830116 - Video recording leading to segfault

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[:gerard-majax]

On Nexus S, steps to reproduce:
 1. Start Camera application
 2. Wait preview
 3. Press video recording

Expected: video recording
Got: segfault

With gdb:
./run-gdb.sh attach 1135
..ignoring gdbserver pid 1065
Attached; pid = 1135
Listening on port 12135
prebuilt/linux-x86/toolchain/arm-linux-androideabi-4.4.x/bin/arm-linux-androideabi-gdb -x /tmp/b2g.gdbinit.alex /home/alex/codaz/B2G/objdir-gecko/dist/bin/plugin-container
GNU gdb (GDB) 7.1-android-gg2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-linux-gnu --target=arm-elf-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/alex/codaz/B2G/objdir-gecko/dist/bin/plugin-container...done.
Remote debugging from host 127.0.0.1
syscall () at bionic/libc/arch-arm/bionic/syscall.S:50
50	    ldmfd   sp!, {r4, r5, r6, r7}
(gdb) break mozilla::GetPreviewStreamVideoModeTask::Run()
Breakpoint 1 at 0x4084e5a0: file /home/alex/codaz/B2G/gecko/dom/camera/CameraControlImpl.h, line 580.
(gdb) continue 
Continuing.
[New Thread 1135.1155]
[Switching to Thread 1135.1155]

Breakpoint 1, mozilla::GetPreviewStreamVideoModeTask::Run (this=0x4326d740) at /home/alex/codaz/B2G/gecko/dom/camera/CameraControlImpl.h:580
580	    nsresult rv = mCameraControl->GetPreviewStreamVideoModeImpl(this);
(gdb) print this
$1 = (mozilla::GetPreviewStreamVideoModeTask * const) 0x4326d740
(gdb) print mCameraControl 
$2 = {mRawPtr = 0x43c879d0}
(gdb) step
nsRefPtr<mozilla::CameraControlImpl>::operator-> (this=0x4326d740) at /home/alex/codaz/B2G/gecko/dom/camera/CameraControlImpl.h:580
580	    nsresult rv = mCameraControl->GetPreviewStreamVideoModeImpl(this);
(gdb) step
nsRefPtr<mozilla::CameraControlImpl>::get (this=0x4326d740) at ../../dist/include/nsAutoPtr.h:1003
1003	          return const_cast<T*>(mRawPtr);
(gdb) print mRawPtr 
Cannot access memory at address 0x0
(gdb) continue 
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x4084e17c in nsMainThreadPtrHolder<nsICameraErrorCallback>::get (this=<value optimized out>) at ../../dist/include/nsProxyRelease.h:133
133	      MOZ_CRASH();
(gdb) bt
#0  0x4084e17c in nsMainThreadPtrHolder<nsICameraErrorCallback>::get (this=<value optimized out>) at ../../dist/include/nsProxyRelease.h:133
#1  nsMainThreadPtrHandle<nsICameraErrorCallback>::get (this=<value optimized out>) at ../../dist/include/nsProxyRelease.h:181
#2  0x4084e5bc in mozilla::GetPreviewStreamVideoModeTask::Run (this=0x4326d740) at /home/alex/codaz/B2G/gecko/dom/camera/CameraControlImpl.h:583
#3  0x40bb82e2 in nsThread::ProcessNextEvent (this=0x43c7c940, mayWait=<value optimized out>, result=0x443edeb7) at /home/alex/codaz/B2G/gecko/xpcom/threads/nsThread.cpp:620
#4  0x40b9870e in NS_ProcessNextEvent_P (thread=0x0, mayWait=true) at /home/alex/codaz/B2G/objdir-gecko/xpcom/build/nsThreadUtils.cpp:237
#5  0x40bb872c in nsThread::ThreadFunc (arg=<value optimized out>) at /home/alex/codaz/B2G/gecko/xpcom/threads/nsThread.cpp:258
#6  0x4008f9b0 in _pt_root (arg=<value optimized out>) at /home/alex/codaz/B2G/gecko/nsprpub/pr/src/pthreads/ptthread.c:156
#7  0x40101c28 in __thread_entry (func=0x4008f951 <_pt_root>, arg=0x43e6e5c0, tls=<value optimized out>) at bionic/libc/bionic/pthread.c:217
#8  0x4010177c in pthread_create (thread_out=<value optimized out>, attr=0xbe8075dc, start_routine=0x4008f951 <_pt_root>, arg=0x43e6e5c0) at bionic/libc/bionic/pthread.c:357
#9  0x00000000 in ?? ()

Comment 1

[David Scravaglieri [:scravag]]

Nexus S is not fully officially supported

Comment 2

[:gerard-majax]

Yep, unfortunately, dietrich and KaiRo reported it being functionnal on Unagi. I'll have to wait mikeh for investigating on this.

Comment 3

[Mike Habicher [:mikeh] (high bugzilla latency)]

Yep, we can't resolve nsMainThreadPtrHandle/Holder objects to real pointers off of the Main Thread, else the code throws a MOZ_CRASH().  I thought I'd cover most of the cases in testing, but looks like I missed one or two.

Renoming for bb+ (it should be) but the fix is pretty simple.  I'll land a patch soon.

Comment 4

[Jason Smith [:jsmith]]

FYI - Use tef? and tracking-b2g? now. We've retired basecamp? as of EOD Friday.

Comment 5

[Mike Habicher [:mikeh] (high bugzilla latency)]

(In reply to Jason Smith [:jsmith] from comment #4)
>
> FYI - Use tef? and tracking-b2g? now. We've retired basecamp? as of EOD Friday.

Good to know.  Thanks!

Comment 6

[Andrew Overholt [:overholt]]

(In reply to Mike Habicher [:mikeh] from comment #3)
> Renoming for bb+ (it should be) but the fix is pretty simple.  I'll land a
> patch soon.

If you think this should block, please re-nom but for now let's just track your work here.

Comment 7

[Mike Habicher [:mikeh] (high bugzilla latency)]

Attachment: don't call nsMainThreadPtrHandle::get() off-main-thread in error handling paths

jst, you know this code pretty well.  Time for a quick review?  This patch also cleans up the error object leaks you pointed out and tracked in bug 818518.

Comment 8

[Mike Habicher [:mikeh] (high bugzilla latency)]

Renoming tef? since this causes a crash.

Comment 9

[Johnny Stenback (:jst)]

Comment on attachment 701911 [details] [diff] [review]
don't call nsMainThreadPtrHandle::get() off-main-thread in error handling paths

Looks good, r=jst!

Comment 10

[Mike Habicher [:mikeh] (high bugzilla latency)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/58a45d848070

Comment 11

[Mike Habicher [:mikeh] (high bugzilla latency)]

Can I get a tef+ to land on b2g18?

Comment 12

[Mike Habicher [:mikeh] (high bugzilla latency)]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/2e8fae7631c8

Comment 13

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/58a45d848070