792307 - Gallery terminated on startup after "This file has not been opened (or could not be opened). Sending an invalid file descriptor to the other process!" and IPDL errors

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

After a clean flash of a "user" build made from m-c 0a28200d2954 and gaia 14f197fa6202f80ecebe3cb8121ade94a8a401f5 .

I reproduced the crash twice, and then the gallery just started doing nothing after startup.  The only suspicious thing I see in logcat is

E/GeckoConsole(  106): Content JS WARN at app://system.gaiamobile.org/js/window_manager.js:402 in getScreenshotTimeout: Window Manager: getScreenshot timeout.

I wonder if maybe the window manager kills an app if the screenshot times out?

On one of the do-nothing runs I saw

E/GeckoConsole( 7541): [JavaScript Error: "TypeError: photoState is undefined" {file: "app://gallery.gaiamobile.org/js/gallery.js" line: 719}]

I can't reproduce either that error or the possible crash now.  Will reset-gaia and see if I have more luck.

Comment 1

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Can reproduce reliably once after reset-gaia.  Doesn't seem to be OOM; the last sampled PSS is ~12MB, *just* before dying.

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

  Program received signal SIGTERM, Terminated.

This is what we use when "gently" nudging content processes to exit.

timdream/djf are we force-killing apps that time out when taking screenshots?

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

(You guys are probably watching this already, but I had meant to CC when I filed the bug.  See comment 2.)

Comment 4

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

The "doing nothing" might be a corrupted DB, which is bad news bears.

Comment 5

[David Flanagan [:djf]]

Thanks for the cc, Chris. I've been seeing some weird stuff, but thought it was related to the activities work I was doing...  I'll investigate the gallery.js error you report.  I also just recently saw the gallery repeatedly scanning, failing, and rescanning the same jpeg file for metadata, and that could be a source of weirdness from the new MediaDB library I just landed.

Comment 6

[David Flanagan [:djf]]

Chris, you weren't launching the gallery as an activity from the Contacts app or Camera, were you? Was this just an ordinary launch from the homescreen?

Comment 7

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

No, STR

 (1) Launch Gallery from homescreen
 (2) Watch it process images for a second or two

then BOOM, killed by SIGTERM.

We first need to explain why it's getting SIGTERM, which is sent by the b2g process when it's in the later stages of shutdown with the child process.

Comment 8

[David Flanagan [:djf]]

Attachment: possible fix for Gallery app

Probably grasping at straws, but I was seeing a weird infinite loop where an image onerror event handler was called repeatedly. This was happening for me after launching the gallery as an inline disposition activity, maybe corrupting my database or something.  

The attached patch breaks the loop.  It would be interesting to know if it cures the symptom you're seeing here.

Comment 9

[David Flanagan [:djf]]

The photoState is undefined error on line 719 of gallery.js is harmless

I should note that I cannot reproduce this bug.  I'm using the gecko build from https://releases.mozilla.com/b2g/2012-09-18/otoro_2012-09-18_ics_us.zip and something very close to the tip of gaia with some local gallery changes.

Comment 10

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Applying the patch doesn't make the SIGTERM go away.

Comment 11

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

I also tried launching b2g from the command line to see if anything was hitting stdout/stderr, but to no avail.

Comment 12

[David Flanagan [:djf]]

To no avail because it doesn't crash on desktop or because it crashed but didn't log anything to stdout or stderr?

Comment 13

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Crashed but no additional information hitting stdout/stderr.

Comment 14

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Debug build is much more interesting

I/Gecko   (29550): [Child 29550] WARNING: This file has not been opened (or could not be opened). Sending an invalid file descriptor to the other process!: file /home/cjones/mozilla/inbound/netwerk/base/src/nsFileStreams.cpp, line 515
I/Gecko   (24954): [Parent 24954] ###!!! ASSERTION: IPDL error:: 'Error', file /home/cjones/mozilla/new-b2g/objdir-gecko/ipc/ipdl/PBlobStreamParent.cpp, line 353
I/Gecko   (24954): [Parent 24954] ###!!! ASSERTION: error deserializing (better message TODO): 'Error', file /home/cjones/mozilla/new-b2g/objdir-gecko/ipc/ipdl/PBlobStreamParent.cpp, line 354
I/Gecko   (24954): [Parent 24954] ###!!! ASSERTION: [PBlobStreamParent] killing child side as a result: 'Error', file /home/cjones/mozilla/new-b2g/objdir-gecko/ipc/ipdl/PBlobStreamParent.cpp, line 357

bent, any advice for debugging this further?  I can reproduce 100%.

Comment 15

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Might help if I CC bent! :)

bent, see comment 14.

Comment 16

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

With two more lines of context, which may or may not be relevant

E/GeckoConsole(29550): Content JS LOG at app://gallery.gaiamobile.org/js/MetadataParser.js:90 in parseImageMetadata: fallback parsing metadata for Android/data/com.google.android.apps.books/files/volumes/Y7sOAAAAIAAJ/cover_thumbnail.png
E/GeckoConsole(24954): Content JS LOG at app://gallery.gaiamobile.org/js/MetadataParser.js:90 in parseImageMetadata: fallback parsing metadata for Android/data/com.google.android.apps.books/files/volumes/Y7sOAAAAIAAJ/cover_thumbnail.png
I/Gecko   (29550): [Child 29550] WARNING: This file has not been opened (or could not be opened). Sending an invalid file descriptor to the other process!: file /home/cjones/mozilla/inbound/netwerk/base/src/nsFileStreams.cpp, line 515
I/Gecko   (24954): [Parent 24954] ###!!! ASSERTION: IPDL error:: 'Error', file /home/cjones/mozilla/new-b2g/objdir-gecko/ipc/ipdl/PBlobStreamParent.cpp, line 353
I/Gecko   (24954): [Parent 24954] ###!!! ASSERTION: error deserializing (better message TODO): 'Error', file /home/cjones/mozilla/new-b2g/objdir-gecko/ipc/ipdl/PBlobStreamParent.cpp, line 354
I/Gecko   (24954): [Parent 24954] ###!!! ASSERTION: [PBlobStreamParent] killing child side as a result: 'Error', file /home/cjones/mozilla/new-b2g/objdir-gecko/ipc/ipdl/PBlobStreamParent.cpp, line 357

A little bit after that we get

E/GeckoConsole(24954): Content JS WARN at app://system.gaiamobile.org/js/window_manager.js:402 in getScreenshotTimeout: Window Manager: getScreenshot timeout.

Comment 17

[David Flanagan [:djf]]

seems like dougt might be interested in this too, since the files in question are presumably coming through device storage

Comment 18

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Are we getting here for the files in question? http://mxr.mozilla.org/mozilla-central/source/dom/ipc/Blob.cpp#1063

Basically before we can dup() the file descriptor we have to open it in the parent (on a background thread). It looks like that isn't happening for some reason.

Comment 19

[Andrew Overholt [:overholt]]

Ben, can you take a look and re-assign if you're not the best owner?

Comment 20

[David Flanagan [:djf]]

Chris thinks that this might be the same as https://bugzilla.mozilla.org/show_bug.cgi?id=794619  I've got a reduced test case over there, so check it out.

Comment 21

[Doug Turner (:dougt)]

ben, on the main thread in the parent process, i am doing this:


  nsCOMPtr<nsIDOMBlob> blob = new nsDOMFileFile(mFile->mPath, mime, mLength, mFile->mFile);

  ContentParent* cp = static_cast<ContentParent*>(mParent->Manager());
  BlobParent* actor = cp->GetOrCreateActorForBlob(blob);

  BlobResponse response;
  response.blobParent() = actor;


in the child process, on the main thread, I am doing:


      BlobResponse r = aValue;
      BlobChild* actor = static_cast<BlobChild*>(r.blobChild());
      nsCOMPtr<nsIDOMBlob> blob = actor->GetBlob();

      jsval result = InterfaceToJsval(mRequest->GetOwner(), blob, &NS_GET_IID(nsIDOMFile));


the result is passed back to script.

Comment 22

[Doug Turner (:dougt)]

basically, we are creating file-backed blobs in the child process which is a big no-no.  

7136:I/Gecko   (21324): [Child 21324] WARNING: This file has not been opened (or could not be opened). Sending an invalid file descriptor to the other process!: file /builds/mozilla-central/netwerk/base/src/nsFileStreams.cpp, line 519

7257:I/Gecko   (21238): [Parent 21238] ###!!! ASSERTION: IPDL error:: 'Error', file /builds/mozilla-central/objdir-gonk/ipc/ipdl/PBlobStreamParent.cpp, line 360
7258:I/Gecko   (21238): [Parent 21238] ###!!! ASSERTION: error deserializing (better message TODO): 'Error', file /builds/mozilla-central/objdir-gonk/ipc/ipdl/PBlobStreamParent.cpp, line 361
7259:I/Gecko   (21238): [Parent 21238] ###!!! ASSERTION: [PBlobStreamParent] killing child side as a result: 'Error', file /builds/mozilla-central/objdir-gonk/ipc/ipdl/PBlobStreamParent.cpp, line 364


The way to fix this is to remote the creation of the blobs from the parent down to the child during the enumeration.  Patch will follow.

Comment 23

[Doug Turner (:dougt)]

fixed by 794619

Comment 24

[(PTO June 19-July 7) Ryan VanderMeulen]

Bug 794619 landed before the branch.
https://hg.mozilla.org/releases/mozilla-aurora/rev/d7c8896af07a