Closed Bug 1234974 Opened 4 years ago Closed 4 years ago

[emulator-x86-kk][mochitest] PROCESS-CRASH | dom/permission/tests/test_bluetooth.html | application crashed [@ mozilla::dom::bluetooth::BluetoothAdapter::IsBluetoothCertifiedApp()]

Categories

(Firefox OS Graveyard :: Bluetooth, defect)

ARM
Gonk (Firefox OS)
defect
Not set

Tracking

(firefox46 fixed)

RESOLVED FIXED
Tracking Status
firefox46 --- fixed

People

(Reporter: edgar, Assigned: ben.tian)

References

Details

Attachments

(2 files, 1 obsolete file)

https://treeherder.mozilla.org/logviewer.html#?job_id=14847479&repo=try

[...]
13:33:24  WARNING -  PROCESS-CRASH | dom/permission/tests/test_bluetooth.html | application crashed [@ mozilla::dom::bluetooth::BluetoothAdapter::IsBluetoothCertifiedApp()]
13:33:24     INFO -  Crash dump filename: /tmp/tmpIvbcge/0bd83bed-4f0a-b156-3613f1b6-2b5797c8.dmp
13:33:24     INFO -  Operating system: Android
13:33:24     INFO -                    0.0.0 Linux 3.4.0+ #1 PREEMPT Fri Dec 5 17:28:48 PST 2014 i686 Android/full_x86/generic_x86:4.4.2/KOT49H/eng.worker.20151223.122803:eng/test-keys
13:33:24     INFO -  CPU: x86
13:33:24     INFO -       GenuineIntel family 6 model 3 stepping 3
13:33:24     INFO -       1 CPU
13:33:24     INFO -  Crash reason:  SIGSEGV
13:33:24     INFO -  Crash address: 0x8
13:33:24     INFO -  Thread 0 (crashed)
13:33:24     INFO -   0  libxul.so!mozilla::dom::bluetooth::BluetoothAdapter::IsBluetoothCertifiedApp() [nsCOMPtr.h : 721 + 0x3]
13:33:24     INFO -      eip = 0xb3d20935   esp = 0xbfb88170   ebp = 0xbfb88258   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xad85dc40   edi = 0x00000000   eax = 0x00000000   ecx = 0xb73346a8
13:33:24     INFO -      edx = 0xb5a9a0a8   efl = 0x00200292
13:33:24     INFO -      Found by: given as instruction pointer in context
13:33:24     INFO -   1  libxul.so!mozilla::dom::bluetooth::BluetoothAdapter::BluetoothAdapter(nsPIDOMWindow*, mozilla::dom::bluetooth::BluetoothValue const&) [BluetoothAdapter.cpp:3779955620ed : 334 + 0x7]
13:33:24     INFO -      eip = 0xb3d24815   esp = 0xbfb88260   ebp = 0xbfb882a8   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xad85dc40   edi = 0x00000000
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   2  libxul.so!mozilla::dom::bluetooth::BluetoothAdapter::Create(nsPIDOMWindow*, mozilla::dom::bluetooth::BluetoothValue const&) [BluetoothAdapter.cpp:3779955620ed : 498 + 0x4]
13:33:24     INFO -      eip = 0xb3d248df   esp = 0xbfb882b0   ebp = 0xbfb882e8   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb88314   edi = 0xad85dc40
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   3  libxul.so!mozilla::dom::bluetooth::BluetoothManager::AppendAdapter(mozilla::dom::bluetooth::BluetoothValue const&) [BluetoothManager.cpp:3779955620ed : 155 + 0x1a]
13:33:24     INFO -      eip = 0xb3d305d5   esp = 0xbfb882f0   ebp = 0xbfb88348   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xaafffbc0   edi = 0xbfb88318
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   4  libxul.so!GetAdaptersTask::ParseSuccessfulReply(JS::MutableHandle<JS::Value>) [BluetoothManager.cpp:3779955620ed : 91 + 0xa]
13:33:24     INFO -      eip = 0xb3d3082b   esp = 0xbfb88350   ebp = 0xbfb88378   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0x00000001   edi = 0xad9542dc
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   5  libxul.so!mozilla::dom::bluetooth::BluetoothReplyRunnable::Run() [BluetoothReplyRunnable.cpp:3779955620ed : 103 + 0x6]
13:33:24     INFO -      eip = 0xb3d1ca81   esp = 0xbfb88380   ebp = 0xbfb88418   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xada240d0   edi = 0xbfb883b0
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   6  libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:3779955620ed : 964 + 0x5]
13:33:24     INFO -      eip = 0xb34ce97c   esp = 0xbfb88420   ebp = 0xbfb88498   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb884bf   edi = 0x00000000
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   7  libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:3779955620ed : 297 + 0x11]
13:33:24     INFO -      eip = 0xb34e9fb6   esp = 0xbfb884a0   ebp = 0xbfb884c8   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0x00000000   edi = 0xbfb886d0
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   8  libxul.so!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) [MessagePump.cpp:3779955620ed : 95 + 0xb]
13:33:24     INFO -      eip = 0xb36f7d38   esp = 0xbfb884d0   ebp = 0xbfb88518   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xb1f596a0   edi = 0xbfb886d0
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -   9  libxul.so!MessageLoop::RunInternal() [message_loop.cc:3779955620ed : 234 + 0x5]
13:33:24     INFO -      eip = 0xb36daba2   esp = 0xbfb88520   ebp = 0xbfb88538   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xb1f02630
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  10  libxul.so!MessageLoop::Run() [message_loop.cc:3779955620ed : 227 + 0x7]
13:33:24     INFO -      eip = 0xb36dacd0   esp = 0xbfb88540   ebp = 0xbfb88568   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xb1f02630
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  11  libxul.so!nsBaseAppShell::Run() [nsBaseAppShell.cpp:3779955620ed : 156 + 0xd]
13:33:24     INFO -      eip = 0xb47bac6f   esp = 0xbfb88570   ebp = 0xbfb88588   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xb0046d60   edi = 0xb1f02630
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  12  libxul.so!XRE_RunAppShell [nsEmbedFunctions.cpp:3779955620ed : 787 + 0x8]
13:33:24     INFO -      eip = 0xb4d662e1   esp = 0xbfb88590   ebp = 0xbfb885b8   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xbfb89963
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  13  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) [MessagePump.cpp:3779955620ed : 259 + 0x4]
13:33:24     INFO -      eip = 0xb36f7e16   esp = 0xbfb885c0   ebp = 0xbfb885e8   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xbfb89963
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  14  libxul.so!MessageLoop::RunInternal() [message_loop.cc:3779955620ed : 234 + 0x5]
13:33:24     INFO -      eip = 0xb36daba2   esp = 0xbfb885f0   ebp = 0xbfb88608   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xbfb89963
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  15  libxul.so!MessageLoop::Run() [message_loop.cc:3779955620ed : 227 + 0x7]
13:33:24     INFO -      eip = 0xb36dacd0   esp = 0xbfb88610   ebp = 0xbfb88638   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xbfb89963
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  16  libxul.so!XRE_InitChildProcess [nsEmbedFunctions.cpp:3779955620ed : 623 + 0xe]
13:33:24     INFO -      eip = 0xb4d66aa0   esp = 0xbfb88640   ebp = 0xbfb89008   ebx = 0xb73346a8
13:33:24     INFO -      esi = 0xbfb886d0   edi = 0xbfb89963
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  17  plugin-container!content_process_main(int, char**) [plugin-container.cpp:3779955620ed : 237 + 0x8]
13:33:24     INFO -      eip = 0xb77db982   esp = 0xbfb89010   ebp = 0xbfb89048   ebx = 0xb77dcfb4
13:33:24     INFO -      esi = 0xbfb890e4   edi = 0x00000007
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  18  plugin-container!main [MozillaRuntimeMain.cpp:3779955620ed : 11 + 0x9]
13:33:24     INFO -      eip = 0xb77db9ab   esp = 0xbfb89050   ebp = 0xbfb89068   ebx = 0xb771ffcc
13:33:24     INFO -      esi = 0xbfb89108   edi = 0x00000008
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  19  libc.so!__libc_init [libc_init_dynamic.cpp : 112 + 0xe]
13:33:24     INFO -      eip = 0xb769152d   esp = 0xbfb89070   ebp = 0xbfb890e4
13:33:24     INFO -      Found by: previous frame's frame pointer
13:33:24     INFO -  20  plugin-container + 0xfb3
13:33:24     INFO -      eip = 0xb77dcfb4   esp = 0xbfb890a0   ebp = 0xb76914c9   ebx = 0xb77d8f04
13:33:24     INFO -      esi = 0x00000000   edi = 0x00000000
13:33:24     INFO -      Found by: call frame info
13:33:24     INFO -  21  plugin-container!content_process_main(int, char**) [plugin-container.cpp:3779955620ed : 241 + 0x7]
13:33:24     INFO -      eip = 0xb77db990   esp = 0xbfb890bc   ebp = 0xb76914c9
13:33:24     INFO -      Found by: stack scanning
[...]
See Also: → 1234127, 1175389
Edgar,

Per offline discussion, please attach your test change to help reproduce the crash.
Flags: needinfo?(echen)
You need multiple patches from different bugs that helps to dump more detail information,
- bug 1215084: make minidump works, so you can see crash stack.
- bug 1207040: fix crash on mochitest shutdown.
- bug 1235734: show more logs in treeherder.

I squash them into one. Please let me know if you need any help. Thank you.
Flags: needinfo?(echen)
Attached patch bug_1234974_mgr-owner.patch (obsolete) — Splinter Review
Edgar, can you help reproduce with attached patch for more logs?

I have difficulty to meet the identical bluetooth crash. Not sure if I missed some steps.
Flags: needinfo?(echen)
Note the patch doesn't modify code flow but only prints more logs.

(In reply to Ben Tian [:btian] from comment #5)
> Created attachment 8704464 [details] [diff] [review]
> bug_1234974_mgr-owner.patch
> 
> Edgar, can you help reproduce with attached patch for more logs?
> 
> I have difficulty to meet the identical bluetooth crash. Not sure if I
> missed some steps.
I triggered a try run with applying your patch to reproduce this, https://treeherder.mozilla.org/#/jobs?repo=try&revision=f4db2de19b38&exclusion_profile=false. (The crash is usually happening in chunk 34)
(In reply to Edgar Chen [:edgar][:echen] from comment #7)
> I triggered a try run with applying your patch to reproduce this,
> https://treeherder.mozilla.org/#/
> jobs?repo=try&revision=f4db2de19b38&exclusion_profile=false. (The crash is
> usually happening in chunk 34)

Thanks Edgar. The log shows window bound on BluetoothManager [1][2] is nullptr, resulting in nullptr owner of BluetoothAdapter.

10:43:56     INFO -  01-08 10:36:06.993 I/GeckoBluetooth( 1671): AppendAdapter: manager owner is null? 1
10:43:56     INFO -  01-08 10:36:07.003 I/GeckoBluetooth( 1671): IsBluetoothCertifiedApp: adapter owner null? 1

[1] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/common/webapi/BluetoothManager.cpp#155
[2] https://dxr.mozilla.org/mozilla-central/source/dom/bluetooth/common/webapi/BluetoothManager.cpp#110
Flags: needinfo?(echen)
A quick fix to handle nullptr GetOwner() in BluetoothAdapter.
Attachment #8704464 - Attachment is obsolete: true
See Also: → 1214444
Attachment #8706203 - Flags: review?(shuang)
https://hg.mozilla.org/mozilla-central/rev/d81230512a10
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Revise owner accordingly.
Assignee: wiwang → btian
You need to log in before you can comment on or make changes to this bug.