944276 - [fugu][buri][MMS] unable to view specific small pictures from MMS attachment which is taken from camera

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Gallery, defect)

Description

[Peipei Cheng (needinfo if you need my action)]

Test build buri v1.2
Gaia:     92cd11ea023dd6598d82d859ae3c945ff6589ce6                             
Gecko:    http://hg.mozilla.org/releases/mozilla-b2g26_v1_2/rev/14e91ab12441  
BuildID   20131127004001                                                       
Version   26.0     


STR:
1. Launch SMS
2. Add a new sms
3. Click add attachment -> Camera
4. Take a picture with size 200K~300K.
   This is very important! You can try to take a picture of a while paper, the size will be 200K~300K.
5. Click "Select"
6. In the new message page, tap on the picture and select "View"
   -> [issue] Unable to view this picture. It always return to a untitled page.

Comment 1

[Julien Wajsberg [:julienw]]

So it happens when you have a small file.

Can you try to do the same with a small file from Gallery too?

Comment 2

[Peipei Cheng (needinfo if you need my action)]

(In reply to Julien Wajsberg [:julienw] from comment #1)
> So it happens when you have a small file.
> 
> Can you try to do the same with a small file from Gallery too?

Attachment from Gallery does not have this problem.

This only happens when attach from Camera.

Comment 3

[James Zhang (Spreadtrum)]

It's bug, need fix on v1.2 or v1.3 branch.

Comment 4

[Julien Wajsberg [:julienw]]

I don't get why this bug is fugu specific nor why it should be a blocker.

Comment 5

[James Zhang (Spreadtrum)]

(In reply to Julien Wajsberg [:julienw] from comment #4)
> I don't get why this bug is fugu specific nor why it should be a blocker.

Need Steven explain it. We use v1.2f branch to resolve fugu major bug if v1.2 wontfix.

Comment 6

[Julien Wajsberg [:julienw]]

This is not a blocker, user rarely send a MMS of a picture with a white page.

That said, I reproduce the issue.

Comment 7

[Julien Wajsberg [:julienw]]

It happens when the picture is not resized and it comes from the Camera.

Comment 8

[Julien Wajsberg [:julienw]]

I added logs in some parts and it seems the Gallery app stops working at different points at each invocations.

* In some cases it doesn't go to the localized event handler.
* In other cases it went to the "open" function
* and in other cases it stopped somewhere between these 2 locations.

This is out of my skills here because I suspect some low-level issue. Redirecting to the Gallery component since I see clearly that the open.js file is loaded 100% of the time.

To reproduce, I take a picture of the black part of my thinkpad. The file is small enough if you don't see the "resizing" banner in the Messages app. It's also probably possible to hack the Messages app in [1] to never do the resize.

[1] https://github.com/mozilla-b2g/gaia/blob/master/apps/sms/js/compose.js#L170

Comment 9

[Steven Yang [:styang]]

After discussed with our partner, we will still need it for Fugu.

Comment 10

[Evelyn Hung]

Second to Julien's finding, looks like the activity is terminated immediately. I'm investigating..

Comment 11

[Evelyn Hung]

Not sure if this error log related, but I see this while doing blob.slice(): https://github.com/mozilla-b2g/gaia/blob/v1.2f/shared/js/blobview.js#L46

I/Gecko   (  103):
I/Gecko   (  103): ###!!! [Parent][AsyncChannel] Error: Value error: message was deserialized, but contained an illegal value
I/Gecko   (  103):
I/Gecko   (  103):
I/Gecko   (  103): ###!!! [Parent][AsyncChannel] Error: Channel error: cannot send/recv
I/Gecko   (  103):

Comment 12

[Evelyn Hung]

I tested `this.blob.slice()` in SMS app before calling activity, also got a similar gecko error, and then SMS is killed.

I/GeckoDump(12626): ===== sms: do slice
I/Gecko   (  103):
I/Gecko   (  103): ###!!! [Parent][AsyncChannel] Error: Value error: message was deserialized, but contained an illegal value
I/Gecko   (  103):
I/Gecko   (  103):
I/Gecko   (  103): ###!!! [Child][AsyncChannel] Error: Channel error: cannot send/recv
I/Gecko   (  103):
D/gralloc.sc7710(  103): alloc_device_free buffer_handle_t:0x479269c0 start
D/gralloc.sc7710(  103): alloc_device_free end
D/gralloc.sc7710(  103): alloc_device_free buffer_handle_t:0x47926ab0 start
D/gralloc.sc7710(  103): alloc_device_free end
I/Gecko   (  103):
I/Gecko   (  103): ###!!! [Parent][AsyncChannel] Error: Channel error: cannot send/recv
I/Gecko   (  103):
I/Gonk    (  103): Setting nice for pid 12613 to 1
I/Gonk    (  103): Changed nice for pid 12613 from 18 to 1.
I/Gecko   (  103):
I/Gecko   (  103): ###!!! [Parent][AsyncChannel] Error: Channel error: cannot send/recv
I/Gecko   (  103):

Ben, any idea?

Comment 13

[Kan-Ru Chen [:kanru] (UTC+9)]

(gdb) f
#0  mozilla::dom::ipc::RemoteBlob<(mozilla::dom::ipc::ActorFlavorEnum)0>::CreateSlice (this=0x475c8b80, aStart=0, aLength=1024, aContentType=...) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/Blob.cpp:1032
1032          return nullptr;
(gdb) p mActor
$19 = (mozilla::dom::ipc::Blob<(mozilla::dom::ipc::ActorFlavorEnum)0> *) 0x0
(gdb) bt
#0  mozilla::dom::ipc::RemoteBlob<(mozilla::dom::ipc::ActorFlavorEnum)0>::CreateSlice (this=0x475c8b80, aStart=0, aLength=1024, aContentType=...) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/Blob.cpp:1032
#1  0x4110b128 in nsDOMFileBase::Slice (this=0x475c8b80, aStart=0, aEnd=<value optimized out>, aContentType=..., optional_argc=3 '\003', aBlob=0xbea0f660)
    at /home/kanru/zone2/mozilla/B2G/gecko/content/base/src/nsDOMFile.cpp:255
#2  0x418ba434 in mozilla::dom::ipc::Blob<(mozilla::dom::ipc::ActorFlavorEnum)0>::Create (aManager=0x4a0b8400, aParams=...) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/Blob.cpp:1187
#3  0x418bf0b0 in mozilla::dom::ContentParent::AllocPBlobParent (this=0x4a0b8400, aParams=...) at /home/kanru/zone2/mozilla/B2G/gecko/dom/ipc/ContentParent.cpp:1920
#4  0x4195f73e in mozilla::dom::PContentParent::OnMessageReceived (this=0x4a0b8400, __msg=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/objdir-gecko-gecko-debug/ipc/ipdl/PContentParent.cpp:1803
#5  0x418ec92e in mozilla::ipc::AsyncChannel::OnDispatchMessage (this=0x4a0b8410, msg=...) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/glue/AsyncChannel.cpp:507
#6  0x418f2b3a in mozilla::ipc::RPCChannel::OnMaybeDequeueOne (this=0x4a0b8410) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/glue/RPCChannel.cpp:388
#7  0x412cc3aa in DispatchToMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)()> (this=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/tuple.h:383
#8  RunnableMethod<WebCore::ReverbConvolver, void (WebCore::ReverbConvolver::*)(), Tuple0>::Run (this=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/task.h:307
#9  0x418f13ba in mozilla::ipc::RPCChannel::RefCountedTask::Run (this=0x4844dc40) at ../../dist/include/mozilla/ipc/RPCChannel.h:397
#10 mozilla::ipc::RPCChannel::DequeueTask::Run (this=0x4844dc40) at ../../dist/include/mozilla/ipc/RPCChannel.h:414
#11 0x41d67990 in MessageLoop::RunTask (this=0x4043e0c0, task=0x4844dc40) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:338
#12 0x41d68086 in MessageLoop::DeferOrRunPendingTask (this=0x4844dc40, pending_task=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:346
#13 0x41d68ccc in MessageLoop::DoWork (this=0x4043e0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:446
#14 0x418f09a0 in mozilla::ipc::DoWorkRunnable::Run (this=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/glue/MessagePump.cpp:41
#15 0x41d3d894 in nsThread::ProcessNextEvent (this=0x40402550, mayWait=<value optimized out>, result=0xbea106af) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/threads/nsThread.cpp:622
#16 0x41d0630e in NS_ProcessNextEvent (thread=0x40402550, mayWait=true) at /home/kanru/zone2/mozilla/B2G/gecko/xpcom/glue/nsThreadUtils.cpp:238
#17 0x418f0bba in mozilla::ipc::MessagePump::Run (this=0x40401dc0, aDelegate=0x4043e0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/glue/MessagePump.cpp:116
#18 0x41d67e9a in MessageLoop::RunInternal (this=0x4043e0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:220
#19 0x41d67eb2 in MessageLoop::RunHandler (this=0x4043e0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:213
#20 MessageLoop::Run (this=0x4043e0c0) at /home/kanru/zone2/mozilla/B2G/gecko/ipc/chromium/src/base/message_loop.cc:187
#21 0x41874d2a in nsBaseAppShell::Run (this=0x44574100) at /home/kanru/zone2/mozilla/B2G/gecko/widget/xpwidgets/nsBaseAppShell.cpp:161
#22 0x41781b42 in nsAppStartup::Run (this=0x44573af0) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/components/startup/nsAppStartup.cpp:269
#23 0x40cc3d0e in XREMain::XRE_mainRun (this=0xbea10994) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/xre/nsAppRunner.cpp:3869
#24 0x40cc673a in XREMain::XRE_main (this=0xbea10994, argc=<value optimized out>, argv=<value optimized out>, aAppData=0x21830) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/xre/nsAppRunner.cpp:3937
#25 0x40cc68d0 in XRE_main (argc=1, argv=0xbea12b84, aAppData=0x21830, aFlags=<value optimized out>) at /home/kanru/zone2/mozilla/B2G/gecko/toolkit/xre/nsAppRunner.cpp:4139
#26 0x00009b94 in do_main (argc=1, argv=0xbea12b84) at /home/kanru/zone2/mozilla/B2G/gecko/b2g/app/nsBrowserApp.cpp:168
#27 main (argc=1, argv=0xbea12b84) at /home/kanru/zone2/mozilla/B2G/gecko/b2g/app/nsBrowserApp.cpp:261
(gdb)

Comment 14

[Kan-Ru Chen [:kanru] (UTC+9)]

So the RemoteBlob's actor is destroyed when the Camera activity exits.

  B2G            SMS           Camera
-------        -------       ----------
   |<--activity---|              |
   |              |              |
   |---open--------------------->|
   |<----------------RemoteBlob--|
   |              |              |
   |--RemoteBlob->|              |
   |<---------------ActorDestory-|
   mActor=nullptr |              x
   |<--slice------|
   |(error)       x
   |
   v

See also
https://bugzilla.mozilla.org/show_bug.cgi?id=832419
https://bugzilla.mozilla.org/show_bug.cgi?id=806503

Comment 15

[Evelyn Hung]

Hi Kyle, it seems you did a patch for bug 806503 which is similar to this one, can you help here?

Comment 16

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to Evelyn Hung [:evelyn] from comment #15)
> Hi Kyle, it seems you did a patch for bug 806503 which is similar to this
> one, can you help here?

Yeah, Ben and I can take this unless Kan-Ru wants to fix it.

Comment 17

[Kan-Ru Chen [:kanru] (UTC+9)]

Thanks, I have no idea how to fix this ;)

Comment 18

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to Kan-Ru Chen [:kanru] from comment #17)
> Thanks, I have no idea how to fix this ;)

Ok, just didn't want to step on any toes since you were investigating this.

Comment 19

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to Kan-Ru Chen [:kanru] from comment #14)
> So the RemoteBlob's actor is destroyed when the Camera activity exits.
> 
>   B2G            SMS           Camera
> -------        -------       ----------
>    |<--activity---|              |
>    |              |              |
>    |---open--------------------->|
>    |<----------------RemoteBlob--|
>    |              |              |
>    |--RemoteBlob->|              |
>    |<---------------ActorDestory-|
>    mActor=nullptr |              x
>    |<--slice------|
>    |(error)       x
>    |
>    v
> 
> See also
> https://bugzilla.mozilla.org/show_bug.cgi?id=832419
> https://bugzilla.mozilla.org/show_bug.cgi?id=806503

Bent and I both agree that this sequence of things should work.  It'll likely be a couple days before we can investigate though.

Comment 21

[Jason Smith [:jsmith]]

Switching to koi+ per the dupe. See the dupe's testing that shows that this also reproduces with cropped pictures.

Comment 22

[David Flanagan [:djf]]

Attachment: Gaia workaround

Julien, 

I created this workaround for bug 946519. It seems to fix that bug. Not positive that it will fix the camera bug too, but please review.

This patch is for the 1.2 branch. Maybe it will be good enough for 1.2 and we can try to get a gecko fix in 1.3?

Comment 23

[David Flanagan [:djf]]

The patch I've attached also seems to workaround the attaching from camera issue.

We could land the Gaia workaround in 1.2 as a temporary thing, and try to fix it in Gecko for 1.3?

What do you think, Kyle?

Comment 24

[David Flanagan [:djf]]

Julien and Kyle: see https://bugzilla.mozilla.org/show_bug.cgi?id=946519#c28 for the reasoning behind this Gaia workaround.  (Though that reasoning probably just duplicates the debugging done above in this bug).

I can't explain why bug 946519 appeared to be a regression. This one was reported well before the regression range in that other bug, and since they have the same workaround I assume they have the same underlying cause.

Comment 25

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

The underlying Gecko issue here needs to be investigated regardless.  What is described in comment 14 should work.

Comment 26

[David Flanagan [:djf]]

(In reply to Kyle Huey [:khuey] ([e-mail]) from comment #25)
> The underlying Gecko issue here needs to be investigated regardless.  What
> is described in comment 14 should work.

Absolutely. Yes, we need to fix this in Gecko. I'm offering this gaia workaround only because:

- this bug is more serious than previously believed because it is not just weirdly small camera images that are affected, but any image from gallery sufficiently cropped.

- it is a koi+ bug

- koi was supposed to be code complete as of yesterday

- comment #19 says it will be a couple of days before you and Ben can begin investigating a gecko fix

If we land the gaia workaround on the v1.2 branch, then we could convert this bug to a 1.3 blocker and get a little bit of breathing room to find a gecko solution.

I'm not sure who should make that call, but the patch is there if someone wants to land it (after it is reviewed, of course)

Comment 27

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Well we need to understand if this affects other stuff on 1.2 also, which means finding the root cause.

Comment 28

[Julien Wajsberg [:julienw]]

Comment on attachment 8345600 [details] [review]
Gaia workaround

r=me for a v1.2 only fix and with the requested changes + test fix + answered questions

Feel free to land if we don't find the root cause in Gecko, but I'd be more comfortable with a Gecko fix.

Comment 29

[David Flanagan [:djf]]

Landed my Gaia workaround to v1.2: https://github.com/mozilla-b2g/gaia/commit/bd559ee748be267a80fff2bbdbd887c85af06eba

Setting flags to show that 1.2 is fixed and 1.3 is still affected.  It does not look like we have a flag for the 1.2f branch so someone following the fugu work might want to uplift the workaround to that branch, too, or wait and uplift whatever gecko fix we get for 1.3.

Leaving this bug open because it is not resolved yet. The workaround just buys us a little time. I recommend that someone who is able to do so convert this from koi+ to 1.3+.  I don't want to change it to 1.3? and make it go through triage again.

Comment 30

[Jason Smith [:jsmith]]

In an effort to reduce confusion, I'm going to close this out for the koi+ fix & file a new bug for tracking the real fix in gecko for 1.3.

Comment 31

[John Ford [:jhford] CET/CEST Berlin Time]

This is on v1.2f

Comment 32

[Julien Wajsberg [:julienw]]

As John said, this is already in v1.2f.