830038 - [bluetooth] B2G Crash and reboot when receiving files via bluetooth file transfer

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[Parul Mathur]

Test Environment:
Device: unagi phone
Build Identifier: 20130111230201
Update channel: nightly
Git commit info: 2013-11-11 15:13:02 df38c1
Gaia Version: 45a3196a5517
Gecko Version: 8f2ef4998b60

Steps to reproduce:
1. Go to Settings and turn on Bluetooth.
2. Pair the phone with another device, like a laptop.
3. Send a file from the laptop to the phone. 

Actual results:
The phone crashes and reboots when receiving the file via bluetooth transfer.

Expected results:
The phone smoothly receives the file via bluetooth transfer.

Crash Reports:
https://crash-stats.mozilla.com/report/index/57fb04a9-5ec1-4779-8d94-342442130113

Comment 1

[Marcia Knous [:marcia]]

Frame 	Module 	Signature 	Source
0 	libxul.so 	mozalloc_abort 	mozalloc_abort.cpp:30
1 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:423
2 	libxul.so 	mozilla::dom::bluetooth::PBluetoothRequest::Transition 	PBluetoothRequest.cpp:35
3 	libxul.so 	mozilla::dom::bluetooth::PBluetoothRequestParent::Send__delete__ 	PBluetoothRequestParent.cpp:87
4 	libxul.so 	mozilla::dom::bluetooth::BluetoothRequestParent::ReplyRunnable::Run 	BluetoothParent.cpp:50
5 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:620
6 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:237
7 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:82
8 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:215
9 	libxul.so 	MessageLoop::Run 	message_loop.cc:208
10 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
11 	libxul.so 	nsAppStartup::Run 	nsAppStartup.cpp:290
12 	libxul.so 	XREMain::XRE_mainRun 	nsAppRunner.cpp:3794
13 	libxul.so 	XREMain::XRE_main 	nsAppRunner.cpp:3860
14 	libxul.so 	XRE_main 	nsAppRunner.cpp:3935
15 	b2g 	main 	nsBrowserApp.cpp:164
16 	libc.so 	__libc_init 	libc_init_dynamic.c:114
17 	libc.so 	__cxa_atexit 	atexit.c:99
18 		@0xbee99d25

Comment 2

[Marcia Knous [:marcia]]

I was able to reproduce this crash sending an RTF file from my laptop computer to the device when paired via bluetooth - I believe Parul mentioned that the original crash was found using an image file.

Comment 3

[Walter Chen[:ypwalter][:wachen]]

Device: Unagi
Build Identifier: 20130113070202
Update channel: 
   nightly b2g18 (pvt server)  
   unagi.zip	13-Jan-2013 08:06 	100M	 
   https://pvtbuilds.mozilla.org/pub/mozilla.org/b2g/nightly/mozilla-b2g18-unagi-eng/
Git commit info: 2013-11-13 15:15:51

Not able to reproduce by transferring files from ubuntu 12.04. (jpg, png, tgz files are okay.)
Will try to get rtf file later to test.

Comment 4

[Walter Chen[:ypwalter][:wachen]]

Can you state the equipment used to do tranferring of file?

Comment 5

[Alex Keybl [:akeybl]]

Sending this over to Ian in the hopes that he can reproduce/resolve overnight.

Comment 6

[[e-mail], [e-mail]]

Alex,
I cannot reproduce it on Mac with a 27MB RTF file. I will try to reproduce it again with Walter.

Comment 7

[Walter Chen[:ypwalter][:wachen]]

Device: Unagi
Build Identifier: 20130114073222
Update channel: 
   nightly b2g18 (pvt server)
   unagi.zip 14-Jan-2013 08:36 100M	 
   https://pvtbuilds.mozilla.org/pub/mozilla.org/b2g/nightly/mozilla-b2g18-unagi-eng/
Git commit info: 2013-11-14 15:45:37

Not able to reproduce by transferring files from ubuntu 12.04. 
(.jpg, .png, .tgz, and .rtf)



Parul Mathur and Marcia Knous,

Can you give us more information? Like what devices you are connecting to, and so on.

Comment 8

[Parul Mathur]

Test Environment:
Device: unagi phone
Build Identifier: 20130114073222
Update channel: nightly
Git commit info: 2013-11-11 15:13:02 df38c1
Gaia Version: 45a3196a5517
Gecko Version: 5a367713bfa4

I connected to 2 devices: Windows 7 laptop and another Unagi device.
I transferred the following file types via bluetooth: .jpg, .rtf, .ods, .xml, .mp3

I devoted a significant amount of time trying to reproduce the crash on this build, but failed to do so.

Comment 9

[Joe Cheng [:jcheng] (please needinfo)]

since this is not reproducible, tef?

Comment 11

[David Scravaglieri [:scravag]]

My bad, not a dupe.

Comment 12

[Marcia Knous [:marcia]]

I was able to only reproduce this once using today's nightly build - here are the steps as I remember them:

1. Pair unagi device with Mac
2. Began transfering a file (I am looking for the file format - http://www.youtube.com/watch?v=rGWb3LBXKJs was the video)
3. The file transfer began and then suddenly stopped, leading to an OS crash.

Gaia: 688c601f18f2
Gecko: 67503cae6a5a

Comment 13

[Thomas Zimmermann [:tzimmermann] [:tdz]]

(In reply to Marcia Knous [:marcia] from comment #12)
> I was able to only reproduce this once using today's nightly build - here
> are the steps as I remember them:
> 
> 1. Pair unagi device with Mac
> 2. Began transfering a file (I am looking for the file format -
> http://www.youtube.com/watch?v=rGWb3LBXKJs was the video)
> 3. The file transfer began and then suddenly stopped, leading to an OS crash.
>

If the transfer stopped just before the crash, it might be the same problem as bug 830704.

> Gaia: 688c601f18f2
> Gecko: 67503cae6a5a

Comment 14

[Walter Chen[:ypwalter][:wachen]]

Still can't reproduce with most up-to-date code. 
Where do you get your nightly build?
do you mean by pvt build? or your own code? is it in branch b2g18 or central?
what else can you provide so that we can try?

Comment 15

[Marcia Knous [:marcia]]

Nightly build comes from pvt directory.

When I reproduced the crash in Comment 12, I was transferring a set of different file types from my Mac laptop to the device. Out of more than 15 attempts, I only crashed once, and as Thomas said I may have hit the bug he references in Comment 13. I will attempt some more testing on this today using the latest nightly build.

(In reply to Walter Chen from comment #14)
> Still can't reproduce with most up-to-date code. 
> Where do you get your nightly build?
> do you mean by pvt build? or your own code? is it in branch b2g18 or central?
> what else can you provide so that we can try?

Comment 16

[Eric Chou [:ericchou] [:echou]]

(In reply to Marcia Knous [:marcia] from comment #15)
> Nightly build comes from pvt directory.
> 
> When I reproduced the crash in Comment 12, I was transferring a set of
> different file types from my Mac laptop to the device. Out of more than 15
> attempts, I only crashed once, and as Thomas said I may have hit the bug he
> references in Comment 13. I will attempt some more testing on this today
> using the latest nightly build.
> 

Thanks for your help, Marcia.

Comment 17

[Marcia Knous [:marcia]]

Parul: Are you still able to reproduce this issue?

Comment 18

[Parul Mathur]

Test Environment:
Device: unagi phone
Build Identifier: 20130204070201
Gaia Version: b277f372f097c
Gecko Version: 450fd3b8496b
Update channel: nightly
Git commit info: 2013-02-01 13:43:40 

Steps to reproduce:
1. Pair a bluetooth device with the phone, such a laptop.
2. Transfer via bluetooth the following file types via bluetooth: .jpg, .rtf, .ods, .xml, .mp3, .webm, .flv, .ogv

Actual results:
Could not reproduce the crash on this build.

Comment 19

[Walter Chen[:ypwalter][:wachen]]

Hi,

Since this works for u(reporter), dev, and me(qa), close this as WFM.

Thanks.

Comment 20

[Scoobidiver (away)]

There are still recent crashes: https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozalloc_abort%20|%20NS_DebugBreak_P%20|%20mozilla%3A%3Adom%3A%3Abluetooth%3A%3APBluetoothRequest%3A%3ATransition

Comment 21

[Eric Chou [:ericchou] [:echou]]

Kyle, any thoughts? It looks like we may use a free'd ReplyRunnable, but not quite sure. Will try to figure this out next week.

Comment 22

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Maybe reproduced steps are not precise? From backtrace, it looks like outgoing connection had been made? I have seen similar assertion (not the same place) in mozilla::dom::bluetooth::PBluetoothRequest::Transition while testing Bug 858436. So I suspect the execution path is probably due to outgoing HFP/OPP connection not incoming connection (receiving files).

Comment 23

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Attachment: Bug830038 patch

Comment 24

[Eric Chou [:ericchou] [:echou]]

Comment on attachment 743496 [details] [diff] [review]
Bug830038 patch

Sorry for the late reply.

This may be the same problem as bug 858436. Based on my comment (bug 858436 comment c30), we need is an assertion instead of a conditional check.

Comment 25

[Eric Chou [:ericchou] [:echou]]

Attachment: patch 1: Add an assertion

Comment 26

[Eric Chou [:ericchou] [:echou]]

birch: https://hg.mozilla.org/projects/birch/rev/2b4281dba4bf

Comment 27

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2b4281dba4bf