1162893 - [bluetooth2] App crashed after write characteristic

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[elin]

Attachment: write-characteristic-crash.log

https://bugzilla.mozilla.org/show_bug.cgi?id=1161939
After this bug fixed,
I rebuilt b2g and tried to write characteristic again,
now it crashed with some error logs.

I guess these two lines are closest to the root cause?
maybe I'm wrong...

I/Gecko   ( 3696): IPDL protocol error: Error deserializing 'writeType' (BluetoothGattWriteType) member of 'GattClientWriteCharacteristicValueRequest'
I/Gecko   ( 3696): IPDL protocol error: Error deserializing 'Request'

also detail logs are attached.

Comment 1

[Jocelyn Liu [:jocelyn] [:joliu]]

I will take a look, thanks for reporting.

Comment 2

[elin]

In addition,
here's the code I use to write descriptor:
https://github.com/elin-moco/ble-explorer/blob/master/main.js#L531
basically I create the value array the same way as descriptor.writeValue,
and my write descriptor code is working fine.

Comment 3

[Bruce Sun [:brsun]]

I guess the root cause should be because |ParamTraits| of |BluetoothGattCharAttribute|[1] doesn't pass |mWriteType| during serialization and deserialization[2], so |BluetoothGattCharacteristic::mWriteType|[3] doesn't have chances to have a proper value during its initialization[4]. When |BluetoothGattCharacteristic::WriteValue()|[5] is called, the value validation for |BluetoothGattWriteType|[6] could fail easily due to passing a garbage value.

[1] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/ipc/BluetoothMessageUtils.h#115
[2] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/BluetoothCommon.h#718
[3] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/BluetoothGattCharacteristic.cpp#66
[4] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/BluetoothGattService.cpp#109
[5] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/BluetoothGattCharacteristic.cpp#319
[6] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/bluetooth2/ipc/BluetoothMessageUtils.h#41

Comment 4

[Bruce Sun [:brsun]]

Attachment: bug1162893_gatt_characteristic_writetype_serialization.patch

Comment 5

[Bruce Sun [:brsun]]

Eddie,

Would you help to try the patch on comment 4 to see if it helps or not?

Comment 6

[Jocelyn Liu [:jocelyn] [:joliu]]

Reassign to Bruce since he found the root cause. :)

Comment 7

[elin]

(In reply to Bruce Sun [:brsun] from comment #5)
> Eddie,
> 
> Would you help to try the patch on comment 4 to see if it helps or not?

OK, I'll try to build with the patch first,
and I'll try it on my flame on Monday.

Comment 8

[elin]

Comment on attachment 8603304 [details] [diff] [review]
bug1162893_gatt_characteristic_writetype_serialization.patch

Review of attachment 8603304 [details] [diff] [review]:
-----------------------------------------------------------------

Hooray!!!
I'm able to blink LED and rotate servo through characteristic.writeValue now!
Thanks for the patch!

Comment 9

[Jocelyn Liu [:jocelyn] [:joliu]]

Comment on attachment 8603304 [details] [diff] [review]
bug1162893_gatt_characteristic_writetype_serialization.patch

Review of attachment 8603304 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM.
Thanks for fixing this.

Comment 10

[Bruce Sun [:brsun]]

Attachment: bug1162893_gatt_characteristic_writetype_serialization.commit.patch

Comment 11

[Bruce Sun [:brsun]]

Files under bluetooth2 is not built/compiled by default for the moment.

Comment 12

[Pulsebot]

https://hg.mozilla.org/integration/b2g-inbound/rev/ddb0bfa1e15a

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ddb0bfa1e15a