846647 - [b2g-bluetooth] Update call state before reseting call array

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect)

Description

[Gina Yeh [:gyeh] [:ginayeh]]

STR:
1. Make a call
2. Hang up the call via bluetooth headset



Program received signal SIGSEGV, Segmentation fault.
0x411c73b4 in nsTArray_Impl<mozilla::dom::bluetooth::Call, nsTArrayInfallibleAllocator>::ElementAt (this=<value optimized out>, 
    i=<value optimized out>) at ../../dist/include/nsTArray.h:638
---Type <return> to continue, or q <return> to quit---
638	    MOZ_ASSERT(i < Length(), "invalid array index");




When we hang up the phone call, the call array is reset/re-initialized, so we failed to update the state of call array.

Comment 1

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: Patch 1(v1): Update call state before reseting call array

Comment 2

[Gina Yeh [:gyeh] [:ginayeh]]

Since NS_ENSURE_FALSE_VOID will generate a warning message in debug build, I'd like to replace it with an if statement.

Comment 3

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: Patch 1(v2): Update call state before reseting call array

Let's update the patch! We should update call array after cacheing the previous call state.

Comment 4

[Eric Chou [:ericchou] [:echou]]

Comment on attachment 719877 [details] [diff] [review]
Patch 1(v2): Update call state before reseting call array

Review of attachment 719877 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me.

Comment 5

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: Final patch, Update call state before reseting call array, r=echou

Comment 6

[Mozilla RelEng Bot]

Try run for 938dbd25ffe5 is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=938dbd25ffe5
Results (out of 18 total builds):
    success: 17
    warnings: 1
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-938dbd25ffe5

Comment 7

[Mozilla RelEng Bot]

Try run for 12a7d1e71dbb is complete.
Detailed breakdown of the results available here:
    https://tbpl.mozilla.org/?tree=Try&rev=12a7d1e71dbb
Results (out of 14 total builds):
    success: 14
Builds (or logs if builds failed) available at:
http://ftp.mozilla.org/pub/mozilla.org/firefox/try-builds/[e-mail]-12a7d1e71dbb

Comment 8

[Eric Chou [:ericchou] [:echou]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e0bc07a40a67

Comment 9

[Gregory Szorc [:gps]]

https://hg.mozilla.org/mozilla-central/rev/e0bc07a40a67

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

Looks like a good fix to get into v1.1, tracking.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

This is going to need a branch-specific patch for b2g18.

Comment 12

[Gina Yeh [:gyeh] [:ginayeh]]

This is blocked by Bug 827212, which has been marked as tracking-b2g?

Can we land it after Bug 827212?

Comment 13

[Ryan VanderMeulen [:RyanVM]]

This still doesn't apply even with bug 827212 rebased onto b2g18. Looking at the m-c hg log for BluetoothHfpManager.cpp, it appears that a good number of other bugs landed in between these two. Either get approval for the other ones or post a branch-specific patch, please.

Comment 14

[Gina Yeh [:gyeh] [:ginayeh]]

Sorry for the late reply.

I've checked the implementation in b2g-18 and m-c and found that the architecture has changed a lot (as Ryan said, a good number of other bugs landed between these two). I think this issue should only be happen on m-c, so re-nominate to tracking-b2g18?

Comment 15

[Lukas Blakk [:lsblakk] use ?needinfo]

In that case we'll remove tracking, this can ride the trains to v1.2

Comment 16

[Eric Chou [:ericchou] [:echou]]

Due to bug 827212 has been landed to b2g18, I'd like to nominate this bug as tracking-b2g+ again, trying to make it checked into b2g18 branch. Otherwise it would hit an assertion if suer hanging up a phone call when a Bluetooth headset is connected.

Comment 17

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: Final patch for b2g-18, r=echou

Comment 18

[Gina Yeh [:gyeh] [:ginayeh]]

Comment on attachment 731757 [details] [diff] [review]
Final patch for b2g-18, r=echou

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): none
User impact if declined: The call array is reset when user hang up all phone calls, and we still set value for invalid address of the call array.
Testing completed: mozilla-central
Risk to taking this patch (and alternatives if risky): Should be fairly low. The patch is to set the call array value before resetting it, and make sure we won't access invalid memory address.
String or UUID changes made by this patch: none

Comment 19

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

This patch seems still not merge into b2g18. This will block leo bluetooth certification.

Comment 20

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

Sorry, after confirmation, it had been merged.

Comment 21

[Shawn Huang [:shawnjohnjr][:shuang] (as a happy gecko contributor)]

typo:
Sorry, after confirmation, it had NOT been merged yet.

Comment 22

[Ryan VanderMeulen [:RyanVM]]

This doesn't apply to b2g18. Please post an updated patch.

Comment 23

[Alex Keybl [:akeybl]]

(In reply to Shawn Huang from comment #19)
> This patch seems still not merge into b2g18. This will block leo bluetooth
> certification.

This is approved for v1.1, but no justification was provided for why this would block v1.1 but not v1.0.1.

Also, ni on gyeh for comment 22.

Comment 24

[Gina Yeh [:gyeh] [:ginayeh]]

For v1.0.1, we just reset the call index (mCurrentCallIndex) to 0 after a phone call is disconnected without resetting the whole array (mCurrentCallStateArray). So we won't have this issue on v1.0.1.

Comment 25

[Gina Yeh [:gyeh] [:ginayeh]]

I'll generate a new b28-specific patch later.

Comment 26

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: Final patch for b2g-18, r=echou (updated)

Comment 27

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/d0c7d0c2d493

Comment 28

[Kai-Chih Hu [:khu]]

This bug(and other 9 bugs) block Bluetooth certification. So, these bugs need to be marked as tef+ and landed to v1.0.1 in order to pass Bluetooth certification: 

bug 827255
bug 827212
bug 827266
bug 828175
bug 823346
bug 827230
bug 828798
bug 835740
bug 846647
bug 828160

So, mark these bugs as tef?. These fixes have some dependency and it would be better to have them landed in a specific order. Gina has a good view on this.

Comment 29

[Gina Yeh [:gyeh] [:ginayeh]]

I recommend to land these patches in the following order:

01. bug827204
02. bug827255
03. bug823346
04. bug827230
05. bug828798
06. bug827212, patch 1
06. bug827212, patch 2
07. bug827266
08. bug828175
09. bug846647
10. bug825861
11. bug825851
12. bug835740




I'm going to attach patches for b2g18_v1_0_1 for each bug. Please land them in the above order. There should be no conflict and feel free to let me know if I can be any help.

Comment 30

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: b2g18_v1_0_1 patch

Comment 31

[Joe Cheng [:jcheng] (please needinfo)]

tef- for now until partner confirms this is blocking BT cert.

Comment 32

[Daniel Coloma:dcoloma]

Seems it is confirmed it blocks BT cer as per bug 868347

Comment 33

[Ryan VanderMeulen [:RyanVM]]

Gina, this doesn't apply to b2g18_v1_0_1 anymore. Can you please rebase?

Comment 34

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: b2g18_v1_0_1 patch

v1.0.1 patch updated.

Comment 35

[Gina Yeh [:gyeh] [:ginayeh]]

Ryan, I've updated all patches. Please land them in the following order, thanks.

01. bug827204
02. bug827255
(03. bug823346 has been landed on v1.0.1)
04. bug827230
05. bug828798
06. bug827212, patch 1
06. bug827212, patch 2
07. bug827266
08. bug828175
09. bug846647
10. bug825861
11. bug825851
12. bug835740

Comment 36

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18_v1_0_1/rev/57dda403121f