Paul Yang [:pyang] (away) Reporter
	Description • 9 years ago

Crash report: https://crash-stats.mozilla.com/report/index/468f15f3-1496-402e-a7bf-a1ea02150324


Version info:
Build ID               20150317162504
Gaia Revision          306772a58335ac4cad285d27c3805090a8cc6886
Gaia Date              2015-03-17 17:12:36
Gecko Revision         https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/83251e534b33
Gecko Version          37.0
Device Name            flame
Firmware(Release)      4.4.2
Firmware(Incremental)  eng.cltbld.20150317.195036
Firmware Date          Tue Mar 17 19:50:45 EDT 2015
Bootloader             L1TC100118D0

STR: Running mtbf for 15 more hours.

	Paul Yang [:pyang] (away) Reporter
	Comment 1 • 9 years ago

Hi Blake, do you know for this issue?

	Blake Wu [:bwu][:blakewu]
	Comment 2 • 9 years ago

From the crash report, it crashed in AudioTrack. 

Hi Alastor,
Could you help check it?

	Alastor Wu [:alwu] Assignee
	Comment 3 • 9 years ago

I will check it later, keep NI for tracking.

	Alastor Wu [:alwu] Assignee
	Comment 4 • 9 years ago

Hi, Paul,
Could you apply this patch and test it again to capture the error log?
Because now I can't know the root cause from this crash record, I need more information.
Thanks :)

	Ken Chang[:kenkai]
	Comment 5 • 9 years ago

Alastor, You will take this bug, right?

	Alastor Wu [:alwu] Assignee
	Comment 6 • 9 years ago

Yes, but I need more information about this issue.

	Alastor Wu [:alwu] Assignee
	Comment 7 • 9 years ago

Hi, Paul,
Is there any log record about this bug?
Thanks!

	Paul Yang [:pyang] (away) Reporter
	Comment 8 • 9 years ago

https://crash-stats.mozilla.com/report/index/fc8363a9-f4e6-40c0-bddf-a4a842150331
another crash in same function

Build ID               20150330002503
Gaia Revision          473cd63f53c855299b719285d9b95e3f2910782f
Gaia Date              2015-03-27 20:14:43
Gecko Revision         https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/4b13c4254e2f
Gecko Version          37.0
Device Name            flame
Firmware(Release)      4.4.2
Firmware(Incremental)  eng.cltbld.20150330.040122
Firmware Date          Mon Mar 30 04:01:31 EDT 2015
Bootloader             L1TC100118D0

will attach logcat later.

	Alastor Wu [:alwu] Assignee
	Comment 9 • 9 years ago

[Crash on the description]
@ frameworks/av/media/libmedia/AudioTrack.cpp:990
> uint32_t minBufCount = afLatency / ((1000 * afFrameCount)/afSampleRate);
It seems that the crash reason is |afLatency| was divided by ZERO. 
I think that we can add some codes to prevent returning the zero value in |AudioSystem::getLatency()| and |AudioSystem::getFrameCount()|.

[Crash on the comment8]
@ frameworks/av/media/libmedia/AudioTrack.cpp:1070
> size_t temp = cblk->frameCount_;
It seems that we access the wrong memory address. 

The cblk is got from this code. 
> audio_track_cblk_t* cblk = static_cast<audio_track_cblk_t*>(iMem->pointer());

The code here ensures we got the non-null |iMem|.
> sp<IMemory> iMem = track->getCblk();
> if (iMem == 0) {
>   ALOGE("Could not get control block");
>   return NO_INIT;
> }

Therefore, I guess that the |iMem| have the wrong file format so that |iMem->pointer()| returns invalid audio_track_cblk_t address.

	Blake Wu [:bwu][:blakewu]
	Comment 10 • 9 years ago

From the crash stack, the crash happens in libmedia, it looks like a POVB. 

0 	libc.so 	libc.so@0x220c8 	
1 	libmozglue.so 	__aeabi_idiv0 	
2 		@0xefe 	
3 	libmedia.so 	android::AudioTrack::createTrack_l(audio_stream_type_t, unsigned int, audio_format_t, unsigned int, audio_output_flags_t, android::sp<android::IMemory> const&, int, unsigned int) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/frameworks/av/media/libmedia/AudioTrack.cpp:990
4 	libmedia.so 	android::AudioTrack::restoreTrack_l(char const*) 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/frameworks/av/media/libmedia/AudioTrack.cpp:1776
5 	libmedia.so 	android::AudioTrack::start() 	/builds/slave/b2g_m-cen_flm-kk_ntly-00000000/build/frameworks/av/media/libmedia/AudioTrack.cpp:485

	Wesly Huang (EPM)
	Comment 11 • 9 years ago

Hi Youlong:

As discussed in phone earlier today, would you help check the crash in libmedia? We would like to find out the root cause first to see the next step, even there is no plan for further Flame KK SW release.

Thank you.

	youlong.jiang
	Comment 12 • 9 years ago

(In reply to Wesly Huang from comment #11)
> Hi Youlong:
> 
> As discussed in phone earlier today, would you help check the crash in
> libmedia? We would like to find out the root cause first to see the next
> step, even there is no plan for further Flame KK SW release.
> 
> Thank you.

hi wesly -

the attach is your previous patch not log. just from brief log in comment#10, it's not feasible to catch more info. could you pls upload the whole log file.

tks.

	Wesly Huang (EPM)
	Comment 13 • 9 years ago

(In reply to youlong.jiang from comment #12)
> hi wesly -
> 
> the attach is your previous patch not log. just from brief log in
> comment#10, it's not feasible to catch more info. could you pls upload the
> whole log file.
> 
> tks.

Youlong, is the log in comment#0 & comment#8 sufficient for your analysis?

Paul, in comment#8 you mentioned about logcat upload, would you help provide more log for T2M to analysis?

Thanks!

	Alison Shiue
	Comment 14 • 9 years ago

Nexus-5-L(5.1) has encountered one crash which was related to audio, not sure if it was similar with the original issue.
Here is the crash report: https://crash-stats.mozilla.com/report/index/8a84b3a1-f464-4a21-b1f1-e37202150417

STR: 
Running MTBF for 34 more hours.

Version info:
Build ID               20150414162502
Gaia Revision          16e948bfaaa15dbc0200135d52f16257b4eab193
Gaia Date              2015-04-14 21:08:25
Gecko Revision         https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/0eec28e78eb1
Gecko Version          37.0
Device Name            hammerhead
Firmware(Release)      5.1
Firmware(Incremental)  eng.cltbld.20150414.201650
Firmware Date          Tue Apr 14 20:17:04 EDT 2015
Bootloader             HHZ12f

	Bobby Chien
	Comment 15 • 9 years ago

Looks like crash in comment 14 is different with comment 8. Alison, could create another tracking bug?

	Alison Shiue
	Comment 16 • 9 years ago

(In reply to Bobby Chien [:bchien] from comment #15)
> Looks like crash in comment 14 is different with comment 8. Alison, could
> create another tracking bug?

ok, bug 1155490 is tracking this issue.

	Paul Yang [:pyang] (away) Reporter
	Comment 17 • 9 years ago

I think comment #9 providing pretty sufficient information.  Ping me if you need more.

	youlong.jiang
	Comment 18 • 9 years ago

(In reply to Paul Yang [: pyang] from comment #17)
> I think comment #9 providing pretty sufficient information.  Ping me if you
> need more.

hi Paul -

from bug description, we just get crash result and tracking info, but it's also difficult for us to analysis issue. could you pls provide reproduce step and scenario.

@wesly -

from the crash report, it located the libmedia/AudioTrack. in my opinion, this part is related to framework/native level not BSP scope. from comment#9, if you have some tracking points, could you test locally on your site?

tks.

	Wesly Huang (EPM)
	Comment 19 • 9 years ago

 > @wesly -
> 
> from the crash report, it located the libmedia/AudioTrack. in my opinion,
> this part is related to framework/native level not BSP scope. from
> comment#9, if you have some tracking points, could you test locally on your
> site?
> 
> tks.

Hi Youlong:

I discussed this with QA, RD, and EPM:

1. this is found during MTBF test so no fixed STR.
2. please help submit a SR (paste SR number here) to QCT for checking this issue, in comment#9 there is some analysis & clue. If QCT is able to find the root cause and provide a fix we will consider to have it in Flame KK (Mozilla build, since no further T2M SW release in plan), and most important, FxOS with Lollipop.

Thank you.

	Bobby Chien
	Comment 20 • 9 years ago

as comment 19, troubleshooting process takes time between mozilla and partner. Considering timeframe and it's not easy reproducible issue, unblock case from 2.2+. And waiting response.

	youlong.jiang
	Comment 21 • 9 years ago

(In reply to Wesly Huang from comment #19)
>  > @wesly -
> > 
> > from the crash report, it located the libmedia/AudioTrack. in my opinion,
> > this part is related to framework/native level not BSP scope. from
> > comment#9, if you have some tracking points, could you test locally on your
> > site?
> > 
> > tks.
> 
> Hi Youlong:
> 
> I discussed this with QA, RD, and EPM:
> 
> 1. this is found during MTBF test so no fixed STR.
> 2. please help submit a SR (paste SR number here) to QCT for checking this
> issue, in comment#9 there is some analysis & clue. If QCT is able to find
> the root cause and provide a fix we will consider to have it in Flame KK
> (Mozilla build, since no further T2M SW release in plan), and most
> important, FxOS with Lollipop.
> 
> Thank you.

Dear wesly -

ok. I would apply for qcom support about this problem and feedback asap.

tks.

	Wesly Huang (EPM)
	Comment 22 • 9 years ago

Thanks, please have the SR number here, and keep up posted the feedback.

	youlong.jiang
	Comment 23 • 9 years ago

(In reply to Wesly Huang from comment #22)
> Thanks, please have the SR number here, and keep up posted the feedback.

hi wesly -

here is the SR num:01993174

i'll feedback if there's any update.

tks.

	youlong.jiang
	Comment 24 • 9 years ago

Dears -

Please enable log mask in AudioTrack.cpp AudioFlinger.cpp,thread.cpp AudioPolicyManager.cpp,AudioPolicyManagerBase.cpp,mediaplayerservice.cpp.

then feedback with logcat.

Please catch log by logcat -v threadtime. 

tks.

	Bobby Chien
	Comment 25 • 9 years ago

ni paul per comment 24.

	Wesly Huang (EPM)
	Comment 26 • 9 years ago

Thanks Bobby, clear my ni and we need more log for further check per comment#24.

	Paul Yang [:pyang] (away) Reporter
	Comment 27 • 9 years ago

Didn't catch this bug since last occurrence. Will keep collecting log with threadtime.

	Bobby Chien
	Comment 28 • 9 years ago

see bp-GUID bp-468f15f3-1496-402e-a7bf-a1ea02150324

	Bobby Chien
	Comment 29 • 9 years ago

As crash report, no such crash and signature for long time. Close as worksforme.