848037 - Multiple crashes seen while playing music in background in repeat mode while on MO call

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: General, defect)

Description

[Greg Grisco]

Attachment: decoded minidump of crash 1

1. Make MO calls using QXDM
2. Play music in background in repeat mode

After a weekend run, found many mini-dumps.  Example shown here, full minidumps attached.

Crash reason:  SIGSEGV
Crash address: 0x6c0069

Thread 2 (crashed)
 0  libxul.so!mozilla::ipc::UnixSocketImpl::Accept [UnixSocket.cpp : 452 + 0x0]
     r4 = 0x432963a0    r5 = 0x44749580    r6 = 0x429fcd70    r7 = 0x429fcdf8
     r8 = 0x429fcd68    r9 = 0x429fcd98   r10 = 0x00000001    fp = 0x00000000
     sp = 0x429fcd00    lr = 0x411486df    pc = 0x4114856e
    Found by: given as instruction pointer in context
 1  libxul.so!mozilla::ipc::SocketAcceptTask::Run [UnixSocket.cpp : 420 + 0x5]
     r4 = 0x429fcdf0    r5 = 0x44749580    r6 = 0x429fcd70    r7 = 0x429fcdf8
     r8 = 0x429fcd68    r9 = 0x429fcd98   r10 = 0x00000001    fp = 0x00000000
     sp = 0x429fcd40    pc = 0x411486df
    Found by: call frame info
 2  libxul.so!MessageLoop::RunTask [message_loop.cc : 334 + 0x5]
     r4 = 0x429fcdf0    r5 = 0x44749580    r6 = 0x429fcd70    r7 = 0x429fcdf8
     r8 = 0x429fcd68    r9 = 0x429fcd98   r10 = 0x00000001    fp = 0x00000000
     sp = 0x429fcd48    pc = 0x4118dc01
    Found by: call frame info
 3  libxul.so!MessageLoop::DeferOrRunPendingTask [message_loop.cc : 342 + 0x5]
     r4 = 0x00000001    r5 = 0x429fcd60    r6 = 0x429fcd70    r7 = 0x429fcdf8
     r8 = 0x429fcd68    r9 = 0x429fcd98   r10 = 0x00000001    fp = 0x00000000
     sp = 0x429fcd58    pc = 0x4118ea33
    Found by: call frame info
 4  libxul.so!MessageLoop::DoWork [message_loop.cc : 442 + 0x7]
     r4 = 0x429fcdf0    r5 = 0x429fcd60    r6 = 0x429fcd70    r7 = 0x429fcdf8
     r8 = 0x429fcd68    r9 = 0x429fcd98   r10 = 0x00000001    fp = 0x00000000
     sp = 0x429fcd60    pc = 0x4118f611
    Found by: call frame info
 5  libxul.so!base::MessagePumpLibevent::Run [message_pump_libevent.cc : 310 + 0x7]
     r4 = 0x403024f0    r5 = 0x429fcdf0    r6 = 0x429fcda0    r7 = 0x40302500
     r8 = 0x429fcd90    r9 = 0x429fcd98   r10 = 0x00000001    fp = 0x00000000
     sp = 0x429fcd90    pc = 0x4119faa7
    Found by: call frame info

Comment 1

[Greg Grisco]

Attachment: decoded minidump of crash 2

Comment 2

[Greg Grisco]

Attachment: decoded minidump of crash 3

Comment 3

[Greg Grisco]

Attachment: decoded minidump of crash 4

Comment 4

[Andrew Overholt [:overholt]]

Kevin, can you find an owner here?

Comment 5

[Kai-Chih Hu [:khu]]

Trying to identify the best owner for this.

Comment 6

[Kai-Chih Hu [:khu]]

Keven will take a look on this first.

Comment 7

[Keven Kuo [:kkuo]]

Hi! Alan,

Per our discussion, please help on this case.
Thanks.

--
Keven

Comment 8

[Alan Huang]

attachment 721351 [details]
This is a b2g non-main thread crash in UnixSocket case.

Crash reason:  SIGSEGV
Crash address: 0x6c0069
Thread 2 (crashed)
 0  libxul.so!mozilla::ipc::UnixSocketImpl::Accept [UnixSocket.cpp : 452 + 0x0]
 1  libxul.so!mozilla::ipc::SocketAcceptTask::Run [UnixSocket.cpp : 420 + 0x5]
 2  libxul.so!MessageLoop::RunTask [message_loop.cc : 334 + 0x5]
 3  libxul.so!MessageLoop::DeferOrRunPendingTask [message_loop.cc : 342 + 0x5]
 4  libxul.so!MessageLoop::DoWork [message_loop.cc : 442 + 0x7]
 5  libxul.so!base::MessagePumpLibevent::Run [message_pump_libevent.cc : 310 + 0x7]
 6  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
 7  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
 8  libxul.so!base::Thread::ThreadMain [thread.cc : 156 + 0x5]
 9  libxul.so!ThreadFunc [platform_thread_posix.cc : 39 + 0x5]
10  libc.so!__thread_entry [pthread.c : 217 + 0x6]
11  libc.so!pthread_create [pthread.c : 357 + 0xe]

attachment 721353 [details]
This is a b2g process crash in JS Environment cycle collection case.

Crash reason:  SIGSEGV
Crash address: 0x7
Thread 0 (crashed)
 0  libxul.so!mozilla::dom::FragmentOrElement::IsPurple [FragmentOrElement.h : 303 + 0x0]
 1  libxul.so!nsBaseContentList::cycleCollection::CanSkipImpl [nsContentList.cpp : 65 + 0x9]
 2  libxul.so!nsPurpleBuffer::RemoveSkippable [nsCycleCollectionParticipant.h : 262 + 0x1]
 3  libxul.so!nsCycleCollector::ForgetSkippable [nsCycleCollector.cpp : 2106 + 0x9]
 4  libxul.so!nsCycleCollector_forgetSkippable [nsCycleCollector.cpp : 3217 + 0x7]
 5  libxul.so!FireForgetSkippable [nsJSEnvironment.cpp : 3134 + 0x3]
 6  libxul.so!CCTimerFired [nsJSEnvironment.cpp : 3384 + 0x7]
 7  libxul.so!nsTimerImpl::Fire [nsTimerImpl.cpp : 473 + 0x5]
 8  libxul.so!nsTimerEvent::Run [nsTimerImpl.cpp : 556 + 0x5]
 9  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp : 620 + 0x5]
10  libxul.so!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 237 + 0xb]
11  libxul.so!mozilla::ipc::MessagePump::Run [MessagePump.cpp : 117 + 0x7]
12  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
13  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
14  libxul.so!nsBaseAppShell::Run [nsBaseAppShell.cpp : 163 + 0x7]
15  libxul.so!nsAppStartup::Run [nsAppStartup.cpp : 290 + 0x5]
16  libxul.so!XREMain::XRE_mainRun [nsAppRunner.cpp : 3794 + 0x5]
17  libxul.so!XREMain::XRE_main [nsAppRunner.cpp : 3860 + 0x5]
18  libxul.so!XRE_main [nsAppRunner.cpp : 3935 + 0x3]
19  b2g!main [nsBrowserApp.cpp : 164 + 0xf]

attachment 721355 [details]
This is app process crash in  gfx layers case.

Crash reason:  SIGSEGV
Crash address: 0x0
Thread 0 (crashed)
 0  libxul.so!mozalloc_abort [mozalloc_abort.cpp : 30 + 0x4]
 1  libxul.so!NS_DebugBreak_P [nsDebugImpl.cpp : 423 + 0x5]
 2  libxul.so!mozilla::layers::PLayersChild::Write [PLayersChild.cpp : 1422 + 0x13]
 3  libxul.so!mozilla::layers::PLayersChild::Write [PLayersChild.cpp : 3047 + 0x5]
 4  libxul.so!mozilla::layers::PLayersChild::Write [PLayersChild.cpp : 1673 + 0x7]
 5  libxul.so!mozilla::layers::PLayersChild::Write [PLayersChild.cpp : 1605 + 0x3]
 6  libxul.so!mozilla::layers::PLayersChild::SendUpdateNoSwap [PLayersChild.cpp : 322 + 0x3]
 7  libxul.so!mozilla::layers::ShadowLayerForwarder::EndTransaction [ShadowLayers.cpp : 377 + 0x7]
 8  libxul.so!mozilla::layers::BasicShadowLayerManager::ForwardTransaction [BasicLayerManager.cpp : 1205 + 0x9]
 9  libxul.so!mozilla::layers::BasicShadowLayerManager::EndEmptyTransaction [BasicLayerManager.cpp : 1193 + 0x5]
10  libxul.so!PresShell::Paint [nsPresShell.cpp : 5316 + 0x1]
11  libxul.so!nsViewManager::ProcessPendingUpdatesForView [nsViewManager.cpp : 431 + 0x1f]
12  libxul.so!nsViewManager::ProcessPendingUpdates [nsViewManager.cpp : 1221 + 0x9]
13  libxul.so!nsRefreshDriver::Notify [nsRefreshDriver.cpp : 436 + 0x5]
14  libxul.so!nsTimerImpl::Fire [nsTimerImpl.cpp : 476 + 0x9]
15  libxul.so!nsTimerEvent::Run [nsTimerImpl.cpp : 556 + 0x5]
16  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp : 620 + 0x5]
17  libxul.so!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 237 + 0xb]
18  libxul.so!mozilla::ipc::MessagePump::Run [MessagePump.cpp : 82 + 0x7]
19  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run [MessagePump.cpp : 231 + 0x7]
20  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
21  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
22  libxul.so!nsBaseAppShell::Run [nsBaseAppShell.cpp : 163 + 0x7]
23  libxul.so!XRE_RunAppShell [nsEmbedFunctions.cpp : 646 + 0x5]
24  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run [MessagePump.cpp : 198 + 0x3]
25  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
26  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
27  libxul.so!XRE_InitChildProcess [nsEmbedFunctions.cpp : 485 + 0xb]
28  plugin-container!main [MozillaRuntimeMain.cpp : 48 + 0x5]
29  libc.so!__libc_init [libc_init_dynamic.c : 114 + 0x7]

attachment 721355 [details]
This is also a app process crash in  gfx layers case.

Crash reason:  SIGSEGV
Crash address: 0x30
Thread 0 (crashed)
 0  libxul.so!android::sp<android::GraphicBuffer>::operator= [StrongPointer.h : 156 + 0x0]
 1  libxul.so!mozilla::layers::ShadowLayerForwarder::PlatformAllocBuffer [ShadowLayerUtilsGralloc.cpp : 243 + 0x3]
 2  libxul.so!mozilla::layers::ShadowLayerForwarder::AllocBufferWithCaps [ShadowLayers.cpp : 441 + 0x5]
 3  libxul.so!mozilla::layers::ShadowLayerForwarder::AllocBuffer [ShadowLayers.cpp : 428 + 0x7]
 4  libxul.so!mozilla::layers::BasicShadowableThebesLayer::CreateBuffer [BasicThebesLayer.cpp : 456 + 0x7]
 5  libxul.so!mozilla::layers::BasicThebesLayerBuffer::CreateBuffer [BasicBuffers.cpp : 64 + 0x7]
 6  libxul.so!mozilla::layers::ThebesLayerBuffer::BeginPaint [ThebesLayerBuffer.cpp : 306 + 0x3]
 7  libxul.so!mozilla::layers::BasicThebesLayer::PaintThebes [BasicThebesLayer.cpp : 172 + 0x13]
 8  libxul.so!mozilla::layers::BasicShadowableThebesLayer::PaintThebes [BasicThebesLayer.cpp : 307 + 0x13]
 9  libxul.so!mozilla::layers::BasicLayerManager::PaintSelfOrChildren [BasicLayerManager.cpp : 826 + 0x15]
10  libxul.so!mozilla::layers::BasicLayerManager::PaintLayer [BasicLayerManager.cpp : 939 + 0x9]
11  libxul.so!mozilla::layers::BasicLayerManager::PaintSelfOrChildren [BasicLayerManager.cpp : 841 + 0x17]
12  libxul.so!mozilla::layers::BasicLayerManager::PaintLayer [BasicLayerManager.cpp : 939 + 0x9]
13  libxul.so!mozilla::layers::BasicLayerManager::PaintSelfOrChildren [BasicLayerManager.cpp : 841 + 0x17]
14  libxul.so!mozilla::layers::BasicLayerManager::PaintLayer [BasicLayerManager.cpp : 939 + 0x9]
15  libxul.so!mozilla::layers::BasicLayerManager::EndTransactionInternal [BasicLayerManager.cpp : 586 + 0x13]
16  libxul.so!mozilla::layers::BasicLayerManager::EndTransaction [BasicLayerManager.cpp : 509 + 0x3]
17  libxul.so!mozilla::layers::BasicShadowLayerManager::EndTransaction [BasicLayerManager.cpp : 1149 + 0x3]
18  libxul.so!nsDisplayList::PaintForFrame [nsDisplayList.cpp : 1144 + 0x7]
19  libxul.so!nsDisplayList::PaintRoot [nsDisplayList.cpp : 1009 + 0xd]
20  libxul.so!nsLayoutUtils::PaintFrame [nsLayoutUtils.cpp : 1955 + 0x7]
21  libxul.so!PresShell::Paint [nsPresShell.cpp : 5364 + 0xd]
22  libxul.so!nsViewManager::ProcessPendingUpdatesForView [nsViewManager.cpp : 431 + 0x1f]
23  libxul.so!nsViewManager::ProcessPendingUpdates [nsViewManager.cpp : 1221 + 0x9]
24  libxul.so!nsRefreshDriver::Notify [nsRefreshDriver.cpp : 436 + 0x5]
25  libxul.so!nsTimerImpl::Fire [nsTimerImpl.cpp : 476 + 0x9]
26  libxul.so!nsTimerEvent::Run [nsTimerImpl.cpp : 556 + 0x5]
27  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp : 620 + 0x5]
28  libxul.so!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 237 + 0xb]
29  libxul.so!mozilla::ipc::MessagePump::Run [MessagePump.cpp : 82 + 0x7]
30  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run [MessagePump.cpp : 231 + 0x7]
31  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
32  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
33  libxul.so!nsBaseAppShell::Run [nsBaseAppShell.cpp : 163 + 0x7]
34  libxul.so!XRE_RunAppShell [nsEmbedFunctions.cpp : 646 + 0x5]
35  libxul.so!mozilla::ipc::MessagePumpForChildProcess::Run [MessagePump.cpp : 198 + 0x3]
36  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
37  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
38  libxul.so!XRE_InitChildProcess [nsEmbedFunctions.cpp : 485 + 0xb]
39  plugin-container!main [MozillaRuntimeMain.cpp : 48 + 0x5]
40  libc.so!__libc_init [libc_init_dynamic.c : 114 + 0x7]

Comment 9

[Eric Chou [:ericchou] [:echou]]

(In reply to Alan Huang [:ahuang] from comment #8)
> attachment 721351 [details]
> This is a b2g non-main thread crash in UnixSocket case.
> 
> Crash reason:  SIGSEGV
> Crash address: 0x6c0069
> Thread 2 (crashed)
>  0  libxul.so!mozilla::ipc::UnixSocketImpl::Accept [UnixSocket.cpp : 452 +
> 0x0]
>  1  libxul.so!mozilla::ipc::SocketAcceptTask::Run [UnixSocket.cpp : 420 +
> 0x5]
>  2  libxul.so!MessageLoop::RunTask [message_loop.cc : 334 + 0x5]
>  3  libxul.so!MessageLoop::DeferOrRunPendingTask [message_loop.cc : 342 +
> 0x5]
>  4  libxul.so!MessageLoop::DoWork [message_loop.cc : 442 + 0x7]
>  5  libxul.so!base::MessagePumpLibevent::Run [message_pump_libevent.cc : 310
> + 0x7]
>  6  libxul.so!MessageLoop::RunInternal [message_loop.cc : 216 + 0x5]
>  7  libxul.so!MessageLoop::Run [message_loop.cc : 209 + 0x5]
>  8  libxul.so!base::Thread::ThreadMain [thread.cc : 156 + 0x5]
>  9  libxul.so!ThreadFunc [platform_thread_posix.cc : 39 + 0x5]
> 10  libc.so!__thread_entry [pthread.c : 217 + 0x6]
> 11  libc.so!pthread_create [pthread.c : 357 + 0xe]
> 

This should be already fixed after bug 845148 landed.

Comment 10

[Lucas Adamski [:ladamski]]

These are not actionable bug without a clear and deterministic STR, and therefore should not block.

Comment 11

[Michael Vines [:m1] [:evilmachines]]

I think it would help to break up these 4 crashes into separate bugs, I agree they are a little hard to process in the current format.  

Greg, can you please do this?   Except for the crash in comment 9 as that fix has already landed on v1.0.1 so hopefully we won't run into this when we start the next stability run early next week.

Comment 12

[Alex Keybl [:akeybl]]

(In reply to Greg Grisco from comment #0)
> Created attachment 721351 [details]
> decoded minidump of crash 1
> 
> 1. Make MO calls using QXDM
> 2. Play music in background in repeat mode

Did you notice these crashes happening? Or were you surprised to find the minidumps on your phone? I want to make sure that we're devoting our engineering time to user impactful issues.

Comment 13

[Michael Vines [:m1] [:evilmachines]]

Closing this bug out.  We can track the three individual crashes directly instead.