Closed Bug 856076 Opened 12 years ago Closed 11 years ago

Crash while playing games after MT calls

Categories

(Firefox OS Graveyard :: General, defect)

Product:
Firefox OS Graveyard
Component:
General
Platform:
ARM
Gonk (Firefox OS)
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(blocking-b2g:-)

Status:
RESOLVED DUPLICATE of bug 867025
Project Flags:
blocking-b2g -

People

(Reporter: ggrisco, Unassigned)

Details

(Keywords: crash, Whiteboard: [CR 486768][b2g-crash][BTG-1334])

Crash Data

Attachments

(8 files)

decoded minidump of crash
41.43 KB, text/plain
Details
EXTRA file attachment
962 bytes, text/plain
Details
unagi weekly build 13.04.17 crash report
423.26 KB, application/octet-stream
Details
unagi weekly build 13.04.24 crash report
387.30 KB, application/octet-stream
Details
tara also crash, crash report 1
791.88 KB, application/octet-stream
Details
tara also crash, crash report 2
250.68 KB, application/octet-stream
Details
tara crash report 3
216.58 KB, application/octet-stream
Details
minidump file for crash on latest build [AU88]
49.35 KB, text/plain
Details
1. Receive Mobile Terminated (MT) calls, 2. While playing games, device collected minidump. Reproducibility: Seen once Crash reason: SIGSEGV Crash address: 0x0 Thread 0 (crashed) 0 libxul.so!mozalloc_abort [mozalloc_abort.cpp : 30 + 0x4] r4 = 0xbeb4be4c r5 = 0x00000000 r6 = 0xffffffff r7 = 0xbeb4ba60 r8 = 0x40c4a8e1 r9 = 0x00000001 r10 = 0xbeb4ba60 fp = 0x4112ffea sp = 0xbeb4ba48 lr = 0x410c22c7 pc = 0x410c22ca Found by: given as instruction pointer in context 1 libxul.so!NS_DebugBreak_P [nsDebugImpl.cpp : 423 + 0x5] r4 = 0xbeb4be4c r5 = 0x00000000 r6 = 0xffffffff r7 = 0xbeb4ba60 r8 = 0x40c4a8e1 r9 = 0x00000001 r10 = 0xbeb4ba60 fp = 0x4112ffea sp = 0xbeb4ba50 pc = 0x40c4a6c9 Found by: call frame info 2 libxul.so!mozilla::dom::ContentChild::ProcessingError [ContentChild.cpp : 1020 + 0x17] r4 = 0x00000006 r5 = 0x41a311b0 r6 = 0xbeb4bec4 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4be80 pc = 0x40b27c25 Found by: call frame info 3 libxul.so!mozilla::dom::PContentChild::OnProcessingError [PContentChild.cpp : 3194 + 0x5] r4 = 0x00000006 r5 = 0x41a311b0 r6 = 0xbeb4bec4 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4be90 pc = 0x40baee8f Found by: call frame info 4 libxul.so!mozilla::ipc::AsyncChannel::MaybeHandleError [AsyncChannel.cpp : 611 + 0x9] r4 = 0x00000006 r5 = 0x41a311b0 r6 = 0xbeb4bec4 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4be98 pc = 0x40b3d073 Found by: call frame info 5 libxul.so!mozilla::ipc::AsyncChannel::OnDispatchMessage [AsyncChannel.cpp : 473 + 0x15] r4 = 0x41a311b0 r5 = 0xbeb4bec4 r6 = 0xbeb4bec4 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4beb0 pc = 0x40b3d0f5 Found by: call frame info 6 libxul.so!mozilla::ipc::RPCChannel::OnMaybeDequeueOne [RPCChannel.cpp : 402 + 0x7] r4 = 0x41a311b0 r5 = 0xbeb4bec4 r6 = 0xbeb4bec4 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4bec0 pc = 0x40b41f8f Found by: call frame info 7 libxul.so!RunnableMethod<IPC::ChannelProxy::Context, void (IPC::ChannelProxy::Context::*)(), Tuple0>::Run [tuple.h : 383 + 0x5] r4 = 0xbeb4c8b8 r5 = 0x4335f898 r6 = 0xbeb4bf30 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4bef8 pc = 0x40b2386b Found by: call frame info 8 libxul.so!mozilla::ipc::RPCChannel::DequeueTask::Run [RPCChannel.h : 425 + 0x9] r4 = 0xbeb4c8b8 r5 = 0x4335f898 r6 = 0xbeb4bf30 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4bf00 pc = 0x40b40945 Found by: call frame info 9 libxul.so!MessageLoop::RunTask [message_loop.cc : 334 + 0x5] r4 = 0xbeb4c8b8 r5 = 0x4335f898 r6 = 0xbeb4bf30 r7 = 0xbeb4c8c0 r8 = 0xbeb4bf28 r9 = 0x41a06bac r10 = 0x00000000 fp = 0x00000000 sp = 0xbeb4bf08 pc = 0x40c68311 Found by: call frame info
Attached file EXTRA file attachment —
blocking-b2g: --- → tef?
Michael, I rely on your judgement here, should we block on this one?
Flags: needinfo?(mvines)
I suggest tef- right now as this has only been reproduced in long-term stability testing. I'm sure this will come up as we start to stability test v1.1 again, so if we can get a low-risk fix for v1.1 quick then an uplift to v1.0.1 might a good idea.
Severity: critical → major
blocking-b2g: tef? → -
Flags: needinfo?(mvines)
(In reply to Michael Vines [:m1] [:evilmachines] from comment #3) > I suggest tef- right now as this has only been reproduced in long-term > stability testing. I'm sure this will come up as we start to stability test > v1.1 again, so if we can get a low-risk fix for v1.1 quick then an uplift to > v1.0.1 might a good idea. tef- is then. Thanks!
Some additional info: We ignored most of the Mobile Terminated (MT) calls and answered a few MT calls. We have played multiple games. As far as i remember we played "Shake it game" when the crash occurred. Before the crash, we were playing the "Fruit salad" game.
Duplicate of bug 831305 that has no STR?
Severity: major → critical
Crash Signature: [@ mozalloc_abort | NS_DebugBreak_P | mozilla::dom::ContentChild::ProcessingError]
Keywords: crash
unagi weekly build 13.04.17 also has same crash report, add more
Add new crash report, unagi weekly build 13.04.24 still crash.
Attachment #740140 - Attachment mime type: application/octet-stream → text/plain
Attachment #740140 - Attachment mime type: text/plain → application/octet-stream
It looks like something is going wrong in the parent process, or perhaps the parent is killing the child after receiving a bad message from the child. Either way I expect this will be very difficult to understand unless we can debug this locally.
(In reply to Justin Lebar [:jlebar] from comment #12) > It looks like something is going wrong in the parent process, or perhaps the > parent is killing the child after receiving a bad message from the child. > Either way I expect this will be very difficult to understand unless we can > debug this locally. Hi Justin， We are writing a new monkey test script which can attach with gdb. so we can catch the crash with gdb. Is it useful for your debugging?
Not really. Like I said, you probably need an IPC expert to understand what is triggering this error in the child. That is happening before you see this error.
How about open IPC log? Or you need any other log for this crash?
An IPC log might help. But like I said, an IPC expert (perhaps bent) probably needs to sit down with a reproducable testcase /on his own machine/ and debug this.
OK, I'll try to duplicate this crash case.
Hi Justin and bent, Please find 'ABORT' log in unagi/tara crash report, in the bugreport file. If exist 'ABORT' log, also exist 'camera close' log in context. Maybe camera close cause this abort? unagi log 04-25 14:51:35.850 117 5893 E CAM_FD : cam_conf: CAMERA_EXIT 04-25 14:51:35.850 117 117 I QualcommCameraHardware: release X: mCameraRunning = 0, mFrameThreadRunning = 0 04-25 14:51:35.850 117 117 I QualcommCameraHardware: mVideoThreadRunning = 0, mSnapshotThreadRunning = 0, mJpegThreadRunning = 0 04-25 14:51:35.850 117 117 I QualcommCameraHardware: camframe_timeout_flag = 0, mAutoFocusThreadRunning = 0 04-25 14:51:35.850 117 117 E QualcommCamera: Qint android::set_preview_window(camera_device*, preview_stream_ops*): E window = 0x0 04-25 14:51:35.850 117 117 E QualcommCameraHardware: : set_preview_window 04-25 14:51:35.850 117 117 V QualcommCameraHardware: setPreviewWindow: E 04-25 14:51:35.850 117 117 W QualcommCameraHardware: Setting NULL preview window 04-25 14:51:35.850 117 117 E QualcommCameraHardware: Set preview window:: 04-25 14:51:35.850 117 117 V QualcommCameraHardware: setPreviewWindow : X 04-25 14:51:35.850 117 117 E QualcommCamera: Qint android::close_camera_device(hw_device_t*): device =0x1cefc98 E 04-25 14:51:35.850 117 117 I QualcommCamera: void android::close_Hal_obj(camera_device*): E 04-25 14:51:35.850 117 117 I QualcommCamera: void android::close_Hal_obj(camera_device*): clear hw 04-25 14:51:35.850 117 117 I QualcommCameraHardware: ~QualcommCameraHardware E 04-25 14:51:35.850 117 117 V QualcommCameraHardware: ~MMCameraDL: E 04-25 14:51:35.860 117 5901 V QualcommCameraHardware: runFrameThread X 04-25 14:51:35.880 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x44000000 size:233472 fd:210 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x44151000 size:233472 fd:242 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x44500000 size:233472 fd:247 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x44665000 size:233472 fd:258 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x44a00000 size:233472 fd:261 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x44ba7000 size:233472 fd:264 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x45013000 size:233472 fd:267 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x451a1000 size:233472 fd:270 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem_adsp: Freeing buffer base:0x45700000 size:233472 fd:274 04-25 14:51:35.900 111 252 D memalloc: /dev/pmem: Freeing buffer base:0x4b40a000 size:614400 offset:4628480 fd:180 04-25 14:51:35.910 5877 5877 D memalloc: /dev/pmem: Unmapping buffer base:0x46882000 size:5242880 offset:4628480 04-25 14:51:35.910 5877 5877 D memalloc: /dev/pmem: Unmapping buffer base:0x44400000 size:5324800 offset:5242880 04-25 14:51:35.920 5877 5877 D memalloc: /dev/pmem: Unmapping buffer base:0x45128000 size:8343552 offset:8335360 04-25 14:51:35.930 111 252 D memalloc: /dev/pmem: Freeing buffer base:0x4b4a0000 size:81920 offset:5242880 fd:183 04-25 14:51:35.930 5877 5877 I Gecko : 04-25 14:51:35.930 5877 5877 I Gecko : ###!!! [Child][AsyncChannel] Error: Route error: message sent to unknown actor ID 04-25 14:51:35.930 5877 5877 I Gecko : 04-25 14:51:35.940 5877 5877 I Gecko : [Child 5877] ###!!! ABORT: aborting because of fatal error: file /home/apuser/unagi_weekly_build/B2G/gecko/dom/ipc/ContentChild.cpp, line 1020 04-25 14:51:35.940 5877 5877 E Gecko : mozalloc_abort: [Child 5877] ###!!! ABORT: aborting because of fatal error: file /home/apuser/unagi_weekly_build/B2G/gecko/dom/ipc/ContentChild.cpp, line 1020 04-25 14:51:35.960 111 252 D memalloc: /dev/pmem: Freeing buffer base:0x4b632000 size:614400 offset:6889472 fd:279 04-25 14:51:35.970 111 252 D memalloc: /dev/pmem: Freeing buffer base:0x4b4b4000 size:81920 offset:5324800 fd:197 04-25 14:51:36.100 117 117 V QualcommCameraHardware: closed MM Camera DL 04-25 14:51:36.100 117 117 V QualcommCameraHardware: ~MMCameraDL: X 04-25 14:51:36.100 117 117 I QualcommCameraHardware: ~QualcommCameraHardware X 04-25 14:51:36.100 117 117 I QualcommCamera: void android::close_Hal_obj(camera_device*): X tara log 04-25 23:13:46.327 81 25111 I CameraService: Destroying camera 0 04-25 23:13:46.327 81 25111 I SprdCameraHardware: int android::HAL_camera_device_close(hw_device_t*) 04-25 23:13:46.327 81 25111 V SprdCameraHardware: ~SprdCameraHardware E 04-25 23:13:46.327 81 25111 V SprdCameraHardware: ~SprdCameraHardware X 04-25 23:13:46.327 81 25111 D CameraService: CameraService::removeClient E (pid 10075) 04-25 23:13:46.327 81 25111 D CameraService: removeClient: clear camera 0 04-25 23:13:46.327 81 25111 D CameraService: CameraService::removeClient X (pid 10075) 04-25 23:13:46.327 81 25111 E CameraService: disconnect X (pid 10075) 04-25 23:13:46.337 81 3941 D CameraService: Client::~Client E (pid 81, this 0x1477648) 04-25 23:13:46.337 81 3941 E CameraService: disconnect E (pid 81) 04-25 23:13:46.337 81 3941 D CameraService: CameraService::releaseSound ref=1 04-25 23:13:46.337 81 3941 I MediaPlayerService: disconnect(47) from pid 81 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 a 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 b 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 c 04-25 23:13:46.337 81 10492 I OMXCodec: [OMX.google.vorbis.decoder] Now Idle. mState(0), mState 04-25 23:13:46.337 81 10492 I OMXCodec: [OMX.google.vorbis.decoder] Now Loaded. 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=1 d 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=1 e 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stopped in state 1 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] ~OMXCodec in state 04-25 23:13:46.337 81 3941 I AwesomePlayer: --mSystemTimeSourceForSync reset ok 04-25 23:13:46.337 81 3941 I AwesomePlayer: --mSystemTimeSourceForSync reset ok 04-25 23:13:46.337 81 3941 I AwesomePlayer: --mSystemTimeSourceForSync reset ok 04-25 23:13:46.337 81 3941 I MediaPlayerService: Client(47) destructor pid = 81 04-25 23:13:46.337 81 3941 I MediaPlayerService: disconnect(47) from pid 81 04-25 23:13:46.337 81 3941 V AudioFlinger: releasing 287 from 81 04-25 23:13:46.337 81 3941 W AudioFlinger: session id 287 not found for pid 81 04-25 23:13:46.337 81 3941 I MediaPlayerService: disconnect(48) from pid 81 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 a 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 b 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=4 c 04-25 23:13:46.337 81 10495 I OMXCodec: [OMX.google.vorbis.decoder] Now Idle. mState(0), mState 04-25 23:13:46.337 81 10495 I OMXCodec: [OMX.google.vorbis.decoder] Now Loaded. 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=1 d 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stop mState=1 e 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] stopped in state 1 04-25 23:13:46.337 81 3941 I OMXCodec: [OMX.google.vorbis.decoder] ~OMXCodec in state 04-25 23:13:46.337 81 3941 I AwesomePlayer: --mSystemTimeSourceForSync reset ok 04-25 23:13:46.337 81 3941 I AwesomePlayer: --mSystemTimeSourceForSync reset ok 04-25 23:13:46.337 81 3941 I AwesomePlayer: --mSystemTimeSourceForSync reset ok 04-25 23:13:46.337 81 3941 I MediaPlayerService: Client(48) destructor pid = 81 04-25 23:13:46.337 81 3941 I MediaPlayerService: disconnect(48) from pid 81 04-25 23:13:46.337 81 3941 V AudioFlinger: releasing 288 from 81 04-25 23:13:46.337 81 3941 W AudioFlinger: session id 288 not found for pid 81 04-25 23:13:46.337 81 3941 D CameraService: Client::~Client X (pid 81, this 0x1477648) 04-25 23:13:46.397 10075 10075 I Gecko : 04-25 23:13:46.397 10075 10075 I Gecko : ###!!! [Child][AsyncChannel] Error: Route error: message sent to unknown actor ID 04-25 23:13:46.397 10075 10075 I Gecko : 04-25 23:13:46.397 10075 10075 I Gecko : [Child 10075] ###!!! ABORT: aborting because of fatal error: file /home/apuser/MocorHTML5/b2g_latest/B2G/gecko/dom/ipc/ContentChild.cpp, line 1020 04-25 23:13:46.397 10075 10075 E Gecko : mozalloc_abort: [Child 10075] ###!!! ABORT: aborting because of fatal error: file /home/apuser/MocorHTML5/b2g_latest/B2G/gecko/dom/ipc/ContentChild.cpp, line 1020
Camera seems unrelated to the original bug report, perhaps file another bug for your crash.
I file a new bug for tracking this crash. Bug 867025
Test Steps: 1. Make calls and send SMS. 2. Take pictures and record videos, playing videos; like that do testing on multiple applications for 2 to 3 hours. 3. After that mini dumps are generated in the phone.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Whiteboard: [b2g-crash][BTG-1334] → [CR 486768][b2g-crash][BTG-1334]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: