832236 - crash in PreviewControl::Run

Status: RESOLVED DUPLICATE of bug 836427

(Firefox OS Graveyard :: General, defect)

Description

[Scoobidiver (away)]

There's one crash in the latest 18 build: bp-87940363-01c1-48b0-9bf9-1d2342130117.

Frame 	Module 	Signature 	Source
0 		@0x4341a7e0 	
1 	libxul.so 	PreviewControl::Run 	DOMCameraPreview.cpp:43
2 	libxul.so 	nsThread::ProcessNextEvent 	nsThread.cpp:620
3 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:237
4 	libxul.so 	mozilla::ipc::MessagePump::Run 	MessagePump.cpp:82
5 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	MessagePump.cpp:231
6 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:215
7 	libxul.so 	MessageLoop::Run 	message_loop.cc:208
8 	libxul.so 	nsBaseAppShell::Run 	nsBaseAppShell.cpp:163
9 	libxul.so 	XRE_RunAppShell 	nsEmbedFunctions.cpp:646
10 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	MessagePump.cpp:198
11 	libxul.so 	MessageLoop::RunInternal 	message_loop.cc:215
12 	libxul.so 	MessageLoop::Run 	message_loop.cc:208
13 	libxul.so 	XRE_InitChildProcess 	nsEmbedFunctions.cpp:485
14 	plugin-container 	main 	MozillaRuntimeMain.cpp:48
15 	libc.so 	__libc_init 	libc_init_dynamic.c:114
16 		@0xb0001dc5 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=PreviewControl%3A%3ARun

Comment 1

[Andrew Overholt [:overholt]]

Let's re-nom for blocking if we can find a reliable STR.

Comment 2

[Marcia Knous [:marcia]]

There hasn't been any further crashes in the last week, and without STR there is not much QA can do here.

Comment 3

[Sotaro Ikeda [:sotaro]]

I found following in the report. It seems that camera hw is in under destruction.

--------------------
Thread 14

10 libxul.so 	android::CameraHardwareInterface::~CameraHardwareInterface 	CameraHardwareInterface.h:93
11 libxul.so 	android::CameraHardwareInterface::~CameraHardwareInterface 	CameraHardwareInterface.h:97
12 libxul.so 	libxul.so@0x6fa111 	
13 libutils.so 	android::RefBase::decStrong 	RefBase.cpp:359
14 libxul.so 	mozilla::GonkCameraHardware::~GonkCameraHardware 	StrongPointer.h:149
15 libxul.so 	mozilla::GonkCameraHardware::ReleaseHandle 	GonkCameraHwMgr.cpp:260
16 libxul.so 	mozilla::nsGonkCameraControl::ReleaseHardwareImpl 	GonkCameraControl.cpp:1308

Comment 4

[Mike Habicher [:mikeh] (high bugzilla latency)]

Discussed with sotaro, and we think bug 826427 is a dupe of this one, but since that bug has STR, will close this one.

Comment 5

[Mike Habicher [:mikeh] (high bugzilla latency)]

This crash is occurring in PreviewControl::Run() at line 43, which is the call to mDOMPreview->Start():

    switch (mControl) {
      case START:
        mDOMPreview->Start();
        break;

The PreviewControl runnable runs on the Main Thread, and is created in DOMCameraPreviewListener::NotifyConsumptionChanged():

    switch (aConsuming) {
      ...
      case CONSUMED:
        previewControl = new PreviewControl(mDOMPreview, PreviewControl::START);
        break;
      ...
    nsresult rv = NS_DispatchToMainThread(previewControl);

It looks like the RemoveListener() call in ~DOMCameraPreview() is an asynchronous call, so it's possible for there to be a race where the PreviewControl object has a stale reference to a non-existent DOMCameraPreview object.

Comment 6

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

only 1 crash in the month

https://crash-stats.mozilla.com/query/query?product=B2G&version=ALL%3AALL&range_value=4&range_unit=weeks&date=02%2F02%2F2013+01%3A25%3A08&query_search=signature&query_type=contains&query=PreviewControl%3A%3ARun&reason=&build_id=&process_type=any&hang_type=any&do_query=1

Not exactly sure how to duplicate this particular crash.

Removing qa-wanted, str wanted from this bug as 1 crash in a month is too low a priority to spend time on esp considering we think this may be a dup of another bug.