Closed Bug 1146861 Opened 7 years ago Closed 6 years ago

[MTBF] Crash in media/audioTrack

Categories

(Firefox OS Graveyard :: Vendcom, defect, P1)

ARM
Gonk (Firefox OS)
defect

Tracking

(tracking-b2g:+, b2g-v2.2 affected)

RESOLVED WORKSFORME
tracking-b2g +
Tracking Status
b2g-v2.2 --- affected

People

(Reporter: pyang, Assigned: alwu)

References

Details

(Whiteboard: [POVB])

Crash Data

Attachments

(1 file)

Crash report: https://crash-stats.mozilla.com/report/index/468f15f3-1496-402e-a7bf-a1ea02150324


Version info:
Build ID               20150317162504
Gaia Revision          306772a58335ac4cad285d27c3805090a8cc6886
Gaia Date              2015-03-17 17:12:36
Gecko Revision         https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/83251e534b33
Gecko Version          37.0
Device Name            flame
Firmware(Release)      4.4.2
Firmware(Incremental)  eng.cltbld.20150317.195036
Firmware Date          Tue Mar 17 19:50:45 EDT 2015
Bootloader             L1TC100118D0

STR: Running mtbf for 15 more hours.
Blocks: MTBF-B2G
Depends on: MTBF-2015Q1
Blocks: MTBF-2015Q1
No longer depends on: MTBF-2015Q1
Hi Blake, do you know for this issue?
Flags: needinfo?(bwu)
From the crash report, it crashed in AudioTrack. 

Hi Alastor,
Could you help check it?
Flags: needinfo?(bwu) → needinfo?(alwu)
I will check it later, keep NI for tracking.
Attached patch AudioLogSplinter Review
Hi, Paul,
Could you apply this patch and test it again to capture the error log?
Because now I can't know the root cause from this crash record, I need more information.
Thanks :)
Flags: needinfo?(alwu)
Severity: normal → critical
blocking-b2g: --- → 2.2?
Priority: -- → P1
QA Contact: pyang
Alastor, You will take this bug, right?
Flags: needinfo?(alwu)
Yes, but I need more information about this issue.
Flags: needinfo?(alwu)
Hi, Paul,
Is there any log record about this bug?
Thanks!
Assignee: nobody → alwu
Flags: needinfo?(pyang)
blocking-b2g: 2.2? → 2.2+
https://crash-stats.mozilla.com/report/index/fc8363a9-f4e6-40c0-bddf-a4a842150331
another crash in same function

Build ID               20150330002503
Gaia Revision          473cd63f53c855299b719285d9b95e3f2910782f
Gaia Date              2015-03-27 20:14:43
Gecko Revision         https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/4b13c4254e2f
Gecko Version          37.0
Device Name            flame
Firmware(Release)      4.4.2
Firmware(Incremental)  eng.cltbld.20150330.040122
Firmware Date          Mon Mar 30 04:01:31 EDT 2015
Bootloader             L1TC100118D0

will attach logcat later.
Flags: needinfo?(pyang)
[Crash on the description]
@ frameworks/av/media/libmedia/AudioTrack.cpp:990
> uint32_t minBufCount = afLatency / ((1000 * afFrameCount)/afSampleRate);
It seems that the crash reason is |afLatency| was divided by ZERO. 
I think that we can add some codes to prevent returning the zero value in |AudioSystem::getLatency()| and |AudioSystem::getFrameCount()|.

[Crash on the comment8]
@ frameworks/av/media/libmedia/AudioTrack.cpp:1070
> size_t temp = cblk->frameCount_;
It seems that we access the wrong memory address. 

The cblk is got from this code. 
> audio_track_cblk_t* cblk = static_cast<audio_track_cblk_t*>(iMem->pointer());

The code here ensures we got the non-null |iMem|.
> sp<IMemory> iMem = track->getCblk();
> if (iMem == 0) {
>   ALOGE("Could not get control block");
>   return NO_INIT;
> }

Therefore, I guess that the |iMem| have the wrong file format so that |iMem->pointer()| returns invalid audio_track_cblk_t address.
From the crash stack, the crash happens in libmedia, it looks like a POVB. 

0 	libc.so 	libc.so@0x220c8 	
1 	libmozglue.so 	__aeabi_idiv0 	
2 		@0xefe 	
3 	libmedia.so 	android::AudioTrack::createTrack_l(audio_stream_type_t, unsigned int, audio_format_t, unsigned int, audio_output_flags_t, android::sp<android::IMemory> const&, int, unsigned int) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/frameworks/av/media/libmedia/AudioTrack.cpp:990
4 	libmedia.so 	android::AudioTrack::restoreTrack_l(char const*) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/frameworks/av/media/libmedia/AudioTrack.cpp:1776
5 	libmedia.so 	android::AudioTrack::start() 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/frameworks/av/media/libmedia/AudioTrack.cpp:485
Whiteboard: [POVB]
Component: Video/Audio → Vendcom
Product: Core → Firefox OS
Version: 37 Branch → unspecified
Hi Youlong:

As discussed in phone earlier today, would you help check the crash in libmedia? We would like to find out the root cause first to see the next step, even there is no plan for further Flame KK SW release.

Thank you.
Flags: needinfo?(youlong.jiang)
(In reply to Wesly Huang from comment #11)
> Hi Youlong:
> 
> As discussed in phone earlier today, would you help check the crash in
> libmedia? We would like to find out the root cause first to see the next
> step, even there is no plan for further Flame KK SW release.
> 
> Thank you.

hi wesly -

the attach is your previous patch not log. just from brief log in comment#10, it's not feasible to catch more info. could you pls upload the whole log file.

tks.
Flags: needinfo?(youlong.jiang)
(In reply to youlong.jiang from comment #12)
> hi wesly -
> 
> the attach is your previous patch not log. just from brief log in
> comment#10, it's not feasible to catch more info. could you pls upload the
> whole log file.
> 
> tks.

Youlong, is the log in comment#0 & comment#8 sufficient for your analysis?

Paul, in comment#8 you mentioned about logcat upload, would you help provide more log for T2M to analysis?

Thanks!
Flags: needinfo?(youlong.jiang)
Flags: needinfo?(pyang)
Nexus-5-L(5.1) has encountered one crash which was related to audio, not sure if it was similar with the original issue.
Here is the crash report: https://crash-stats.mozilla.com/report/index/8a84b3a1-f464-4a21-b1f1-e37202150417

STR: 
Running MTBF for 34 more hours.

Version info:
Build ID               20150414162502
Gaia Revision          16e948bfaaa15dbc0200135d52f16257b4eab193
Gaia Date              2015-04-14 21:08:25
Gecko Revision         https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/0eec28e78eb1
Gecko Version          37.0
Device Name            hammerhead
Firmware(Release)      5.1
Firmware(Incremental)  eng.cltbld.20150414.201650
Firmware Date          Tue Apr 14 20:17:04 EDT 2015
Bootloader             HHZ12f
Looks like crash in comment 14 is different with comment 8. Alison, could create another tracking bug?
Flags: needinfo?(ashiue)
(In reply to Bobby Chien [:bchien] from comment #15)
> Looks like crash in comment 14 is different with comment 8. Alison, could
> create another tracking bug?

ok, bug 1155490 is tracking this issue.
Flags: needinfo?(ashiue)
I think comment #9 providing pretty sufficient information.  Ping me if you need more.
Flags: needinfo?(pyang)
(In reply to Paul Yang [: pyang] from comment #17)
> I think comment #9 providing pretty sufficient information.  Ping me if you
> need more.

hi Paul -

from bug description, we just get crash result and tracking info, but it's also difficult for us to analysis issue. could you pls provide reproduce step and scenario.

@wesly -

from the crash report, it located the libmedia/AudioTrack. in my opinion, this part is related to framework/native level not BSP scope. from comment#9, if you have some tracking points, could you test locally on your site?

tks.
Flags: needinfo?(youlong.jiang) → needinfo?(wehuang)
 > @wesly -
> 
> from the crash report, it located the libmedia/AudioTrack. in my opinion,
> this part is related to framework/native level not BSP scope. from
> comment#9, if you have some tracking points, could you test locally on your
> site?
> 
> tks.

Hi Youlong:

I discussed this with QA, RD, and EPM:

1. this is found during MTBF test so no fixed STR.
2. please help submit a SR (paste SR number here) to QCT for checking this issue, in comment#9 there is some analysis & clue. If QCT is able to find the root cause and provide a fix we will consider to have it in Flame KK (Mozilla build, since no further T2M SW release in plan), and most important, FxOS with Lollipop.

Thank you.
Flags: needinfo?(wehuang) → needinfo?(youlong.jiang)
as comment 19, troubleshooting process takes time between mozilla and partner. Considering timeframe and it's not easy reproducible issue, unblock case from 2.2+. And waiting response.
blocking-b2g: 2.2+ → ---
tracking-b2g: --- → +
(In reply to Wesly Huang from comment #19)
>  > @wesly -
> > 
> > from the crash report, it located the libmedia/AudioTrack. in my opinion,
> > this part is related to framework/native level not BSP scope. from
> > comment#9, if you have some tracking points, could you test locally on your
> > site?
> > 
> > tks.
> 
> Hi Youlong:
> 
> I discussed this with QA, RD, and EPM:
> 
> 1. this is found during MTBF test so no fixed STR.
> 2. please help submit a SR (paste SR number here) to QCT for checking this
> issue, in comment#9 there is some analysis & clue. If QCT is able to find
> the root cause and provide a fix we will consider to have it in Flame KK
> (Mozilla build, since no further T2M SW release in plan), and most
> important, FxOS with Lollipop.
> 
> Thank you.

Dear wesly -

ok. I would apply for qcom support about this problem and feedback asap.

tks.
Flags: needinfo?(youlong.jiang)
Thanks, please have the SR number here, and keep up posted the feedback.
Flags: needinfo?(youlong.jiang)
(In reply to Wesly Huang from comment #22)
> Thanks, please have the SR number here, and keep up posted the feedback.

hi wesly -

here is the SR num:01993174

i'll feedback if there's any update.

tks.
Flags: needinfo?(youlong.jiang)
Dears -

Please enable log mask in AudioTrack.cpp AudioFlinger.cpp,thread.cpp AudioPolicyManager.cpp,AudioPolicyManagerBase.cpp,mediaplayerservice.cpp.

then feedback with logcat.

Please catch log by logcat -v threadtime. 

tks.
Flags: needinfo?(wehuang)
ni paul per comment 24.
Flags: needinfo?(pyang)
Thanks Bobby, clear my ni and we need more log for further check per comment#24.
Flags: needinfo?(wehuang)
Didn't catch this bug since last occurrence. Will keep collecting log with threadtime.
Flags: needinfo?(pyang)
Crash Signature: __aeabi_idiv0
Crash Signature: __aeabi_idiv0 → [@__aeabi_idiv0]
As crash report, no such crash and signature for long time. Close as worksforme.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.