862974 - crash in [@ __libc_android_abort | __android_log_assert | android::OMXCodec::onCmdComplete ]

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: General, defect)

Description

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This bug was filed from the Socorro interface and is 
report bp-fcb81609-a34b-4f4c-b43d-6ae7d2130417 .
============================================================= 
0 	libc.so 	__libc_android_abort 	abort.c:82
1 	liblog.so 	__android_log_assert 	logd_write.c:246
2 	libstagefright.so 	android::OMXCodec::onCmdComplete 	OMXCodec.cpp:3419
3 	libstagefright.so 	android::OMXCodec::onEvent 	OMXCodec.cpp:3278
4 	libstagefright.so 	android::OMXCodec::on_message 	OMXCodec.cpp:2966
5 	libstagefright.so 	android::OMXCodecObserver::onMessage 	OMXCodec.cpp:325
6 	libmedia.so 	android::BnOMXObserver::onTransact 	IOMX.cpp:778
7 	libbinder.so 	android::BBinder::transact 	Binder.cpp:107
8 	libbinder.so 	android::IPCThreadState::executeCommand 	IPCThreadState.cpp:1028
9 	libbinder.so 	android::IPCThreadState::joinThreadPool 	IPCThreadState.cpp:468
10 	libbinder.so 	android::PoolThread::threadLoop 	ProcessState.cpp:67
11 	libutils.so 	android::Thread::_threadLoop 	Threads.cpp:834
12 	libutils.so 	thread_data_t::trampoline 	Threads.cpp:127
13 	libc.so 	__thread_entry 	pthread.c:217
14 	libc.so 	pthread_create 	pthread.c:357 

## Environment :
Master build :2013-04-17-03-06-35
"mozilla-central" revision="50ab959f4bd1"
"integration/gaia-central" revision="f7235663cfcb"
"gecko.git" revision="4fdfb0d252a2ecd11c9f338174f33f8aa0726dba"
"gaia.git" revision="e3696dee033b6c0d8f77ebb59b99c3f29b6ff79e"
Unagi
  
## Repro :
1. launch video app
2. switch to camera app via the menu options
3. take a picture

## Expected :
no crash

## Actual :
crash

## Note :
happens in leo device as well:
https://crash-stats.mozilla.com/report/index/0778185b-9cdb-410f-abef-4dac82130417

Gecko  http://hg.mozilla.org/releases/mozilla-b2g18_v1_0_1/rev/6bac24e14538
Gaia   c883af5ecd0998f78d9aaa4c2337c842e1dbb5a0
BuildID 20130416070200
Version 18.0
Leo

v1.0.1 doesn't have this option in video

Comment 1

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

This crash doesn't seem to happen on v1.1 unagi.  Not sure why.

Gecko  http://hg.mozilla.org/releases/mozilla-b2g18/rev/d1b2e28b303f
Gaia   3774a756e70ec322d363b49d29fea43c5b214cff
BuildID 20130417070204
Version 18.0

Comment 2

[Lukas Blakk [:lsblakk] use ?needinfo]

Blocking since this seems to be specific to leo device.

Comment 3

[Gabriele Svelto [:gsvelto]]

I still haven't got a working build for my Leo so I'm trying to reproduce the issue on my Unagi as in the original crash but couldn't for now.

Looking at the code it seems that this might be caused by some kind of race condition, the failing line being this assertion:

https://www.codeaurora.org/gitweb/quic/la/?p=platform/frameworks/base.git;a=blob;f=media/libstagefright/OMXCodec.cpp;h=7a57834fb5317b692f3f596996af7789f04006a2;hb=eb2bc75803ca179353c24c364a9c8a8ce23e8b78#l3419

CHECK_EQ((int)mPortStatus[portIndex], (int)DISABLING);

Looking at the code setting that particular state it seems that we might be sending the wrong OMX message (or sending something out-of-order) so that we end up in an inconsistent state which then triggers the assertion. If that's the case then this shouldn't be device specific.

Comment 4

[Gabriele Svelto [:gsvelto]]

I've finally managed to flash my Leo devices with the latest nightly build (leo-mozilla-b2g18-20130520230207-ril01.01.00.019.099.zip) and tried reproducing this. I applied the STR ten times without being able to reproduce the problem; in order to exercise it more I even loaded a bunch of videos in the SD-card so that the video app would be busy creating previews for a while but this didn't make it crash either. Testing again with the latest builds on the Unagi didn't yield any crashes either so I'm closing as WORKSFORME; please re-open if this crops up again.