[bluetooth] B2G Crash and reboot when receiving files via bluetooth file transfer

RESOLVED FIXED

Status

defect
--
critical
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: parul, Assigned: echou)

Tracking

({crash, regression, unagi})

unspecified
ARM
Gonk (Firefox OS)

Firefox Tracking Flags

(blocking-b2g:-, b2g18 affected)

Details

(Whiteboard: [b2g-crash][EU_TPE_TRIAGED][fixed-in-birch], crash signature)

Attachments

(2 attachments)

Test Environment:
Device: unagi phone
Build Identifier: 20130111230201
Update channel: nightly
Git commit info: 2013-11-11 15:13:02 df38c1
Gaia Version: 45a3196a5517
Gecko Version: 8f2ef4998b60

Steps to reproduce:
1. Go to Settings and turn on Bluetooth.
2. Pair the phone with another device, like a laptop.
3. Send a file from the laptop to the phone. 

Actual results:
The phone crashes and reboots when receiving the file via bluetooth transfer.

Expected results:
The phone smoothly receives the file via bluetooth transfer.

Crash Reports:
https://crash-stats.mozilla.com/report/index/57fb04a9-5ec1-4779-8d94-342442130113
Frame 	Module 	Signature 	Source
0 	libxul.so 	mozalloc_abort 	mozalloc_abort.cpp:30
1 	libxul.so 	NS_DebugBreak_P 	nsDebugImpl.cpp:423
2 	libxul.so 	mozilla::dom::bluetooth::PBluetoothRequest::Transition 	PBluetoothRequest.cpp:35
3 	libxul.so 	mozilla::dom::bluetooth::PBluetoothRequestParent::Send__delete__ 	PBluetoothRequestParent.cpp:87
4 	libxul.so 	mozilla::dom::bluetooth::BluetoothRequestParent::ReplyRunnable::Run 	BluetoothParent.cpp:50
5 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:620
6 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:237
7 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:82
8 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:215
9 	libxul.so 	MessageLoop::Run 	message_loop.cc:208
10 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
11 	libxul.so 	nsAppStartup::Run 	nsAppStartup.cpp:290
12 	libxul.so 	XREMain::XRE_mainRun 	nsAppRunner.cpp:3794
13 	libxul.so 	XREMain::XRE_main 	nsAppRunner.cpp:3860
14 	libxul.so 	XRE_main 	nsAppRunner.cpp:3935
15 	b2g 	main 	nsBrowserApp.cpp:164
16 	libc.so 	__libc_init 	libc_init_dynamic.c:114
17 	libc.so 	__cxa_atexit 	atexit.c:99
18 		@0xbee99d25
blocking-b2g: --- → tef?
Crash Signature: [@ mozalloc_abort | NS_DebugBreak_P | mozilla::dom::bluetooth::PBluetoothRequest::Transition]
Summary: [bluetooth] Crash and reboot when receiving files via bluetooth file transfer → [bluetooth] B2G Crash and reboot when receiving files via bluetooth file transfer
I was able to reproduce this crash sending an RTF file from my laptop computer to the device when paired via bluetooth - I believe Parul mentioned that the original crash was found using an image file.
Severity: normal → critical
Hardware: Other → ARM
Whiteboard: [b2g-crash]
Device: Unagi
Build Identifier: 20130113070202
Update channel: 
   nightly b2g18 (pvt server)  
   unagi.zip	13-Jan-2013 08:06 	100M	 
   https://pvtbuilds.mozilla.org/pub/mozilla.org/b2g/nightly/mozilla-b2g18-unagi-eng/
Git commit info: 2013-11-13 15:15:51

Not able to reproduce by transferring files from ubuntu 12.04. (jpg, png, tgz files are okay.)
Will try to get rtf file later to test.
Can you state the equipment used to do tranferring of file?
blocking-b2g: tef? → tef+
Keywords: regression
Sending this over to Ian in the hopes that he can reproduce/resolve overnight.
Assignee: nobody → iliu
Alex,
I cannot reproduce it on Mac with a 27MB RTF file. I will try to reproduce it again with Walter.
Device: Unagi
Build Identifier: 20130114073222
Update channel: 
   nightly b2g18 (pvt server)
   unagi.zip 14-Jan-2013 08:36 100M	 
   https://pvtbuilds.mozilla.org/pub/mozilla.org/b2g/nightly/mozilla-b2g18-unagi-eng/
Git commit info: 2013-11-14 15:45:37

Not able to reproduce by transferring files from ubuntu 12.04. 
(.jpg, .png, .tgz, and .rtf)



Parul Mathur and Marcia Knous,

Can you give us more information? Like what devices you are connecting to, and so on.
Flags: needinfo?(parul)
Flags: needinfo?(mozillamarcia.knous)
Test Environment:
Device: unagi phone
Build Identifier: 20130114073222
Update channel: nightly
Git commit info: 2013-11-11 15:13:02 df38c1
Gaia Version: 45a3196a5517
Gecko Version: 5a367713bfa4

I connected to 2 devices: Windows 7 laptop and another Unagi device.
I transferred the following file types via bluetooth: .jpg, .rtf, .ods, .xml, .mp3

I devoted a significant amount of time trying to reproduce the crash on this build, but failed to do so.
Flags: needinfo?(parul)
since this is not reproducible, tef?
blocking-b2g: tef+ → tef?
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 830551
My bad, not a dupe.
Status: RESOLVED → REOPENED
Flags: needinfo?(mozillamarcia.knous)
Resolution: DUPLICATE → ---
blocking-b2g: tef? → -
Keywords: qawanted
Whiteboard: [b2g-crash] → [b2g-crash], [EU_TPE_TRIAGED]
I was able to only reproduce this once using today's nightly build - here are the steps as I remember them:

1. Pair unagi device with Mac
2. Began transfering a file (I am looking for the file format - http://www.youtube.com/watch?v=rGWb3LBXKJs was the video)
3. The file transfer began and then suddenly stopped, leading to an OS crash.

Gaia: 688c601f18f2
Gecko: 67503cae6a5a
(In reply to Marcia Knous [:marcia] from comment #12)
> I was able to only reproduce this once using today's nightly build - here
> are the steps as I remember them:
> 
> 1. Pair unagi device with Mac
> 2. Began transfering a file (I am looking for the file format -
> http://www.youtube.com/watch?v=rGWb3LBXKJs was the video)
> 3. The file transfer began and then suddenly stopped, leading to an OS crash.
>

If the transfer stopped just before the crash, it might be the same problem as bug 830704.

> Gaia: 688c601f18f2
> Gecko: 67503cae6a5a
Assignee: iliu → echou
Severity: critical → major
Component: Gaia::Bluetooth File Transfer → General
QA Contact: wachen
Still can't reproduce with most up-to-date code. 
Where do you get your nightly build?
do you mean by pvt build? or your own code? is it in branch b2g18 or central?
what else can you provide so that we can try?
Flags: needinfo?(mozillamarcia.knous)
Nightly build comes from pvt directory.

When I reproduced the crash in Comment 12, I was transferring a set of different file types from my Mac laptop to the device. Out of more than 15 attempts, I only crashed once, and as Thomas said I may have hit the bug he references in Comment 13. I will attempt some more testing on this today using the latest nightly build.

(In reply to Walter Chen from comment #14)
> Still can't reproduce with most up-to-date code. 
> Where do you get your nightly build?
> do you mean by pvt build? or your own code? is it in branch b2g18 or central?
> what else can you provide so that we can try?
Flags: needinfo?(mozillamarcia.knous)
(In reply to Marcia Knous [:marcia] from comment #15)
> Nightly build comes from pvt directory.
> 
> When I reproduced the crash in Comment 12, I was transferring a set of
> different file types from my Mac laptop to the device. Out of more than 15
> attempts, I only crashed once, and as Thomas said I may have hit the bug he
> references in Comment 13. I will attempt some more testing on this today
> using the latest nightly build.
> 

Thanks for your help, Marcia.
Parul: Are you still able to reproduce this issue?
Test Environment:
Device: unagi phone
Build Identifier: 20130204070201
Gaia Version: b277f372f097c
Gecko Version: 450fd3b8496b
Update channel: nightly
Git commit info: 2013-02-01 13:43:40 

Steps to reproduce:
1. Pair a bluetooth device with the phone, such a laptop.
2. Transfer via bluetooth the following file types via bluetooth: .jpg, .rtf, .ods, .xml, .mp3, .webm, .flv, .ogv

Actual results:
Could not reproduce the crash on this build.
Hi,

Since this works for u(reporter), dev, and me(qa), close this as WFM.

Thanks.
Status: REOPENED → RESOLVED
Closed: 7 years ago7 years ago
Resolution: --- → WORKSFORME
There are still recent crashes: https://crash-stats.mozilla.com/report/list?product=B2G&signature=mozalloc_abort%20|%20NS_DebugBreak_P%20|%20mozilla%3A%3Adom%3A%3Abluetooth%3A%3APBluetoothRequest%3A%3ATransition
Severity: major → critical
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
Whiteboard: [b2g-crash], [EU_TPE_TRIAGED] → [b2g-crash][EU_TPE_TRIAGED]
Kyle, any thoughts? It looks like we may use a free'd ReplyRunnable, but not quite sure. Will try to figure this out next week.
Maybe reproduced steps are not precise? From backtrace, it looks like outgoing connection had been made? I have seen similar assertion (not the same place) in mozilla::dom::bluetooth::PBluetoothRequest::Transition while testing Bug 858436. So I suspect the execution path is probably due to outgoing HFP/OPP connection not incoming connection (receiving files).
Comment on attachment 743496 [details] [diff] [review]
Bug830038 patch

Sorry for the late reply.

This may be the same problem as bug 858436. Based on my comment (bug 858436 comment c30), we need is an assertion instead of a conditional check.
Attachment #743496 - Flags: feedback?(echou)
Assignee: shuang → echou
Attachment #748623 - Flags: review?(gyeh)
Attachment #748623 - Flags: review?(gyeh) → review+
birch: https://hg.mozilla.org/projects/birch/rev/2b4281dba4bf
Whiteboard: [b2g-crash][EU_TPE_TRIAGED] → [b2g-crash][EU_TPE_TRIAGED][fixed-in-birch]
https://hg.mozilla.org/mozilla-central/rev/2b4281dba4bf
Status: REOPENED → RESOLVED
Closed: 7 years ago6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.