1068872 - Crash in BluetoothProfileController::NotifyCompletion while running mochitest-9 on b2g emulator

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Kartikaya Gupta (email:[e-mail])]

Attachment: Backtrace to crash

STR:
1. Pull B2G and do:
   BRANCH=master ./config.sh emulator-jb
   ./build.sh
   export MINIDUMP_SAVE_PATH=$PWD
   ./mach mochitest-remote --this-chunk 9 --total-chunks 15
2. Wait for it to end in a crash
3. Use the instructions in bug 1015230 comments 1-2 to get a backtrace of the crash from the minidump file

Backtrace is attached. The line at http://mxr.mozilla.org/mozilla-central/source/dom/bluetooth/BluetoothProfileController.cpp?rev=5bc7a1c7054c#313 appears to be referencing an out-of-bounds index in the array, from what I can tell.

Comment 1

[Kartikaya Gupta (email:[e-mail])]

Also for the record I think this crash was happening right at the end of the test suite, after all the tests were run.

5162 INFO TEST-OK | /tests/dom/imptests/html/html/dom/documents/dta/test_nameditem-06.html | took 693ms
5163 INFO TEST-START | Shutdown
5164 INFO Passed:  29462
5165 INFO Failed:  0
5166 INFO Todo:    5726
5167 INFO Slowest: 225700ms - /tests/dom/imptests/editing/selecttest/test_extend.html
5168 INFO SimpleTest FINISHED
5169 INFO TEST-INFO | Ran 1 Loops
5170 INFO SimpleTest FINISHED
JavaScript error: resource://gre/modules/BrowserElementParent.jsm, line 300: NS_ERROR_ILLEGAL_VALUE: Component returned failure code: 0x80070057 (NS_ERROR_ILLEGAL_VALUE) [nsIXPCComponents_Utils.isDeadWrapper]
JavaScript error: resource://gre/modules/BrowserElementParent.jsm, line 300: NS_ERROR_ILLEGAL_VALUE: Component returned failure code: 0x80070057 (NS_ERROR_ILLEGAL_VALUE) [nsIXPCComponents_Utils.isDeadWrapper]
-*- NetworkService: NetworkService shutdown
mozcrash Saved minidump as /home/kats/zspace/B2G-emulator/2feb7643-dab0-05b3-3263a5a5-18abcf8c.dmp
mozcrash Saved app info as /home/kats/zspace/B2G-emulator/2feb7643-dab0-05b3-3263a5a5-18abcf8c.extra
PROCESS-CRASH | /tests/dom/imptests/html/html/dom/documents/dta/test_nameditem-06.html | application crashed [unknown top frame]
Crash dump filename: /tmp/tmpsk5COl/2feb7643-dab0-05b3-3263a5a5-18abcf8c.dmp
MINIDUMP_STACKWALK not set, can't process dump.
TEST-INFO | leakcheck | threshold set at 5116 bytes

Comment 2

[Kartikaya Gupta (email:[e-mail])]

I commented out the crashing line in the hope that would let me work around it, but then the next line (mCurrentProfileFinished = true) started crashing. I suspect the |this| object at that point is garbage or something.

Comment 3

[Kartikaya Gupta (email:[e-mail])]

... actually the |this| object there is nullptr, because the code at http://mxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluedroid/hfp/BluetoothHfpManager.cpp?rev=a1960a76aa87#695 passes a nullptr to Disconnect(), which uses it directly without a null check.

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Attachment: My naive patch

Comment 5

[Eric Chou [:ericchou] [:echou]]

Comment on attachment 8491504 [details] [diff] [review]
My naive patch

Review of attachment 8491504 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for fixing this.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/b2g-inbound/rev/91fb84885bcd

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/91fb84885bcd