862462 - B2G Desktop crash on shutdown due to bluetooth adapter not unrooting

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Stack: 

#0  0x00007fe578ac383d in nanosleep ()
    at ../sysdeps/unix/syscall-template.S:82
#1  0x00007fe578ac36dc in __sleep (seconds=0)
    at ../sysdeps/unix/sysv/linux/sleep.c:138
#2  0x00007fe5749ed1b0 in ah_crap_handler (signum=11)
    at /share/code/mozbuild/mozilla-central/toolkit/xre/nsSigHandlers.cpp:88
#3  0x00007fe5749f17d6 in nsProfileLock::FatalSignalHandler (signo=11, info=
    0x7ffff015dcb0, context=<optimized out>)
    at /share/code/mozbuild/mozilla-central/obj-test/toolkit/profile/nsProfileLock.cpp:190
#4  <signal handler called>
#5  0x0000000000000000 in ?? ()
#6  0x00007fe575ca5c88 in nsXPCOMCycleCollectionParticipant::CheckForRightISupports (s=0x13c3a80)
    at /share/code/mozbuild/mozilla-central/obj-test/xpcom/build/nsCycleCollectionParticipant.cpp:54
#7  0x00007fe575436fd1 in Run (p=0x13c3a80)
    at ../../dist/include/nsCycleCollectionParticipant.h:322
#8  DowncastCCParticipant<mozilla::dom::bluetooth::BluetoothAdapter> (
    p=<optimized out>)
    at ../../dist/include/nsCycleCollectionParticipant.h:341
#9  0x00007fe5754370bb in mozilla::dom::bluetooth::BluetoothAdapter::cycleCollection::TraceImpl (p=0x13c3a80, aCallback=
    0x7fe5755af5d2 <TraceJSObject(void*, char const*, void*)>, aClosure=
    0xeab6d0)
    at /share/code/mozbuild/mozilla-central/dom/bluetooth/BluetoothAdapter.cpp:33
#10 0x00007fe5755ae757 in TraceJSHolder (holder=<optimized out>, 
    tracer=<optimized out>, arg=<optimized out>)
    at /share/code/mozbuild/mozilla-central/js/xpconnect/src/XPCJSRuntime.cpp:420
#11 0x00007fe575ca6df9 in PL_DHashTableEnumerate (table=0xea49a0, etor=
    0x7fe5755ae7fc <nsBaseHashtable<nsPtrHashKey<void>, nsScriptObjectTracer*, nsScriptObjectTracer*>::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*)>, arg=0x7ffff015e100)
    at /share/code/mozbuild/mozilla-central/obj-test/xpcom/build/pldhash.cpp:714
#12 0x00007fe5755b4f44 in nsBaseHashtable<nsPtrHashKey<void>, nsScriptObjectTracer*, nsScriptObjectTracer*>::Enumerate (this=0xea49a0, enumFunc=
    0x7fe5755ae746 <TraceJSHolder(void*, nsScriptObjectTracer*&, void*)>, 
    userArg=0xeab6d0) at ../../../dist/include/nsBaseHashtable.h:223
#13 0x00007fe5755b527e in XPCJSRuntime::TraceXPConnectRoots (this=0xea4680, 
    trc=0xeab6d0)
    at /share/code/mozbuild/mozilla-central/js/xpconnect/src/XPCJSRuntime.cpp:444
#14 0x00007fe576575978 in js::gc::BufferGrayRoots (gcmarker=<optimized out>)
    at /share/code/mozbuild/mozilla-central/js/src/gc/RootMarking.cpp:781
#15 0x00007fe576318a4a in BeginMarkPhase (rt=0xeab3f0)
    at /share/code/mozbuild/mozilla-central/js/src/jsgc.cpp:2834
#16 0x00007fe576324ac6 in IncrementalCollectSlice (rt=0xeab3f0, 
    budget=<optimized out>, reason=JS::gcreason::SHUTDOWN_CC, gckind=
    js::GC_NORMAL)
    at /share/code/mozbuild/mozilla-central/js/src/jsgc.cpp:4261
#17 0x00007fe576326f01 in GCCycle (rt=0xeab3f0, incremental=<optimized out>, 
    budget=0, gckind=js::GC_NORMAL, reason=JS::gcreason::SHUTDOWN_CC)
    at /share/code/mozbuild/mozilla-central/js/src/jsgc.cpp:4439
#18 0x00007fe57632743c in Collect (rt=0xeab3f0, incremental=false, budget=0, 
    gckind=js::GC_NORMAL, reason=JS::gcreason::SHUTDOWN_CC)
    at /share/code/mozbuild/mozilla-central/js/src/jsgc.cpp:4567
#19 0x00007fe575cfdd7c in nsCycleCollector::MainThreadCollect (this=0xca9cc0, 
    aMergeZones=false, aResults=<optimized out>, aTryCollections=5, aListener=
    0x0)
    at /share/code/mozbuild/mozilla-central/xpcom/base/nsCycleCollector.cpp:2708
#20 0x00007fe575cfdf1f in nsCycleCollector::Shutdown (this=0xca9cc0)
    at /share/code/mozbuild/mozilla-central/xpcom/base/nsCycleCollector.cpp:2825
#21 0x00007fe575cfdf7d in nsCycleCollector_shutdown ()
    at /share/code/mozbuild/mozilla-central/xpcom/base/nsCycleCollector.cpp:3041
#22 0x00007fe575cabff7 in mozilla::ShutdownXPCOM (servMgr=<optimized out>)
    at /share/code/mozbuild/mozilla-central/xpcom/build/nsXPComInit.cpp:642
#23 0x00007fe5749e0167 in ScopedXPCOMStartup::~ScopedXPCOMStartup (this=
    0xc40630, __in_chrg=<optimized out>)
    at /share/code/mozbuild/mozilla-central/toolkit/xre/nsAppRunner.cpp:1122
#24 0x00007fe5749e84ff in XREMain::XRE_main (this=0x7ffff01665a0, 
    argc=<optimized out>, argv=<optimized out>, aAppData=<optimized out>)
    at /share/code/mozbuild/mozilla-central/toolkit/xre/nsAppRunner.cpp:3973
#25 0x00007fe5749e871f in XRE_main (argc=3, argv=0x7ffff01689a8, aAppData=
    0x612c90, aFlags=<optimized out>)
    at /share/code/mozbuild/mozilla-central/toolkit/xre/nsAppRunner.cpp:4153
#26 0x0000000000401c45 in do_main (argv=0x7ffff01689a8, argc=3)
    at /share/code/mozbuild/mozilla-central/b2g/app/nsBrowserApp.cpp:168
#27 main (argc=<optimized out>, argv=<optimized out>)
    at /share/code/mozbuild/mozilla-central/b2g/app/nsBrowserApp.cpp:261

The BluetoothAdapter destructor tries to get a BluetoothService in order to unregister itself. However, since the service has already been destructed and isn't fetchable, it exits early, /before/ we have a chance to unroot. This leaves the object hanging around, which chokes the cycle collector for some reason and hands back weird stacks.

Comment 1

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Attachment: Patch 1 (v1) - Make sure BluetoothAdapter unroots in destructor before exiting

Comment 2

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Repro:

- Bring up bluetooth on B2G Desktop
- Let it scan for/list devices in settings app
- Shut down

Expected:

Clean shutdown

Actual:

Stack in description

Comment 3

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Please do not auto-tef? these bugs.

Comment 4

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

https://tbpl.mozilla.org/?tree=Try&rev=4d382b913e01

Comment 5

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Also: This isn't on Gonk. This isn't on ARM. Please stop automarking these altogether.

Comment 6

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

https://bugzilla.mozilla.org/show_bug.cgi?id=862462

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/13aadb8d9df5