951018 - [B2G][Helix][Bluetooth][HanCheng]B2G crash in mozilla::dom::bluetooth::BluetoothDBusService::AddReservedServicesInternal

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Bluetooth, defect)

Description

[lecky]

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; aff-kingsoft-ciba; .NET4.0C; .NET4.0E)

Steps to reproduce:

* Description:
  B2G crash when open bluetooth.

* Reproduction steps:
  1. Open Airplane mode.
  2. Open Bluetooth.

* Expected result:
  Bluetooth can be opened and can search for devices.

* Actual result:
  B2G Crash. We only find this issue once.

* Reproduction build:( V1.1.0 hd/2013-11-14)

* Analyze
1. From the minidump, we saw B2G crash at mozilla::dom::bluetooth::BluetoothDBusService::AddReservedServicesInternal. [RawDBusConnection.h : 35 + 0x0]

The code:

BluetoothDBusService::AddReservedServicesInternal()
{
    ...
    dbus_func_args(gThreadConnection->GetConnection(),  // Crashed here
    ...

2. We try to disassemble libxul.so, but still can't find the root cause. Could you please give some suggestion about how to analyze the disassemble.txt?

Comment 1

[lecky]

Attachment: Log&minidump&disassemble for bt crash.rar

Crash happens at "12-16 12:09:21".

In kmsgcat-log:
12-16 12:09:21 <7>[1903, BluetoothCmd] [  508.331729] BluetoothCmd: unhandled page fault (11) at 0x00000000, code 0x017

Comment 2

[Wayne Chang [:wchang]]

There's no need to NI me.

Comment 3

[Gina Yeh [:gyeh] [:ginayeh]]

I follow the STR hundreds of times but had no luck to reproduce.

However, the information from reporter caught my attention, I think that we can and we should do some check before using |gThreadConnection->GetConnection()|.

Comment 4

[Gina Yeh [:gyeh] [:ginayeh]]

This issue should be reproducible only on branch v1.1.0hd since we've already handled similar cases on other branches. Nominate hd?

Comment 5

[lecky]

Hi Gina:
   Which similar case? Can we merge into v1.1.0hd?

Comment 6

[Gina Yeh [:gyeh] [:ginayeh]]

Several bugs are involved and the patches are quite big. I would recommend to generate a patch for v1.1.0hd.

Comment 7

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: [v1.1.0hd] Patch 1: Check dbus connection before sending dbus message

This patch checks the dbus connection before sending out dbus message. In other words, if the connection is no longer existed, we report error back rather than using the broken connection which introduced crash.

Comment 8

[lecky]

ok.Thanks!

Comment 9

[Wayne Chang [:wchang]]

Since this is a required code correction we should land this fix on our branch for correctness.

Comment 10

[Gina Yeh [:gyeh] [:ginayeh]]

Please do not close it until the patch is landed.

Comment 11

[Gina Yeh [:gyeh] [:ginayeh]]

Comment on attachment 8350556 [details] [diff] [review]
[v1.1.0hd] Patch 1: Check dbus connection before sending dbus message

Review of attachment 8350556 [details] [diff] [review]:
-----------------------------------------------------------------

Eric, the patch is really really small. Please take a look when you get a minute. Thanks.

Comment 12

[Gina Yeh [:gyeh] [:ginayeh]]

Attachment: [v1.1.0hd] Patch 1: Check dbus connection before sending dbus message, r=echou

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18_v1_1_0_hd/rev/2978f95130ee