1079093 - [Bluetooth][KK] System crashed when reconnect BT headset multiple times

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Alison Shiue]

Attachment: bt_crash_log.log

Gaia-Rev        778ebac47554e1c4b7e9a952d73e850f58123914
Gecko-Rev       https://hg.mozilla.org/releases/mozilla-aurora/rev/c4a4b04c617c
Build-ID        20141006000205
Version         34.0a2

STR:
1. Device turn on BT and connect BT headset
2. Turn off BT headset (disconnect)
3. Turn on BT headset (only auto reconnect phone audio)
4. Reconnect BT headset from device
5. Try reconnect from device 2~3 times
6. Unpair BT headset

Expect result:
Nothing special 

Actual result:
1. In step 3~5, BT headset only connect phone audio, no media audio
2. In step 6, system crashed

Comment 1

[Alison Shiue]

Attachment: crash_report.zip

Comment 2

[Alison Shiue]

[Blocking Requested - why for this release]:
crash issue

Comment 3

[Eric Chou [:ericchou] [:echou]]

I'll take a look

Comment 4

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

It looks like we need to fulfill the pre-condition here:
1. Outgoing connection a2dp fail
2. Disconnect a2dp, then disconnection fail
3. Unpair bluetooth, crash

I/GeckoBluetooth( 1415): ConnectionStateNotification: state 0
I/GeckoBluetooth( 1415): NotifyCompletion: [HFP/HSP] <>
I/GeckoBluetooth( 1415): EndSession: mSuccess 1
I/GeckoBluetooth( 1415): StartSession: connecting
I/GeckoBluetooth( 1415): Next: [HFP/HSP] 
I/GeckoBluetooth( 1415): NotifyCompletion: [A2DP] <ConnectionFailedError>
I/GeckoBluetooth( 1415): EndSession: mSuccess 1
I/GeckoBluetooth( 1415): StartSession: disconnecting
I/GeckoBluetooth( 1415): Next: [HFP/HSP] 
I/GeckoBluetooth( 1415): OnError: BluetoothA2dpInterface::Disconnect failed: 1

Comment 5

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

After reviewing the log, I think I have some idea to know how to reproduce this bug.
1. Don't land the fix to remove CAF added a2dp connection_priority_callback
2. Connect hfp/a2dp with bluetooth headset emulator 
3. Disconnect both profiles from phone
4. Init a2dp connection from bluetooth headset emulator
5. disconnect a2dp connection from phone 
6. Init avrcp connection from bluetooth headset emulator
7. Init hfp/a2dp connection from phone
8. Only HFP connection established, a2dp connection fail, however, avdtp connection state still in open state (because of connection_priority_callback is NULL), avdtp connection is triggered by step 6. And outgoing a2dp connection is triggered by step 7, thus a2dp connection fail.
9. Disconnect hfp connection from phone
10. hfp disconnected, a2dp disconnected fail (because a2dp state is wrong both in stack).
11. Unpair bluetooth
12. Crash

Comment 6

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

(In reply to Shawn Huang [:shawnjohnjr] from comment #5)
> After reviewing the log, I think I have some idea to know how to reproduce
> this bug.
> 1. Don't land the fix to remove CAF added a2dp connection_priority_callback
The fix was introduced in bug 1003591. However, the branch v2.1 locked bluedroid codebase, so the PVT build does not contain the fix. In bug 1079087, I correct b2g manifest, now the revision number is correct. I would recommend to test again, once PVT build the correct manifest was fetched.

Comment 7

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

I think this can be fixed tomorrow, since I can reproduce this bug using certain precise steps as i mentioned on Comment 5.

Comment 8

[Jocelyn Liu [:jocelyn] [:joliu]]

Crash report link: https://crash-stats.mozilla.com/report/index/af011a94-714f-4697-b406-768a32141007

We run into segmentation fault since mController is null here[1].
[1] http://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluedroid/BluetoothA2dpManager.cpp#458

Comment 9

[Jocelyn Liu [:jocelyn] [:joliu]]

Steal this bug. ;)

Comment 10

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Tested with fix (bug 1003591), this problem would never hit in the normal condition. ni Alison to verify the latest v2.1 build. So, this problem will not appear because of proper handling incoming a2dp connection. 

I will still need to figure out why gecko can hit this crash after the stack behaves strange.
If Alison cannot hit the crash, I think we will keep figuring out the problem, but in normal usage, we probably don't need to block this bug.

Comment 11

[Alison Shiue]

Cannot hit crash issue when retest on 
Gaia-Rev        55ce3612bd8a8665139d6b85114ce59993a3fa0a
Gecko-Rev       https://hg.mozilla.org/releases/mozilla-aurora/rev/8811060bf3fe
Build-ID        20141008160203
Version         34.0a2