1161956 - [bluetooth2] System restarts (or shows "Something just crashed") after stopping BLE-connected app.

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[elin]

When I try to stop my Ble-enabled app through WebIDE or through task manager,
there're about 30% chance it will pop a error message says: 

    "Something just crashed",

and if I keep doing this, 
there're 15% chance that my flame restarts automatically without warning.

I'm not trying to do any fringe test or stress test,
it just happens during my normal development cycle .
(since reload would mess up things currently)

Here are the only logs I got:

D/BtGatt.btif( 6791): btif_gattc_upstreams_evt: Event 1
I/Gecko   ( 6791): ++++ MEMORY REPORTING: DecrementNumChildProcesses --> 4
I/GeckoDump( 6791): Crash reporter : Submitting crash: 04af8156-da89-82a1-768e4b75-3443b90a

Let me know if there are any essential logs I can help to dump.

Comment 1

[elin]

Attachment: stop-and-crash-gdb.log

Here's what I get from gdb currently,
not sure if it helps.

Comment 2

[elin]

Attachment: stop-and-crash-gdb-2.log

Comment 3

[elin]

Attachment: logcat.txt

Shawn helped me dump more logs,
it'll be easier to reproduce if we call startDiscovery()
and wait for "Unknow Device Pairing request" pops out,
cancel it and stop the app will increase the chance of crash.

And for the "Unknow Device Pairing request", 
I don't know if it's another bug, 
or just some weird device around me.

It won't happen on devices with bluetooth V1 API

Comment 4

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

mozilla::dom::bluetooth::BluetoothGattManager::DisconnectNotification (this=<optimized out>, aConnId=<optimized out>, aStatus=mozilla::dom::bluetooth::GATT_STATUS_SUCCESS, aClientIf=6, 
    aDeviceAddr=...) at ../../../gecko/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:1522
1522    client->mConnId = 0;
(gdb) bt
#0  mozilla::dom::bluetooth::BluetoothGattManager::DisconnectNotification (this=<optimized out>, aConnId=<optimized out>, aStatus=mozilla::dom::bluetooth::GATT_STATUS_SUCCESS, aClientIf=6, 
    aDeviceAddr=...) at ../../../gecko/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:1522
#1  0xb50b9d96 in mozilla::dom::bluetooth::BluetoothNotificationHALRunnable4<mozilla::dom::bluetooth::BluetoothGattClientCallback::GattClientNotificationHandlerWrapper, void, int, mozilla::dom::bluetooth::BluetoothGattStatus, int, nsString, int, mozilla::dom::bluetooth::BluetoothGattStatus, int, nsAString_internal const&>::Run (this=<optimized out>)
    at ../../../gecko/dom/bluetooth/bluedroid/BluetoothHALHelpers.h:1473

Comment 5

[elin]

Hi, I think I found some new crash logs from GDB,
this time I'm using startLeScan to discover devices,
hope this helps.

Program received signal SIGSEGV, Segmentation fault.
nsRefPtr<gfxFontFamily>::nsRefPtr (this=0xbee6941c, aSmartPtr=...) at ../../dist/include/nsRefPtr.h:83
83	      mRawPtr->AddRef();
(gdb) bt
#0  nsRefPtr<gfxFontFamily>::nsRefPtr (this=0xbee6941c, aSmartPtr=...) at ../../dist/include/nsRefPtr.h:83
#1  0xb50bd504 in mozilla::dom::bluetooth::BluetoothGattManager::UnregisterClient (this=<optimized out>, aClientIf=aClientIf@entry=4, aRunnable=aRunnable@entry=0xa9137e40)
    at ../../../gecko/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:484
#2  0xb50c42f6 in mozilla::dom::bluetooth::BluetoothServiceBluedroid::UnregisterGattClientInternal (this=<optimized out>, aClientIf=4, aRunnable=0xa9137e40)
    at ../../../gecko/dom/bluetooth/bluedroid/BluetoothServiceBluedroid.cpp:505
#3  0xb50d39bc in mozilla::dom::bluetooth::BluetoothRequestParent::DoRequest (this=<optimized out>, aRequest=...) at ../../../gecko/dom/bluetooth/bluetooth2/ipc/BluetoothParent.cpp:845
#4  0xb4dd92be in mozilla::dom::bluetooth::PBluetoothParent::OnMessageReceived (this=0xa9164100, msg__=...) at PBluetoothParent.cpp:407
#5  0xb4e0bd20 in mozilla::dom::PContentParent::OnMessageReceived (this=0xa9b1f400, msg__=...) at PContentParent.cpp:3238
#6  0xb4d25edc in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0xa9b1f438, aMsg=...) at ../../../gecko/ipc/glue/MessageChannel.cpp:1279
#7  0xb4d2a226 in mozilla::ipc::MessageChannel::DispatchMessage (this=0xa9b1f438, aMsg=...) at ../../../gecko/ipc/glue/MessageChannel.cpp:1198
#8  0xb4d2bc42 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=<optimized out>) at ../../../gecko/ipc/glue/MessageChannel.cpp:1182
#9  0xb4babdc2 in DispatchToMethod<FdWatcher, void (FdWatcher::*)()> (method=(void (FdWatcher::*)(FdWatcher * const)) 0xb4d2bbc7 <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, 
    obj=<optimized out>, arg=...) at ../../../gecko/ipc/chromium/src/base/tuple.h:383
#10 RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run (this=<optimized out>) at ../../../gecko/ipc/chromium/src/base/task.h:310
#11 0xb4d2459e in Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:446
#12 mozilla::ipc::MessageChannel::DequeueTask::Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:463
#13 0xb4d180dc in MessageLoop::RunTask (this=0xb2ed31a0, task=0xa911b268) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:361
#14 0xb4d1a7b2 in MessageLoop::DeferOrRunPendingTask (this=<optimized out>, pending_task=...) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:369
#15 0xb4d1c3f8 in DoWork (this=<optimized out>) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:456
#16 MessageLoop::DoWork (this=0xb2ed31a0) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:435
#17 0xb4d24cd4 in mozilla::ipc::DoWorkRunnable::Run (this=<optimized out>) at ../../../gecko/ipc/glue/MessagePump.cpp:220
#18 0xb4bd3910 in nsThread::ProcessNextEvent (this=0xb6a02630, aMayWait=<optimized out>, aResult=0xbee69857) at ../../../gecko/xpcom/threads/nsThread.cpp:866
#19 0xb4be1b6c in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=aMayWait@entry=false) at /home/elin/Srcs/btv2-b2g/gecko/xpcom/glue/nsThreadUtils.cpp:265
#20 0xb4d27028 in mozilla::ipc::MessagePump::Run (this=0xb6aff190, aDelegate=0xb2ed31a0) at ../../../gecko/ipc/glue/MessagePump.cpp:95
#21 0xb4d18068 in MessageLoop::RunInternal (this=this@entry=0xb2ed31a0) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:233
#22 0xb4d1811c in RunHandler (this=0xb2ed31a0) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:226
#23 MessageLoop::Run (this=0xb2ed31a0) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:200
#24 0xb56ab5de in nsBaseAppShell::Run (this=0xb1a67340) at ../../gecko/widget/nsBaseAppShell.cpp:165
#25 0xb59cf236 in nsAppStartup::Run (this=0xb6a931c0) at ../../../../gecko/toolkit/components/startup/nsAppStartup.cpp:280
#26 0xb59effba in XREMain::XRE_mainRun (this=this@entry=0xbee699cc) at ../../../gecko/toolkit/xre/nsAppRunner.cpp:4085
#27 0xb59f01f8 in XREMain::XRE_main (this=this@entry=0xbee699cc, argc=argc@entry=1, argv=argv@entry=0xb6a2b190, aAppData=aAppData@entry=0xb6f40c70 <_ZL8sAppData>)
    at ../../../gecko/toolkit/xre/nsAppRunner.cpp:4165
#28 0xb59f036a in XRE_main (argc=1, argv=0xb6a2b190, aAppData=0xb6f40c70 <_ZL8sAppData>, aFlags=<optimized out>) at ../../../gecko/toolkit/xre/nsAppRunner.cpp:4254
#29 0xb6f24680 in do_main (argc=argc@entry=1, argv=argv@entry=0xb6a2b190) at ../../../gecko/b2g/app/nsBrowserApp.cpp:167
#30 0xb6f2478e in b2g_main (argc=argc@entry=1, argv=argv@entry=0xbee6ac84) at ../../../gecko/b2g/app/nsBrowserApp.cpp:299
#31 0xb6f24510 in RunProcesses (aReservedFds=..., argv=0xbee6ac84, argc=1) at ../../../gecko/b2g/app/B2GLoader.cpp:225
#32 main (argc=1, argv=0xbee6ac84) at ../../../gecko/b2g/app/B2GLoader.cpp:290

Comment 6

[elin]

After this segmentation fault,
my flame reboots automatically.

Comment 7

[Jocelyn Liu [:jocelyn] [:joliu]]

(In reply to elin from comment #5)
> Hi, I think I found some new crash logs from GDB,
> this time I'm using startLeScan to discover devices,
> hope this helps.
> 
> Program received signal SIGSEGV, Segmentation fault.
> nsRefPtr<gfxFontFamily>::nsRefPtr (this=0xbee6941c, aSmartPtr=...) at
> ../../dist/include/nsRefPtr.h:83
> 83	      mRawPtr->AddRef();
> (gdb) bt
> #0  nsRefPtr<gfxFontFamily>::nsRefPtr (this=0xbee6941c, aSmartPtr=...) at
> ../../dist/include/nsRefPtr.h:83
> #1  0xb50bd504 in
> mozilla::dom::bluetooth::BluetoothGattManager::UnregisterClient
> (this=<optimized out>, aClientIf=aClientIf@entry=4,
> aRunnable=aRunnable@entry=0xa9137e40)
>     at ../../../gecko/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:484
> #2  0xb50c42f6 in
> mozilla::dom::bluetooth::BluetoothServiceBluedroid::
> UnregisterGattClientInternal (this=<optimized out>, aClientIf=4,
> aRunnable=0xa9137e40)
>     at
> ../../../gecko/dom/bluetooth/bluedroid/BluetoothServiceBluedroid.cpp:505
> #3  0xb50d39bc in mozilla::dom::bluetooth::BluetoothRequestParent::DoRequest
> (this=<optimized out>, aRequest=...) at
> ../../../gecko/dom/bluetooth/bluetooth2/ipc/BluetoothParent.cpp:845
> #4  0xb4dd92be in
> mozilla::dom::bluetooth::PBluetoothParent::OnMessageReceived
> (this=0xa9164100, msg__=...) at PBluetoothParent.cpp:407
> #5  0xb4e0bd20 in mozilla::dom::PContentParent::OnMessageReceived
> (this=0xa9b1f400, msg__=...) at PContentParent.cpp:3238
> #6  0xb4d25edc in mozilla::ipc::MessageChannel::DispatchAsyncMessage
> (this=0xa9b1f438, aMsg=...) at
> ../../../gecko/ipc/glue/MessageChannel.cpp:1279
> #7  0xb4d2a226 in mozilla::ipc::MessageChannel::DispatchMessage
> (this=0xa9b1f438, aMsg=...) at
> ../../../gecko/ipc/glue/MessageChannel.cpp:1198
> #8  0xb4d2bc42 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne
> (this=<optimized out>) at ../../../gecko/ipc/glue/MessageChannel.cpp:1182
> #9  0xb4babdc2 in DispatchToMethod<FdWatcher, void (FdWatcher::*)()>
> (method=(void (FdWatcher::*)(FdWatcher * const)) 0xb4d2bbc7
> <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, 
>     obj=<optimized out>, arg=...) at
> ../../../gecko/ipc/chromium/src/base/tuple.h:383
> #10 RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run
> (this=<optimized out>) at ../../../gecko/ipc/chromium/src/base/task.h:310
> #11 0xb4d2459e in Run (this=<optimized out>) at
> ../../dist/include/mozilla/ipc/MessageChannel.h:446
> #12 mozilla::ipc::MessageChannel::DequeueTask::Run (this=<optimized out>) at
> ../../dist/include/mozilla/ipc/MessageChannel.h:463
> #13 0xb4d180dc in MessageLoop::RunTask (this=0xb2ed31a0, task=0xa911b268) at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:361
> #14 0xb4d1a7b2 in MessageLoop::DeferOrRunPendingTask (this=<optimized out>,
> pending_task=...) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:369
> #15 0xb4d1c3f8 in DoWork (this=<optimized out>) at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:456
> #16 MessageLoop::DoWork (this=0xb2ed31a0) at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:435
> #17 0xb4d24cd4 in mozilla::ipc::DoWorkRunnable::Run (this=<optimized out>)
> at ../../../gecko/ipc/glue/MessagePump.cpp:220
> #18 0xb4bd3910 in nsThread::ProcessNextEvent (this=0xb6a02630,
> aMayWait=<optimized out>, aResult=0xbee69857) at
> ../../../gecko/xpcom/threads/nsThread.cpp:866
> #19 0xb4be1b6c in NS_ProcessNextEvent (aThread=<optimized out>,
> aMayWait=aMayWait@entry=false) at
> /home/elin/Srcs/btv2-b2g/gecko/xpcom/glue/nsThreadUtils.cpp:265
> #20 0xb4d27028 in mozilla::ipc::MessagePump::Run (this=0xb6aff190,
> aDelegate=0xb2ed31a0) at ../../../gecko/ipc/glue/MessagePump.cpp:95
> #21 0xb4d18068 in MessageLoop::RunInternal (this=this@entry=0xb2ed31a0) at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:233
> #22 0xb4d1811c in RunHandler (this=0xb2ed31a0) at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:226
> #23 MessageLoop::Run (this=0xb2ed31a0) at
> ../../../gecko/ipc/chromium/src/base/message_loop.cc:200
> #24 0xb56ab5de in nsBaseAppShell::Run (this=0xb1a67340) at
> ../../gecko/widget/nsBaseAppShell.cpp:165
> #25 0xb59cf236 in nsAppStartup::Run (this=0xb6a931c0) at
> ../../../../gecko/toolkit/components/startup/nsAppStartup.cpp:280
> #26 0xb59effba in XREMain::XRE_mainRun (this=this@entry=0xbee699cc) at
> ../../../gecko/toolkit/xre/nsAppRunner.cpp:4085
> #27 0xb59f01f8 in XREMain::XRE_main (this=this@entry=0xbee699cc,
> argc=argc@entry=1, argv=argv@entry=0xb6a2b190,
> aAppData=aAppData@entry=0xb6f40c70 <_ZL8sAppData>)
>     at ../../../gecko/toolkit/xre/nsAppRunner.cpp:4165
> #28 0xb59f036a in XRE_main (argc=1, argv=0xb6a2b190, aAppData=0xb6f40c70
> <_ZL8sAppData>, aFlags=<optimized out>) at
> ../../../gecko/toolkit/xre/nsAppRunner.cpp:4254
> #29 0xb6f24680 in do_main (argc=argc@entry=1, argv=argv@entry=0xb6a2b190) at
> ../../../gecko/b2g/app/nsBrowserApp.cpp:167
> #30 0xb6f2478e in b2g_main (argc=argc@entry=1, argv=argv@entry=0xbee6ac84)
> at ../../../gecko/b2g/app/nsBrowserApp.cpp:299
> #31 0xb6f24510 in RunProcesses (aReservedFds=..., argv=0xbee6ac84, argc=1)
> at ../../../gecko/b2g/app/B2GLoader.cpp:225
> #32 main (argc=1, argv=0xbee6ac84) at
> ../../../gecko/b2g/app/B2GLoader.cpp:290

Hi Eddie,

Could you provide the STR for this log?
By looking at this call stack, I suspect that maybe we registered a client that already unregistered.
It will hit MOZ_ASSERT in the debug build, for release build, it will crash.

Thanks,
Jocelyn

Comment 8

[elin]

Basically I start my app, startLeScan, stopLeScan, and stop my app through WebIDE or task manager,
It crashes soon after repeating few times of this steps.

I think my build is a release build, since I didn't specify additional parameters when building.
I'll try building a debug build.

Thanks!

Comment 9

[elin]

BTW, how do I make sure my build is a debug build?
Here are my build options:
MOZ_B2G_BT_API_V2=1 DEBUG=1 DEVICE_DEBUG=1 B2G_DEBUG=1 NOFTU=1 ./build.sh -j1

and I found that app crashes as usual with this build.

Comment 10

[elin]

Here are some adb logs I got in debug build:

This is when the "Something just crashed" message appears
F/MOZ_Assert( 4712): Assertion failure: !aPath.IsEmpty(), at /home/elin/Srcs/btv2-b2g-debug/gecko/dom/bluetooth/BluetoothUtils.cpp:139

This occurred after serval times of repeating startDiscovery->stopDiscovery->stop app
E/Gecko  ( 5388): mozalloc_abort: [Child 5388] ###!!! ABORT: constructor for actor failed: file /home/elin/Srcs/btv2-b2g/objdir-gecko/ipc/ipdl/PContentChild.cpp, line 2051
F/MOZ_CRASH( 5388): Hit MOZ_CRASH() at /home/elin/Srcs/btv2-b2g-debug/gecko/memory/mozalloc/mozalloc_abort.cpp:33

But it seems that system won't restart automatically now, 
at least it didn't happen after 20 times stop app,
only the "Something just crashed" message.

Comment 11

[Bruce Sun [:brsun]]

Sometimes the content process encounters the following segmentation fault:

Program received signal SIGSEGV, Segmentation fault.
0xb5091eb6 in nsRefPtr (aRawPtr=0xb0925b00, this=<synthetic pointer>) at ../../dist/include/nsRefPtr.h:99
99	      mRawPtr->AddRef();
(gdb) bt
#0  0xb5091eb6 in nsRefPtr (aRawPtr=0xb0925b00, this=<synthetic pointer>) at ../../dist/include/nsRefPtr.h:99
#1  DisconnectEventTargetObjects (aKey=<optimized out>, aClosure=0x0) at ../../../../mozilla-central-working/dom/base/nsGlobalWindow.cpp:1257
#2  0xb50917d8 in nsTHashtable<nsPtrHashKey<mozilla::DOMEventTargetHelper> >::s_EnumStub (aTable=<optimized out>, aEntry=<optimized out>, aNumber=<optimized out>, aArg=<optimized out>)
    at ../../dist/include/nsTHashtable.h:504
#3  0xb4c6ca66 in Enumerate (aArg=0xbe8d5a90, aEtor=0xb50917cf <nsTHashtable<nsPtrHashKey<mozilla::DOMEventTargetHelper> >::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*)>, 
    this=this@entry=0xb3ae1b64) at /home/bruce_sun/Source/mozilla-central-working/xpcom/glue/pldhash.cpp:844
#4  PL_DHashTableEnumerate (aTable=aTable@entry=0xb3ae1b64, 
    aEtor=0xb50917cf <nsTHashtable<nsPtrHashKey<mozilla::DOMEventTargetHelper> >::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*)>, aArg=aArg@entry=0xbe8d5a90)
    at /home/bruce_sun/Source/mozilla-central-working/xpcom/glue/pldhash.cpp:895
#5  0xb5095afc in nsTHashtable<nsPtrHashKey<mozilla::DOMEventTargetHelper> >::EnumerateEntries (this=this@entry=0xb3ae1b64, aEnumFunc=<optimized out>, aUserArg=aUserArg@entry=0x0)
    at ../../dist/include/nsTHashtable.h:221
#6  0xb509f9c4 in CleanUp (this=0xb3ae19c0) at ../../../../mozilla-central-working/dom/base/nsGlobalWindow.cpp:1437
#7  nsGlobalWindow::CleanUp (this=0xb3ae19c0) at ../../../../mozilla-central-working/dom/base/nsGlobalWindow.cpp:1428
#8  0xb509fb84 in CleanUp (this=0xb3ae0ca0) at ../../../../mozilla-central-working/dom/base/nsGlobalWindow.cpp:1506
#9  nsGlobalWindow::CleanUp (this=0xb3ae0ca0) at ../../../../mozilla-central-working/dom/base/nsGlobalWindow.cpp:1428
#10 0xb50a00aa in nsGlobalWindow::DetachFromDocShell (this=0xb3ae0ca0) at ../../../../mozilla-central-working/dom/base/nsGlobalWindow.cpp:2939
#11 0xb59d04d2 in nsDocShell::Destroy (this=0xb1ac6400) at ../../../../mozilla-central-working/docshell/base/nsDocShell.cpp:5836
#12 0xb59eb0c6 in nsWebBrowser::SetDocShell (this=this@entry=0xb17cc8e0, aDocShell=aDocShell@entry=0x0) at ../../../../mozilla-central-working/embedding/browser/nsWebBrowser.cpp:1654
#13 0xb59eca96 in nsWebBrowser::InternalDestroy (this=this@entry=0xb17cc8e0) at ../../../../mozilla-central-working/embedding/browser/nsWebBrowser.cpp:95
#14 0xb59ecacc in nsWebBrowser::Destroy (this=0xb17cc8e0) at ../../../../mozilla-central-working/embedding/browser/nsWebBrowser.cpp:1275
#15 0xb5699932 in mozilla::dom::TabChild::DestroyWindow (this=this@entry=0xb1ac5c00) at ../../../../mozilla-central-working/dom/ipc/TabChild.cpp:1578
#16 0xb5699a58 in mozilla::dom::TabChild::RecvDestroy (this=0xb1ac5c00) at ../../../../mozilla-central-working/dom/ipc/TabChild.cpp:2757
#17 0xb4e6787c in mozilla::dom::PBrowserChild::OnMessageReceived (this=0xb1ac5d4c, msg__=...) at PBrowserChild.cpp:3581
#18 0xb4e9dc04 in mozilla::dom::PContentChild::OnMessageReceived (this=0xb2eb0c18, msg__=...) at PContentChild.cpp:5401
#19 0xb4db1e20 in mozilla::ipc::MessageChannel::DispatchAsyncMessage (this=0xb2eb0c50, aMsg=...) at ../../../../mozilla-central-working/ipc/glue/MessageChannel.cpp:1279
#20 0xb4db6216 in mozilla::ipc::MessageChannel::DispatchMessage (this=0xb2eb0c50, aMsg=...) at ../../../../mozilla-central-working/ipc/glue/MessageChannel.cpp:1198
#21 0xb4db7c32 in mozilla::ipc::MessageChannel::OnMaybeDequeueOne (this=<optimized out>) at ../../../../mozilla-central-working/ipc/glue/MessageChannel.cpp:1182
#22 0xb4c38310 in DispatchToMethod<FdWatcher, void (FdWatcher::*)()> (method=(void (FdWatcher::*)(FdWatcher * const)) 0xb4db7bb7 <mozilla::ipc::MessageChannel::OnMaybeDequeueOne()>, obj=<optimized out>, 
    arg=...) at ../../../../mozilla-central-working/ipc/chromium/src/base/tuple.h:383
#23 RunnableMethod<FdWatcher, void (FdWatcher::*)(), Tuple0>::Run (this=<optimized out>) at ../../../../mozilla-central-working/ipc/chromium/src/base/task.h:310
#24 0xb4db04e6 in Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:446
#25 mozilla::ipc::MessageChannel::DequeueTask::Run (this=<optimized out>) at ../../dist/include/mozilla/ipc/MessageChannel.h:463
#26 0xb4da4020 in MessageLoop::RunTask (this=0xbe8d6110, task=0xb3ab3a20) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:361
#27 0xb4da66fa in MessageLoop::DeferOrRunPendingTask (this=<optimized out>, pending_task=...) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:369
#28 0xb4da8340 in DoWork (this=<optimized out>) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:456
#29 MessageLoop::DoWork (this=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:435
#30 0xb4db0c18 in mozilla::ipc::DoWorkRunnable::Run (this=<optimized out>) at ../../../../mozilla-central-working/ipc/glue/MessagePump.cpp:220
#31 0xb4c5f810 in nsThread::ProcessNextEvent (this=0xb6b02710, aMayWait=<optimized out>, aResult=0xbe8d6017) at ../../../../mozilla-central-working/xpcom/threads/nsThread.cpp:846
#32 0xb4c6dd0e in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=aMayWait@entry=true) at /home/bruce_sun/Source/mozilla-central-working/xpcom/glue/nsThreadUtils.cpp:265
#33 0xb4db303a in mozilla::ipc::MessagePump::Run (this=0xb6b01f70, aDelegate=0xbe8d6110) at ../../../../mozilla-central-working/ipc/glue/MessagePump.cpp:127
#34 0xb4da3fac in MessageLoop::RunInternal (this=this@entry=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:233
#35 0xb4da4060 in RunHandler (this=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:226
#36 MessageLoop::Run (this=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:200
#37 0xb574d47a in nsBaseAppShell::Run (this=0xb1a54a60) at ../../../mozilla-central-working/widget/nsBaseAppShell.cpp:165
#38 0xb5a93926 in XRE_RunAppShell () at ../../../../mozilla-central-working/toolkit/xre/nsEmbedFunctions.cpp:738
#39 0xb4da3fac in MessageLoop::RunInternal (this=this@entry=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:233
#40 0xb4da4060 in RunHandler (this=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:226
#41 MessageLoop::Run (this=this@entry=0xbe8d6110) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:200
#42 0xb5a93dec in XRE_InitChildProcess (aArgc=<optimized out>, aArgv=<optimized out>, aGMPLoader=<optimized out>) at ../../../../mozilla-central-working/toolkit/xre/nsEmbedFunctions.cpp:575
#43 0xb4eb6774 in content_process_main (argc=8, argc@entry=9, argv=argv@entry=0xb6b01d60) at ../../../../mozilla-central-working/ipc/contentproc/plugin-container.cpp:236
#44 0xb4db3c46 in mozilla::ipc::ProcLoaderLoadRunner::DoWork (this=<optimized out>) at ../../../../mozilla-central-working/ipc/glue/ProcessUtils_linux.cpp:435
#45 0xb4db44e6 in ProcLoaderServiceRun (aReservedFds=..., aArgv=<optimized out>, aArgc=1, aFd=<optimized out>, aPeerPid=4231) at ../../../../mozilla-central-working/ipc/glue/ProcessUtils_linux.cpp:594
#46 XRE_ProcLoaderServiceRun (aPeerPid=4231, aFd=<optimized out>, aArgc=1, aArgv=<optimized out>, aReservedFds=...) at ../../../../mozilla-central-working/ipc/glue/ProcessUtils_linux.cpp:628
#47 0xb6fd4662 in RunProcesses (aReservedFds=..., argv=0xbe8d6c84, argc=1) at ../../../../mozilla-central-working/b2g/app/B2GLoader.cpp:219
#48 main (argc=1, argv=0xbe8d6c84) at ../../../../mozilla-central-working/b2g/app/B2GLoader.cpp:297
(gdb) p aRawPtr
$6 = (mozilla::DOMEventTargetHelper *) 0xb0925b00
(gdb) p aRawPtr->mRefCnt
$7 = {mRefCntAndFlags = 1515870810}
(gdb) info vtbl aRawPtr
vtable for 'mozilla::DOMEventTargetHelper' @ 0x5a5a5a5a (subobject @ 0xb0925b00):
[0]: <error: Cannot access memory at address 0x5a5a5a5a>
[1]: <error: Cannot access memory at address 0x5a5a5a5e>
[2]: <error: Cannot access memory at address 0x5a5a5a62>
[3]: <error: Cannot access memory at address 0x5a5a5a66>
[4]: <error: Cannot access memory at address 0x5a5a5a6a>
[5]: <error: Cannot access memory at address 0x5a5a5a6e>
[6]: <error: Cannot access memory at address 0x5a5a5a72>
[7]: <error: Cannot access memory at address 0x5a5a5a76>
[8]: <error: Cannot access memory at address 0x5a5a5a7a>
[9]: <error: Cannot access memory at address 0x5a5a5a7e>
[10]: <error: Cannot access memory at address 0x5a5a5a82>
[11]: <error: Cannot access memory at address 0x5a5a5a86>
[12]: <error: Cannot access memory at address 0x5a5a5a8a>
[13]: <error: Cannot access memory at address 0x5a5a5a8e>
[14]: <error: Cannot access memory at address 0x5a5a5a92>
[15]: <error: Cannot access memory at address 0x5a5a5a96>
[16]: <error: Cannot access memory at address 0x5a5a5a9a>
[17]: <error: Cannot access memory at address 0x5a5a5a9e>
[18]: <error: Cannot access memory at address 0x5a5a5aa2>
[19]: <error: Cannot access memory at address 0x5a5a5aa6>
[20]: <error: Cannot access memory at address 0x5a5a5aaa>
[21]: <error: Cannot access memory at address 0x5a5a5aae>
[22]: <error: Cannot access memory at address 0x5a5a5ab2>
[23]: <error: Cannot access memory at address 0x5a5a5ab6>
[24]: <error: Cannot access memory at address 0x5a5a5aba>
[25]: <error: Cannot access memory at address 0x5a5a5abe>
[26]: <error: Cannot access memory at address 0x5a5a5ac2>
[27]: <error: Cannot access memory at address 0x5a5a5ac6>
[28]: <error: Cannot access memory at address 0x5a5a5aca>
[29]: <error: Cannot access memory at address 0x5a5a5ace>
[30]: <error: Cannot access memory at address 0x5a5a5ad2>

vtable for 'nsWrapperCache' @ 0x5a5a5a5a (subobject @ 0xb0925b04):
[0]: <error: Cannot access memory at address 0x5a5a5a5a>

Comment 12

[Bruce Sun [:brsun]]

From the following logs and call stack of the chrome process, |BluetoothGattClient| is unregistered by the content process either from |BluetoothGatt::~BluetoothGatt()| or from |BluetoothGatt::DisconnectFromOwner()|. After the unregistration procedure has completed, the corresponding |BluetoothGattClient| is no longer exists in |sClients|. But if there is a established connection between the adaptor and the device, |btgatt_client_callbacks_t.disconnect_callback| will be triggered from the stack.

Currently |BluetoothGattManager| simply crashes if |BluetoothGattManager| cannot find a matched |BluetoothGattClient| from |sClients| with almost all the callbacks. So the chrome process restarts as a result.

==================================================
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattClient::BluetoothGattClient(this:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}, aSuccess:true) enters
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattClient::BluetoothGattClient(this:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}, aSuccess:true) leaves
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ProceedDiscoverProcess(aClient:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::GetDescriptorNotification(aConnId:262, aStatus:18, client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::Get(mInShutdown:false, sBluetoothGattManager:0xaedc4da0) enters
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::Get(mInShutdown:false, sBluetoothGattManager:0xaedc4da0) early leaves
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssi(aClientIf:6, aDeviceAddr:68:cb:6a:0d:d8:f2) enters
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssi(client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262})
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssiResultHandler::ReadRemoteRssiResultHandler(aClient:0xae93d5e0, {mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) enters
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssiResultHandler::ReadRemoteRssiResultHandler(mClient:0xae93d5e0, {mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssi(aClientIf:6, aDeviceAddr:68:cb:6a:0d:d8:f2, client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssiNotification(aClientIf:6, aBdAddr:68:cb:6a:0d:d8:f2, aRssi:-41, aStatus:0) enters
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssiNotification(client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262})
05-29 17:51:35.150   210   210 I brsun   : BluetoothGattManager::ReadRemoteRssiNotification(aClientIf:6, aBdAddr:68:cb:6a:0d:d8:f2, aRssi:-41, aStatus:0, client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::Get(mInShutdown:false, sBluetoothGattManager:0xaedc4da0) enters
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::Get(mInShutdown:false, sBluetoothGattManager:0xaedc4da0) early leaves
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClient(aClientIf:6) enters
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClient(client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262})
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClientResultHandler::UnregisterClientResultHandler(aClient:0xae93d5e0, {mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) enters
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClientResultHandler::UnregisterClientResultHandler(mClient:0xae93d5e0, {mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClient(aClientIf:6, client:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClientResultHandler::UnregisterClient(mClient:0xae93d5e0, {mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) enters
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::UnregisterClientResultHandler::UnregisterClient(mClient:0xae93d5e0, {mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattClient::~BluetoothGattClient(this:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) enters
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattClient::~BluetoothGattClient(this:{mAppUuid:8aaa3162-3a35-48a6-a14b-988291b0e6b8, mDeviceAddr:68:cb:6a:0d:d8:f2, mClientIf:6, mConnId:262}) leaves
05-29 17:51:36.640   210   210 I brsun   : BluetoothGattManager::DisconnectNotification(aConnId:262, aStatus:0, aClientIf:6, aDeviceAddr:68:cb:6a:0d:d8:f2) early leaves
==================================================

==================================================
Program received signal SIGSEGV, Segmentation fault.
nsRefPtr<gfxFontFamily>::nsRefPtr (this=0xbebde714, aSmartPtr=...) at ../../dist/include/nsRefPtr.h:83
83	      mRawPtr->AddRef();
(gdb) bt
#0  nsRefPtr<gfxFontFamily>::nsRefPtr (this=0xbebde714, aSmartPtr=...) at ../../dist/include/nsRefPtr.h:83
#1  0xb50939a0 in mozilla::dom::bluetooth::BluetoothGattManager::DisconnectNotification (this=<optimized out>, aConnId=262, aStatus=mozilla::dom::bluetooth::GATT_STATUS_SUCCESS, aClientIf=6, 
    aDeviceAddr=...) at ../../../../mozilla-central-working/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:1680
#2  0xb508fe76 in mozilla::dom::bluetooth::BluetoothNotificationHALRunnable4<mozilla::dom::bluetooth::BluetoothGattClientCallback::GattClientNotificationHandlerWrapper, void, int, mozilla::dom::bluetooth::BluetoothGattStatus, int, nsString, int, mozilla::dom::bluetooth::BluetoothGattStatus, int, nsAString_internal const&>::Run (this=<optimized out>)
    at ../../../../mozilla-central-working/dom/bluetooth/bluedroid/BluetoothHALHelpers.h:1473
#3  0xb4ba4ac0 in nsThread::ProcessNextEvent (this=0xb6a02630, aMayWait=<optimized out>, aResult=0xbebde84f) at ../../../../mozilla-central-working/xpcom/threads/nsThread.cpp:846
#4  0xb4bb2f42 in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=aMayWait@entry=true) at /home/bruce_sun/Source/mozilla-central-working/xpcom/glue/nsThreadUtils.cpp:265
#5  0xb4cf814a in mozilla::ipc::MessagePump::Run (this=0xb2de1220, aDelegate=0xb2dd91a0) at ../../../../mozilla-central-working/ipc/glue/MessagePump.cpp:127
#6  0xb4ce90bc in MessageLoop::RunInternal (this=this@entry=0xb2dd91a0) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:233
#7  0xb4ce9170 in RunHandler (this=0xb2dd91a0) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:226
#8  MessageLoop::Run (this=0xb2dd91a0) at ../../../../mozilla-central-working/ipc/chromium/src/base/message_loop.cc:200
#9  0xb569500e in nsBaseAppShell::Run (this=0xb197a3a0) at ../../../mozilla-central-working/widget/nsBaseAppShell.cpp:165
#10 0xb59b999e in nsAppStartup::Run (this=0xb133e3a0) at ../../../../../mozilla-central-working/toolkit/components/startup/nsAppStartup.cpp:280
#11 0xb59da652 in XREMain::XRE_mainRun (this=this@entry=0xbebde9c4) at ../../../../mozilla-central-working/toolkit/xre/nsAppRunner.cpp:4244
#12 0xb59da890 in XREMain::XRE_main (this=this@entry=0xbebde9c4, argc=argc@entry=1, argv=argv@entry=0xb6a2b190, aAppData=aAppData@entry=0xb6f3cc68 <_ZL8sAppData>)
    at ../../../../mozilla-central-working/toolkit/xre/nsAppRunner.cpp:4328
#13 0xb59daa02 in XRE_main (argc=1, argv=0xb6a2b190, aAppData=0xb6f3cc68 <_ZL8sAppData>, aFlags=<optimized out>) at ../../../../mozilla-central-working/toolkit/xre/nsAppRunner.cpp:4417
#14 0xb6f1e7fc in do_main (argc=argc@entry=1, argv=argv@entry=0xb6a2b190) at ../../../../mozilla-central-working/b2g/app/nsBrowserApp.cpp:167
#15 0xb6f1e90a in b2g_main (argc=argc@entry=1, argv=argv@entry=0xbebdfc84) at ../../../../mozilla-central-working/b2g/app/nsBrowserApp.cpp:299
#16 0xb6f1e68c in RunProcesses (aReservedFds=..., argv=0xbebdfc84, argc=1) at ../../../../mozilla-central-working/b2g/app/B2GLoader.cpp:232
#17 main (argc=1, argv=0xbebdfc84) at ../../../../mozilla-central-working/b2g/app/B2GLoader.cpp:297
==================================================

[1] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/BluetoothGatt.cpp#72
[2] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/BluetoothGatt.cpp#89

Comment 13

[Bruce Sun [:brsun]]

Probably the only thing we can do is trying to ignore any callbacks that refers to a unmatched client.

Comment 14

[Jocelyn Liu [:jocelyn] [:joliu]]

(In reply to Bruce Sun [:brsun] from comment #13)
> Probably the only thing we can do is trying to ignore any callbacks that
> refers to a unmatched client.

Personally I agree with this approach.
(Use NS_WARN_IF instead of MOZ_ASSERT in result handlers and notification callbacks when we couldn't find an existing client)
Just need to think twice to make sure we won't cause any side effects, though none I can think of at this moment.

Comment 15

[Bruce Sun [:brsun]]

Attachment: bug1161956_gatt_client_crash.patch

Hi Eddie,

Would you please help try this patch and see if it helps or not?

Comment 16

[elin]

Comment on attachment 8613434 [details] [diff] [review]
bug1161956_gatt_client_crash.patch

I tried this patch, 
and the "Something just crashed" message won't appear now.

But It still restarts automatically when stopping this App
https://github.com/evanxd/wot-pong
Not sure if it's due to some retry-logic here:
https://github.com/evanxd/wot-pong/blob/master/js/bluetooth_helper.js

Comment 17

[elin]

Below is what I got from GDB when I stop the app and encounter a restart.

---Type <return> to continue, or q <return> to quit---

Program received signal SIGSEGV, Segmentation fault.
mozilla::dom::bluetooth::BluetoothGattManager::DisconnectNotification (this=<optimized out>, aConnId=<optimized out>, aStatus=mozilla::dom::bluetooth::GATT_STATUS_SUCCESS, aClientIf=4, 
    aDeviceAddr=...) at /home/elin/Srcs/btv2-b2g-new/gecko/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:1535
1535	  client->mConnId = 0;
(gdb) bt
#0  mozilla::dom::bluetooth::BluetoothGattManager::DisconnectNotification (this=<optimized out>, aConnId=<optimized out>, aStatus=mozilla::dom::bluetooth::GATT_STATUS_SUCCESS, aClientIf=4, 
    aDeviceAddr=...) at /home/elin/Srcs/btv2-b2g-new/gecko/dom/bluetooth/bluedroid/BluetoothGattManager.cpp:1535
#1  0xb50af346 in mozilla::dom::bluetooth::BluetoothNotificationHALRunnable4<mozilla::dom::bluetooth::BluetoothGattClientCallback::GattClientNotificationHandlerWrapper, void, int, mozilla::dom::bluetooth::BluetoothGattStatus, int, nsString, int, mozilla::dom::bluetooth::BluetoothGattStatus, int, nsAString_internal const&>::Run (this=<optimized out>)
    at /home/elin/Srcs/btv2-b2g-new/gecko/dom/bluetooth/bluedroid/BluetoothHALHelpers.h:1473
#2  0xb4bc7278 in nsThread::ProcessNextEvent (this=0xb6a02630, aMayWait=<optimized out>, aResult=0xbee41857) at /home/elin/Srcs/btv2-b2g-new/gecko/xpcom/threads/nsThread.cpp:866
#3  0xb4bd5428 in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=aMayWait@entry=false) at /home/elin/Srcs/btv2-b2g-new/gecko/xpcom/glue/nsThreadUtils.cpp:265
#4  0xb4d1a670 in mozilla::ipc::MessagePump::Run (this=0xb6aff160, aDelegate=0xb2ed31a0) at /home/elin/Srcs/btv2-b2g-new/gecko/ipc/glue/MessagePump.cpp:95
#5  0xb4d0b6ac in MessageLoop::RunInternal (this=this@entry=0xb2ed31a0) at /home/elin/Srcs/btv2-b2g-new/gecko/ipc/chromium/src/base/message_loop.cc:233
#6  0xb4d0b760 in RunHandler (this=0xb2ed31a0) at /home/elin/Srcs/btv2-b2g-new/gecko/ipc/chromium/src/base/message_loop.cc:226
#7  MessageLoop::Run (this=0xb2ed31a0) at /home/elin/Srcs/btv2-b2g-new/gecko/ipc/chromium/src/base/message_loop.cc:200
#8  0xb56a1f16 in mozilla::widget::ScreenProxy::InvalidateCache (this=0x1) at /home/elin/Srcs/btv2-b2g-new/gecko/widget/ScreenProxy.cpp:188
#9  0xb56a1f16 in mozilla::widget::ScreenProxy::InvalidateCache (this=0x1) at /home/elin/Srcs/btv2-b2g-new/gecko/widget/ScreenProxy.cpp:188
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) c
Continuing.

Child exited with status 11
[Inferior 1 (process 2882) exited with code 013]

Comment 18

[elin]

Comment on attachment 8613434 [details] [diff] [review]
bug1161956_gatt_client_crash.patch

It seems like everything works fine after I do a clean build.
It won't restart automatically now!

Thanks for the great work!

Comment 19

[Bruce Sun [:brsun]]

(In reply to elin from comment #18)
> Comment on attachment 8613434 [details] [diff] [review]
> bug1161956_gatt_client_crash.patch
> 
> It seems like everything works fine after I do a clean build.
> It won't restart automatically now!
> 
> Thanks for the great work!

Thanks for your valuable feedback!

Comment 20

[Jocelyn Liu [:jocelyn] [:joliu]]

Comment on attachment 8613434 [details] [diff] [review]
bug1161956_gatt_client_crash.patch

Review of attachment 8613434 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM, thanks.

Comment 21

[Bruce Sun [:brsun]]

Attachment: bug1161956_gatt_client_crash.commit.patch

Comment 22

[Bruce Sun [:brsun]]

Bluetooth2 is not built by default.

Comment 23

[Pulsebot]

https://hg.mozilla.org/integration/b2g-inbound/rev/ce7b42bbf717

Comment 24

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/ce7b42bbf717