917957 - Killing an app with -9 causes segfault and b2g process restart

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: Gaia::System, defect)

Description

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

STR:

- start an app on b2g (Browser or other)
- adb shell
- kill -9 pid (b2g-ps lists b2g processes)

Expected:  App receives mozbrowsererror and has a chance to fail gracefully

Actual:  App receives mozbrowsererror, but device segfaults and reboots

Example log:

I/GeckoDump( 1718): MyApp handleEvent: received mozbrowsererror
I/Gecko   ( 1718): [Parent 1718] ###!!! ABORT: actor has been |delete|d: file /Users/zeus/code/b2g/objdir-gecko/ipc/ipdl/PGrallocBufferParent.cpp, line 378
E/Gecko   ( 1718): mozalloc_abort: [Parent 1718] ###!!! ABORT: actor has been |delete|d: file /Users/zeus/code/b2g/objdir-gecko/ipc/ipdl/PGrallocBufferParent.cpp, line 378
F/libc    ( 1718): Fatal signal 11 (SIGSEGV) at 0x00000000 (code=1)
I/GeckoDump( 1718): MyApp handling the error ...
E/GeckoConsole( 1718): [JavaScript Error: "[Exception... "'Error: no message manager set' when calling method: [nsIObserver::observe]"  nsresult: "0x8057001c (NS_ERROR_XPC_JS_THREW_JS_OBJECT)"  location: "native frame :: <unknown filename> :: <TOP_LEVEL> :: line 0"  data: no]"]
I/DEBUG   ( 1484): debuggerd committing suicide to free the zombie!

Comment 1

[Fernando Jiménez Moreno [:ferjm]]

I can't reproduce with m-i 147857

Comment 2

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

Indeed.  As mysteriously as the bug appeared, it is now fixed in today's m-c as well.  Ok.

Comment 3

[Dave Hylands [:dhylands]]

It may depend on exactly *when* the -9 signal is received.

I believe that having the child die at the wrong point in time can cause the parent to assert/crash.

It would also be useful to determine if the phone rebooted, or the b2g app merely restarted.

If the phone reboots, then you'll see the phone splash (i.e. TURKCELL with unagi, Alcatel with Buri, etc)
If you only see the firefoxOS startup animation then its most likely just the b2g app restarting.

Comment 4

[Jed Parsons (use needinfo, please) [:jedp, :jparsons]]

(In reply to Dave Hylands [:dhylands] from comment #3)
> It may depend on exactly *when* the -9 signal is received.

It was 100% reproducible with varying intervals, including letting the process sit around for a while before -9'ing it.

> It would also be useful to determine if the phone rebooted, or the b2g app
> merely restarted.

Ah - good point.  I was being unintentionally misleading.  The phone did not reboot; it must have been the b2g app restarting.  The adb shell and lolcat were not disconnected in the process.  Thank you for drawing the distinction.  I have updated the title of the bug.

I cannot tell if there is an issue here that should be pursued.  Do you think this should be reopened?

Comment 5

[Dave Hylands [:dhylands]]

I've seen other crashes with similar behaviour where the b2g main process crashes/asserts when a child happens to crash at the wrong time (IIRC something went wrong related to IPC).