1131298 - [Camera][Gonk][Shinano] bad/double/corrupted free in ~MediaPlayer when closing a camera instance, mediaserver crashes

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Camera, defect)

Description

[Mike Habicher [:mikeh] (high bugzilla latency)]

Attachment: logcat of mediaserver SIGSEGV when camera instance is closed

STR:
1. open Camera app
2. tap icon in upper-left to switch to user-facing camera

Expected: user-facing camera should open.

Observed: error "Camera Unavailable: The camera is in use by another app."

This also happens when switching from the user-facing to the away-facing camera. Once the error message appears, returning to the Homescreen and then returing to the Camera app will open the requested camera without error.

Comment 1

[Mike Habicher [:mikeh] (high bugzilla latency)]

Attachment: logcat of mediaserver SIGSEGV when the Camera app dies

mediaserver also crashes when CameraService Client instance is destroyed as a result of the Camera app crashing. The stack in this attachment is slightly different.

Comment 2

[Mike Habicher [:mikeh] (high bugzilla latency)]

Attachment: gdb bt of mediaserver SIGSEGV when camera instance is closed

Comment 3

[Mike Habicher [:mikeh] (high bugzilla latency)]

'this=0x0' sure looks suspicious:

#5  android::CameraService::releaseSound (this=0x0) at frameworks/av/services/camera/libcameraservice/CameraService.cpp:897

Comment 4

[Mike Habicher [:mikeh] (high bugzilla latency)]

With this patch:
https://github.com/mozilla-b2g/device-shinano/commit/e49283b7f7dc708d8fa858d1f0e190dd092f364a

...mediaserver still crashes, but restarts so quickly that it is effectively hidden, and you can switch between front and back cameras. The logcat tells the real story, however.

Comment 5

[Mike Habicher [:mikeh] (high bugzilla latency)]

Attachment: CameraService.cpp patch to fix crash

Comment 6

[Michael Wu [:mwu]]

Comment on attachment 8561762 [details] [diff] [review]
CameraService.cpp patch to fix crash

Review of attachment 8561762 [details] [diff] [review]:
-----------------------------------------------------------------

I think this can be simplified to simply returning early and letting the compiler remove the dead code.

Comment 7

[Mike Habicher [:mikeh] (high bugzilla latency)]

Attachment: CameraService.cpp patch to fix crash, v2

Simplified as requested. I'll leave it to you to land.

Comment 8

[Michael Wu [:mwu]]

Landed. frameworks/av was forked to land this.

https://github.com/mozilla-b2g/platform_frameworks_av/commit/a920312eb6299b6cc11f7136254c4b0ba7a663be