g: 1.4? → ---

Component: Gaia::Camera → Vendcom

James Zhang (Spreadtrum)

Updated

•

10 years ago

Flags: needinfo?(ttsai)

James Zhang (Spreadtrum)

Updated

•

10 years ago

Assignee: Dafeng.Xu → ming.li

James Zhang (Spreadtrum)

Comment 8

•

10 years ago

Fixed on my side.
see kernel

commit bd1f93222e61597b719fe8da0585f8c34e992115
Merge: f511e74 f6e3edf
Author: james.zhang <james.zhang@spreadtrum.com>
Date:   Wed Jun 25 11:12:06 2014 +0800

    Merge "Bug#313633 cherry-pick Bug#302240 swap back to use aon pclk timer as clocksource" into sprdb2g_gonk4.4

commit f6e3edf2c82c3280c7956ee785ad4b2d47c54517
Author: wei.qiao <wei.qiao@spreadtrum.com>
Date:   Mon Apr 21 12:47:16 2014 +0800

    Bug#313633 cherry-pick Bug#302240 swap back to use aon pclk timer as clocksource
    
    [bug number  ] 302240
    [root cause  ] aon timer1 is not suitable because its counter
                register value is not stable when reading it
    [changes     ] swap back to use aon pclk timer as clocksource
    [side effects] not support idle deep mode
    [self test   ] pass on 7715ga
    [whether AOB ] no
    [reviewers   ] geng.ren;mark.yang;xi.zhang;miller.song
    
    Change-Id: I325806d1c6a359b8ba1d245aa2c2713273edaef6

Assignee: ming.li → Dafeng.Xu

Status: NEW → RESOLVED

Closed: 10 years ago

Resolution: --- → FIXED

thomas tsai

Updated

•

10 years ago

Flags: needinfo?(ttsai)

Mike Habicher [:mikeh] (high bugzilla latency)

Updated

•

10 years ago

Bugzilla

Quick Search

[dolphin] crash at GonkCameraSource::dataCallbackTimestamp() | mozilla::LogWrapper::~LogWrapper() | mozilla::Logger::~Logger() | NS_DebugBreak()

Categories

(Firefox OS Graveyard :: Vendcom, defect)

Tracking

(Not tracked)

People

(Reporter: angelc04, Assigned: Dafeng.Xu)

References

Details

(Keywords: crash, Whiteboard: [sprd313633][partner-blocker][b2g-crash][POVB])

Crash Data

Security

(public)

User Story

Description

Comment 1

Updated

Comment 2

Comment 3

Updated

Updated

Comment 4

Comment 5

Updated

Updated

Comment 6

Comment 7

Updated

Updated

Updated

Updated

Comment 8

Updated

Updated