Closed Bug 916951 Opened 6 years ago Closed 6 years ago

[B2G] [Buri] [Camera] Device crashes after taking many pictures then launching Gallery

Categories

(Firefox OS Graveyard :: Gaia::Camera, defect)

ARM
Gonk (Firefox OS)
defect
Not set

Tracking

(Not tracked)

RESOLVED DUPLICATE of bug 915869

People

(Reporter: ckreinbring, Unassigned)

Details

(Keywords: crash, regression, reproducible, Whiteboard: [b2g-crash])

Crash Data

Attachments

(2 files)

Description:
After taking a large amount of pictures with the camera, the device will crash after navigating to the gallery.

Repro Steps:
1) Update Buri to Build ID: 20130916040205
2) Launch the Camera app.
3) Take a large amount of pictures, about 20 will be enough.
4) Tap the gallery button to launch the Gallery app.
5) Observe the device's behavior as the pictures are loaded.

Actual:
The device crashes after loading one or two pictures.

Expected:
All of the pictures taken are loaded with no errors.

Environmental Variables
Occurs on Buri 1.2 mozilla RIL
Build ID: 20130916040205
Gecko: http://hg.mozilla.org/mozilla-central/rev/c4bcef90cef9
Gaia: a0079597d510ce8ea0b9cbb02c506030510b9eeb
Platform Version: 26.0a1

Notes:
Repro frequency: 100%
See attached logcat logs
Crash ID: bp-71b1ade5-cad5-4886-b048-ef7002130916
blocking-b2g: --- → koi?
I can reproduce this with m-c:dc909122bcf5 on hamachi. Just to confirm: this isn't a Gallery crash; I see the blue Firefox OS startup screen with this issue occurs.
Keywords: crash
Keywords: reproducible
The gdb bt is pretty thin:

Program received signal SIGSEGV, Segmentation fault.
0xb0005496 in unwind_phase2_forced (ucbp=0x0, entry_vrs=<value optimized out>, resuming=143360)
    at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:717
717	/tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c: No such file or directory.
	in /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c
(gdb) bt
#0  0xb0005496 in unwind_phase2_forced (ucbp=0x0, entry_vrs=<value optimized out>, resuming=143360)
    at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:717
#1  0x46fd77a8 in ?? ()
#2  0x46fd77a8 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
Not sure if this is useful, but here it is.
Here's the output if you step through the exception handler and signal handler. At this point my knowledge is exhausted. :)

Program received signal SIGSEGV, Segmentation fault.
0xb0005496 in unwind_phase2_forced (ucbp=0x0, entry_vrs=<value optimized out>, resuming=143360)
    at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:717
717	/tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c: No such file or directory.
	in /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
syscall () at bionic/libc/arch-arm/bionic/syscall.S:50
50	    ldmfd   sp!, {r4, r5, r6, r7}
(gdb) bt
#0  syscall () at bionic/libc/arch-arm/bionic/syscall.S:50
#1  0x40d47164 in tgkill (sig=11, info=0xbece4038, uc=0xbece40b8)
    at /home/mikeh/dev/mozilla/m-c/src/toolkit/crashreporter/google-breakpad/src/client/linux/handler/exception_handler.cc:105
#2  google_breakpad::ExceptionHandler::SignalHandler (sig=11, info=0xbece4038, uc=0xbece40b8)
    at /home/mikeh/dev/mozilla/m-c/src/toolkit/crashreporter/google-breakpad/src/client/linux/handler/exception_handler.cc:346
#3  0x40d2ee46 in nsProfileLock::FatalSignalHandler (signo=11, info=0xbece4038, context=0xbece40b8)
    at /home/mikeh/dev/mozilla/m-c/src/profile/dirserviceprovider/src/nsProfileLock.cpp:185
#4  0x41c34638 in AsmJSFaultHandler (signum=11, info=0xbece4038, context=0xbece40b8) at /home/mikeh/dev/mozilla/m-c/src/js/src/jit/AsmJSSignalHandlers.cpp:963
#5  0xffff0514 in ?? ()
#6  0xffff0514 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xb00054be in unwind_phase2_forced (ucbp=0x0, entry_vrs=<value optimized out>, resuming=-3)
    at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:730
730	/tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c: No such file or directory.
	in /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c
(gdb) c
Continuing.
[New Thread 140.258]

Program received signal SIGCONT, Continued.
[Switching to Thread 140.258]
__ioctl () at bionic/libc/arch-arm/syscalls/__ioctl.S:9
9	    swi     #0
(gdb) c
Continuing.

Child terminated with signal = 0xb (SIGSEGV)

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb)
QA Contact: nkot
Regression range:
Build ID: 20130915040205 - Does NOT Reproduce
Gecko: http://hg.mozilla.org/mozilla-central/rev/9366ee039645
Gaia: 3f51f302c3a0c57d8bad482ec7ee86b2819389fb
Platform Version: 26.0a1

Build ID: 20130916040205 - Reproduces
Gecko: http://hg.mozilla.org/mozilla-central/rev/c4bcef90cef9
Gaia: a0079597d510ce8ea0b9cbb02c506030510b9eeb
Platform Version: 26.0a1
Whiteboard: [b2g-crash]
Status: NEW → RESOLVED
blocking-b2g: koi? → ---
Closed: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 915869
Crash Signature: [@ mozalloc_abort(char const*) | NS_DebugBreak | mozilla::layers::PGrallocBufferParent::Write(mozilla::layers::PGrallocBufferParent*, IPC::Message*, bool) ]
To note: the crash signature needs to be placed in the crash signature field for the bugs.  This helps to figure out duplicates faster.
You need to log in before you can comment on or make changes to this bug.