880902 - crash in @android::Vector<android::InputDispatcher::Connection*>::do_copy

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: General, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-2e79a50d-23db-4750-8d4a-759272130607 .
============================================================= 

Seen while running unagi, using Mozilla RIL. Found by swaroopa during testing. Not sure where to file, since it probably belongs in Gecko? Not able to reproduce on Leo device with the latest commercial RIL.

Gecko  http://hg.mozilla.org/releases/mozilla-b2g18/rev/bb6c9375f53b
Gaia   d85d73e50a82cc665d862a93aa7ab34ec0f861ba
BuildID 20130607070208
Version 18.0

STR:
1. Compose a message and leave the SMS compose window open
2. Record a video using the camera app.
3. Play the recorded video right after the video finished playing.
4. Crash

Frame 	Module 	Signature 	Source
0 		@0x0 	
1 	libxul.so 	android::Vector<android::InputDispatcher::Connection*>::do_copy 	
2 		@0x43f5875e 	
3 	libstagefright.so 	android::MPEG4DataSource::readAt 	MPEG4Extractor.cpp:172
4 	libstagefright.so 	android::MPEG4DataSource::readAt 	MPEG4Extractor.cpp:172
5 	libstagefright.so 	android::MPEG4Source::read 	MPEG4Extractor.cpp:2329
6 	libstagefright.so 	android::OMXCodec::drainInputBuffer 	OMXCodec.cpp:4046
7 	libstagefright.so 	android::OMXCodec::on_message 	OMXCodec.cpp:3022
8 	libstagefright.so 	android::OMXCodecObserver::onMessage 	OMXCodec.cpp:325
9 	libstagefright_omx.so 	android::OMXNodeInstance::onMessage 	OMXNodeInstance.cpp:679
10 	libstagefright_omx.so 	android::OMX::CallbackDispatcher::dispatch 	OMX.cpp:125
11 	libstagefright_omx.so 	android::OMX::CallbackDispatcher::loop 	OMX.cpp:146
12 	libstagefright_omx.so 	android::OMX::CallbackDispatcherThread::threadLoop 	OMX.cpp:155
13 	libutils.so 	android::Thread::_threadLoop 	Threads.cpp:834
14 	libutils.so 	thread_data_t::trampoline 	Threads.cpp:127
15 	libc.so 	__thread_entry 	pthread.c:217
16 	libc.so 	pthread_create

Comment 2

[Michael Vines [:m1] [:evilmachines]]

(leo? -- in 120 hours of stability test we saw this crash 5 times, out of 8 crashes total.  This is also a regression as this crash was not seen as a part of the CS build for v1.1)

Comment 3

[Dietrich Ayala (:dietrich)]

Blocking- since Unagi only.

Requesting QA testing on Buri/Inari. QA, please re-nominate if can reproduce on shipping devices.

Comment 4

[Michael Vines [:m1] [:evilmachines]]

Opps, should've been +ed.   This bug reproduces on supported v1.1 devices (see bug 882734) and blocks the required stability metrics for the CS patch (see comment 2).

Comment 5

[Sotaro Ikeda [:sotaro]]

It seems that it is dup of Bug 883543. I found same stack in Bug 883543 comment #1.

Comment 7

[Sotaro Ikeda [:sotaro]]

It is necessary to stop OMXCodec when MediaDecoderStateMachine come into DECODER_STATE_SHUTDOWN. And OmxDecoder should be destructed in MediaOmxReader::~MediaOmxReader().

Comment 8

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #7)
> It is necessary to stop OMXCodec when MediaDecoderStateMachine come into DECODER_STATE_SHUTDOWN.

It is already implemented. strange. There seems a case that MediaDecoderStateMachine does not come into DECODER_STATE_SHUTDOWN stage before destroy it.

Comment 9

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #8)
> 
> It is already implemented. strange. There seems a case that
> MediaDecoderStateMachine does not come into DECODER_STATE_SHUTDOWN stage
> before destroy it.

Free OMXDecoder in DECODER_STATE_SHUTDOWN stage is implemented in Bug 871485. The problem should happen only source code before Bug 871485 fixed.

Comment 10

[Sotaro Ikeda [:sotaro]]

:m1, does the crash happen on the source code since Bug 871485 fixed?

Comment 11

[Michael Vines [:m1] [:evilmachines]]

(In reply to Sotaro Ikeda [:sotaro] from comment #10)
> :m1, does the crash happen on the source code since Bug 871485 fixed?

Our last round of stability was run against Gecko as of June 7th, so it didn't contain that fix.  However we just started a new round last night that does contain that fix, so we should know within a couple days whether or not the issue still manifests.

Comment 12

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Won't affect 1.0.1 since you can't send video via SMS on 1.0.1; 
I crashed on buri with the mozril.  I cannot tell if it was the same crash report or not because the wifi is not working on the device.  It won't initialize.

Comment 13

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Gecko  http://hg.mozilla.org/releases/mozilla-b2g18/rev/08cb0fc1e205
Gaia   6e43018fe137779997211f5dcdfa2ffa7ea5ac8b
BuildID 20130619070213
Version 18.0
Buri

See bug 880617 for wifi not working on Buri

Comment 14

[Michael Vines [:m1] [:evilmachines]]

We have not reproduced this bug on over 100 hrs of stability test with the fix for  bug 871485.  WORKSFORME.