Closed Bug 1139157 Opened 7 years ago Closed 6 years ago

crash in mozilla::MediaDecoderStateMachine::SendStreamData()

Categories

(Firefox OS Graveyard :: Gaia::Music, defect)

All
Android
defect
Not set
critical

Tracking

(b2g-v2.2 fixed, b2g-master unaffected)

RESOLVED FIXED
2.2 S9 (3apr)
Tracking Status
b2g-v2.2 --- fixed
b2g-master --- unaffected

People

(Reporter: pbylenga, Assigned: jwwang)

References

()

Details

(Keywords: crash, Whiteboard: [3.0-Daily-Testing])

Crash Data

Attachments

(4 files)

This bug was filed from the Socorro interface and is 
report bp-13b3f427-1d6a-4455-b5b7-beba12150303.
=============================================================

I'm unable to reproduce this issue so far. I was in Settings :: Sounds :: Ringtones and mixing long pressing and selecting ringtones.  Also was adjusting volume periodically.

Is probably be related to bug 1107534
Here are my variables. Adding steps-wanted to see if we can reproduce.

Environmental Variables:
Device: Flame 3.0 Nightly Mozilla-Central
Build ID: 20150303010233
Gaia: c8ed1085a67490a1ecd7f275e5de9487e1b93b1d
Gecko: 0b3c520002ad
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0
Keywords: steps-wanted
See Also: → 1107534
QA Whiteboard: [QAnalyst-Triage?]
Flags: needinfo?(ktucker)
Whiteboard: [3.0-Daily-Testing]
QA Whiteboard: [QAnalyst-Triage?]
Flags: needinfo?(ktucker)
Attached file Logcat_newCrash
Unable to reproduce issue, but did receive a different crash while following steps in comment 0.

Signature: js::jit::BaselineScript::unlinkDependentAsmJSModules(js::FreeOp*)
Link: https://crash-stats.mozilla.com/report/index/b1d8ca32-787c-449a-a1db-005592150303

Unable to replicate this crash again either, but did grab logcat.

Tested on Flame 3.0 with same variables as comment 1

Leaving keywords in case someone else can reproduce.
Flags: needinfo?(pbylenga)
QA Whiteboard: [QAnalyst-Triage?]
No-Jun, do you think the crashes in Comment 2 are the same or should be filed separately?
QA Whiteboard: [QAnalyst-Triage?] → [QAnalyst-Triage+]
Flags: needinfo?(pbylenga) → needinfo?(npark)
(In reply to Peter Bylenga [:PBylenga] from comment #3)
> No-Jun, do you think the crashes in Comment 2 are the same or should be
> filed separately?

Hmm, if they are caused by same STR, let's file them together, and once the cause is found, then we can always create a new bug.
Flags: needinfo?(npark)
I was unable to reproduce this issue or the crash from comment 2 on the latest nightly build.  I tested with and without headphones but though I was able t reproduce bug 1107534 often, I did not see a crash.

Environmental Variables:
Device: Flame 3.0
BuildID: 20150304010324
Gaia: 3fc0ac309f5fb0c1fe82c12223b955a4efce27e6
Gecko: c5b90c003be8
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0) 
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0
Flags: needinfo?(ktucker)
I encountered a crash once on the reporter's build, and once on today's nightly build. I was tapping on the Select Sound screen multiple times for awhile, but unable to get a solid repro steps.

Device: Flame Master (KK, 319mb, full flash)
Build ID: 20150304010324
Gaia: 3fc0ac309f5fb0c1fe82c12223b955a4efce27e6
Gecko: c5b90c003be8
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Crash Report: https://crash-stats.mozilla.com/report/index/d2ef4551-a99a-4aec-b4eb-0771c2150304
--------------------------------
Environmental Variables:
Device: Flame 3.0
Build ID: 20150303010233
Gaia: c8ed1085a67490a1ecd7f275e5de9487e1b93b1d
Gecko: 0b3c520002ad
Gonk: e7c90613521145db090dd24147afd5ceb5703190
Version: 39.0a1 (3.0)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0

Crash Report: https://crash-stats.mozilla.com/report/index/da4d4bc4-db4a-4974-8b11-979c32150304
QA Whiteboard: [QAnalyst-Triage+] → [QAnalyst-Triage?]
QA Whiteboard: [QAnalyst-Triage?]
Flags: needinfo?(ktucker)
I spent about an hour on this but did not encounter any crash when playing with all kinds of Sound settings.

Device: Flame 3.0 Master (nightly production build, 319MB mem)
BuildID: 20150316010202
Gaia: 4868c56c0a3b7a1e51d55b24457e44a7709ea1ae
Gecko: 436686833af0
Gonk: b83fc73de7b64594cd74b33e498bf08332b5d87b
Version: 39.0a1 (3.0 Master)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0
Flags: needinfo?(ktucker)
I tried to get the STR again on today's nightly user build. After tapping on the items randomly for about 30 minutes, I did get a crash, but still was not able to get a solid repro steps.

https://crash-stats.mozilla.com/report/index/080ef348-c7a8-43ab-828c-2ee252150316

Device: Flame Master (KK, 319mb, full flash)
Build ID: 20150316010202
Gaia: 4868c56c0a3b7a1e51d55b24457e44a7709ea1ae
Gecko: 436686833af0
Gonk: b83fc73de7b64594cd74b33e498bf08332b5d87b
Version: 39.0a1 (3.0)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:39.0) Gecko/39.0 Firefox/39.0
QA Whiteboard: [QAnalyst-Triage?]
After several attempts, I do not think we can get solid repo steps for this because of its low reproducibility. Removing steps-wanted.
QA Whiteboard: [QAnalyst-Triage?] → [QAnalyst-Triage+]
Flags: needinfo?(ktucker)
Keywords: steps-wanted
Does this bug happen on mozilla-b2g32_v2_0? (https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/)
Blocks: 1144381
This bug should've been fixed in Central. (see bug 1127235 which is landed on 3/3).
I was able to reproduce this on Flame 2.2 but not on Flame 3.0 

A crash occurred when changing the volume of the ringtones while selecting different ringtones.

Environmental Variables:
Device: Flame 2.2
BuildID: 20150316002502
Gaia: a6b2d3f8478ec250beb49950fecbb8a16465ff6f
Gecko: 18619f8f6c5c
Gonk: b83fc73de7b64594cd74b33e498bf08332b5d87b
Version: 37.0 (2.2) 
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:37.0) Gecko/37.0 Firefox/37.0

STR:

1. Open "Settings".
2. Tap on "Sound".
3. Slide the "Ringtones and Notifications" volume slider up and down while pressing the physical volume button on the phone. 
4. Quickly tap "Ringtones". 
5. Select a ringtone and tap set.
6. Repeat steps 3-5 at least 3 times.
7. now, slide the "Ringtones and Notifications" volume slider up and down while pressing the physical volume button on the phone again.
8. Quickly tap "Ringtones" and then keep tapping different ringtones without setting them.

Actual:
A crash will occur.

Expected:
No crash will occur.

--------------------------------------------

I can consistently reproduce this crash on Flame 2.2 but not on Flame 3.0. This was probably fixed on master but the fix needs to be uplifted to 2.2. It is possible Yeojin is hitting a different crash on Comment 8 on master since she is missing the symbols on her crash report. Please see bug 1143954
No longer blocks: 1127235
Depends on: 1127235
This crash happened on Flame 2.2 only (with gecko37).
crash report: https://crash-stats.mozilla.com/report/index/13b3f427-1d6a-4455-b5b7-beba12150303

call flow:
1. DestroyDecodedStream() called in MediaDecoder::Shutdown() on the main thread. [1]
2. the decoder monitor was released on the main thread
3. state machine thread kicked in and grabbed the decoder monitor and called MediaDecoderStateMachine::SendStreamData() [2]
4. It crashed because mDecoder->GetDecodedStream() returned null.

Fix: quick return when mDecoder->GetDecodedStream() returns null.

[1] http://hg.mozilla.org/mozilla-central/annotate/0b3c520002ad/dom/media/MediaDecoder.cpp#l641
[2] http://hg.mozilla.org/mozilla-central/annotate/0b3c520002ad/dom/media/MediaDecoderStateMachine.cpp#l406
Assignee: nobody → jwwang
Status: NEW → ASSIGNED
Attachment #8580563 - Flags: review?(roc)
Hi KTucker,
Can you test flame 2.2 with the patch applied? Thanks.
Flags: needinfo?(ktucker)
Sure, we will test 2.2 with the patch applied and reply with our results. Adding qawanted.
Flags: needinfo?(ktucker)
Keywords: qawanted
QA Contact: ktucker
No-Jun, can you take a look at this please?
Flags: needinfo?(npark)
Flags: needinfo?(nhirata.bugzilla)
Attached file frozensound.log
With the latest 2.2, I was able to reproduce the crash.  The crash log is at:
https://crash-stats.mozilla.org/report/index/5c17ed06-6577-41ff-befc-70c1a2150323

With the gecko patch applied, I did not see the crash, but after repeatedly trying the same STR, the Sound UI was frozen (it would scroll, but the touch events won't respond, even if I go back to the homescreen and re-open settings app)

attached is the logcat when the UI was being unresponsive.
Flags: needinfo?(npark)
Clarification: in Comment 18, the crash occurred BEFORE applying the patch.  The UI freeze was seen after applying the patch, but no crash was shown.  The freeze happened right after I repeatedly selected between two ringtones in fast succession.
Flags: needinfo?(nhirata.bugzilla)
Keywords: qawanted
Per comment 19, it looks like a bug of UI or touch. Please file another bug for it.
Flags: needinfo?(jwwang)
Comment on attachment 8580563 [details] [diff] [review]
1139157_add_null_check.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): unknown
User impact if declined: crash when setting ringtones in Setting
Testing completed: tested by QA (comment 18)
Risk to taking this patch (and alternatives if risky): low
String or UUID changes made by this patch:none
Attachment #8580563 - Flags: approval-mozilla-b2g37?
(In reply to JW Wang [:jwwang] from comment #20)
> Per comment 19, it looks like a bug of UI or touch. Please file another bug
> for it.

njpark, can we please file the follow-up bug here ? If we uplift this I would rather want the follow-up fixed as well.
Flags: needinfo?(npark)
Blocks: 1147386
Bug 1147386 is created to track the UI issue.
Flags: needinfo?(npark)
Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1147386#c11. Crash is seen on the debug build of the master branch
Hi bajaj,
Can we uplift the patch? Bug 1147386 is a UI issue which should not block this bug.
Flags: needinfo?(bbajaj)
Flags: needinfo?(bbajaj)
Attachment #8580563 - Flags: approval-mozilla-b2g37? → approval-mozilla-b2g37+
https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/2c2eaa1b2f81
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Target Milestone: --- → 2.2 S9 (3apr)
Attached file reset_logcat.txt
Adding a new logcat per No Jun's request in Per bug 1147386 comment 19 to see if this is actually the same issue or not.
Flags: needinfo?(jwwang)
The logcat logs do not tell much. I need the crash dump to tell if the crash results from the same cause.
Flags: needinfo?(jwwang)
You need to log in before you can comment on or make changes to this bug.