969127 - [Helix] gdb is broken - SIGSEGV in unwind_phase2_forced

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: General, defect)

Description

[Mike Habicher [:mikeh] (high bugzilla latency)]

If I flash helix with recent gecko/gaia builds, then once the device starts properly, I see:

17:42:01 ➜  039_helix git:(master) ✗ adb shell b2g-ps
APPLICATION      USER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAME
b2g              root      166   1     201376 68480 ffffffff 400b2804 S /system/b2g/b2g
(Nuwa)           root      377   166   54780  20196 ffffffff 400fc804 S /system/b2g/plugin-container
Communications   app_429   429   377   1244668 37016 ffffffff 400fc804 R /system/b2g/plugin-container
Homescreen       app_531   531   377   132792 41620 ffffffff 400fc804 S /system/b2g/plugin-container
(Preallocated a  root      614   377   62964  19800 ffffffff 400fc804 S /system/b2g/plugin-container

Since I am trying to debug an app start-up problem, I do:

./run-gdb.sh attach 614

...and type 'c' [Enter] to continue the pre-allocated process. If I then touch the Camera app icon, the process borks out with:

Program received signal SIGSEGV, Segmentation fault.
0xb0005462 in unwind_phase2_forced (ucbp=0x6f6e00, entry_vrs=0x1f, resuming=-1342075088) at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:717
717	/tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c: No such file or directory.
	in /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c
(gdb) bt
#0  0xb0005462 in unwind_phase2_forced (ucbp=0x6f6e00, entry_vrs=0x1f, resuming=-1342075088) at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:717
#1  0x4000e000 in ?? ()
Cannot access memory at address 0xab
#2  0x4000e000 in ?? ()
Cannot access memory at address 0xab
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

The process can't continue:

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xb0005462 in unwind_phase2_forced (ucbp=0x6f6e00, entry_vrs=0x1f, resuming=-1342075088) at /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c:717
717	in /tmp/android-build-bb7e003d31d08f72cabc269a652912b7/src/build/../gcc/gcc-4.4.3/libgcc/../gcc/config/arm/unwind-arm.c
(gdb) c
Continuing.

Child terminated with signal = 0xb (SIGSEGV)

...and eventually terminates.

Comment 1

[Mike Habicher [:mikeh] (high bugzilla latency)]

MOZ_DEBUG_CHILD_PROCESS=1 doesn't work either.

17:48:21 ➜  039_helix git:(master) ✗ MOZ_DEBUG_CHILD_PROCESS=1 ./run-gdb.sh
B2G_DEBUG = 0
B2G_NOOPT = 0
MOZ_DMD = 0
REFCNT_LOGGING = 0
ENABLE_PROFILING = 0
GECKO_PATH = /home/mikeh/dev/mozilla/m-c/b2g-inbound
GECKO_OBJDIR = /home/mikeh/dev/mozilla/b2g/039_helix/objdir-gecko-b2g-inbound
..ignoring gdbserver pid 838

Using DMD.

Process /system/b2g/b2g created; pid = 2400
Listening on port 11000
prebuilt/linux-x86/toolchain/arm-linux-androideabi-4.4.x/bin/arm-linux-androideabi-gdb -x /tmp/b2g.gdbinit.mikeh.1856 /home/mikeh/dev/mozilla/b2g/039_helix/objdir-gecko-b2g-inbound/dist/bin/b2g
GNU gdb (GDB) 7.1-android-gg2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "--host=i686-linux-gnu --target=arm-elf-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/mikeh/dev/mozilla/b2g/039_helix/objdir-gecko-b2g-inbound/dist/bin/b2g...done.
Remote debugging from host 127.0.0.1
__dl__start () at bionic/linker/arch/arm/begin.S:35
35		mov	r0, sp
(gdb) c
Continuing.
1383320641351	Marionette	INFO	marionette enabled via build flag and pref
1383320642101	Marionette	INFO	marionette-server.js loaded
1383320642336	Marionette	INFO	B2G emulator: no
1383320642337	Marionette	INFO	Device detected is HUAWEI Y300-F1
1383320642340	Marionette	INFO	Listening on port 2828

1383320642341	Marionette	INFO	Marionette server ready

Program received signal SIGSEGV, Segmentation fault.
0x4005e9bc in ?? ()
(gdb) bt
#0  0x4005e9bc in ?? ()
#1  0x4005ed62 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Copying a few comments from #b2g:

13:35 < jld> mikeh: I've seen that before.
13:36 < jld> mikeh: Somehow the EH code goes out-of-bounds on the exception index table.  This *might* be related to the linker bug that give libc a not-quite-sorted index.
13:36 < jld> mikeh: The other question is... why are we in the EH code?
13:37 < jld> mikeh: There are definitely weird things that happen when the libc and ld.so that gdb sees aren't the ones on the device.
13:38 < jld> mikeh: I know things tended to break in the code in ld.so that's supposed to inform gdb of library loading.
13:39 < jld> mikeh: So, if I was debugging the main process and started the Email app (which causes the parent to load NSS and dlopen the PKCS#11 module), it would break.
13:40 < mikeh> jld: that's consistent with what I'm seeing--the camera app causes a load of the camera driver library (though I thought that was in another process).

Comment 3

[BMO Automation]

Firefox OS is not being worked on