ubuntu-location-service crash

[Fabio Marconi]

Hallo
Testing unity8-MIR image ubuntu-desktop-next in dmesg there was this repeated a bunch of times:

[ 13.446215] init: ubuntu-location-service main process (682) killed by SEGV signal
[ 13.446228] init: ubuntu-location-service main process ended, respawning
[ 13.454540] init: ubuntu-location-service main process (817) killed by SEGV signal
[ 13.454551] init: ubuntu-location-service main process ended, respawning

ProblemType: Bug
DistroRelease: Ubuntu 14.10
Package: ubuntu-location-service-bin 1.0.0+14.10.20140630-0ubuntu1
ProcVersionSignature: Ubuntu 3.15.0-6.11-generic 3.15.0
Uname: Linux 3.15.0-6-generic x86_64
ApportVersion: 2.14.3-0ubuntu2
Architecture: amd64
Date: Fri Jul 4 00:44:15 2014
InstallationDate: Installed on 2014-07-03 (0 days ago)
InstallationMedia: Ubuntu-Desktop-Next 14.10 "Utopic Unicorn" - Alpha amd64 (20140703)
SourcePackage: location-service
UpgradeStatus: No upgrade log present (probably fresh install)

[Manuel de la Peña (mandel)]

I have been looking into the issue and when gdb attached I get the following:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb4aff3c0 (LWP 9459)]
0xb6c2d7c2 in pthread_mutex_lock () from /lib/arm-linux-gnueabihf/libpthread.so.0
(gdb) bt
#0 0xb6c2d7c2 in pthread_mutex_lock () from /lib/arm-linux-gnueabihf/libpthread.so.0
#1 0xb6c83eb8 in __gthread_mutex_lock (__mutex=<optimized out>) at /usr/include/arm-linux-gnueabihf/c++/4.9/bits/gthr-default.h:748
#2 std::mutex::lock (this=<optimized out>) at /usr/include/c++/4.9/mutex:135
#3 0xb6c890e2 in lock_guard (__m=..., this=<synthetic pointer>) at /usr/include/c++/4.9/mutex:377
#4 core::Signal<bool>::operator() (this=0x18d3050, args#0=<optimized out>) at /usr/include/core/signal.h:134
#5 0xb6c80d92 in operator= (rhs=@0xb4afe998: true, this=0x18d3028) at /usr/include/core/property.h:82
#6 detail::CachedRadioCell::on_network_registration_property_changed (this=0x18d2f90, tuple=...)
    at /build/buildd/location-service-2.1+14.10.20141013/src/location_service/com/ubuntu/location/connectivity/cached_radio_cell.cpp:495
#7 0xb6ca4d48 in core::dbus::Signal<org::Ofono::Manager::Modem::NetworkRegistration::PropertyChanged, std::tuple<std::string, core::dbus::types::Variant> >::operator() (
    this=0x18d29b8, msg=...) at /usr/include/core/dbus/impl/signal.h:343
#8 0xb6e23546 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#9 0xb6e19d54 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#10 0xb6e18572 in core::dbus::Bus::handle_message(std::shared_ptr<core::dbus::Message> const&) () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#11 0xb6e1860e in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#12 0xb6a242e2 in dbus_connection_dispatch () from /lib/arm-linux-gnueabihf/libdbus-1.so.3
#13 0xb6e309c8 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#14 0xb6e2e4d8 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#15 0xb6e2e7b6 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#16 0xb6e17958 in core::dbus::Bus::run() () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#17 0xb6bf4360 in ?? () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#18 0xb6c2bf98 in start_thread () from /lib/arm-linux-gnueabihf/libpthread.so.0
#19 0xb6ae722c in ?? () from /lib/arm-linux-gnueabihf/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

The/A way to reproduce it is to start the location service and turn on and off the aerplane mode (with a sim that needs to be unlocked).

[Manuel de la Peña (mandel)]

We also have crashes in the following way:

(gdb) bt
#0 0x0000004c in ?? ()
#1 0xb6c8527e in operator() (__args#0=@0xb170196c: false, this=0xb1701980) at /usr/include/c++/4.9/functional:2439
#2 core::Property<bool>::set (this=0xb1701968, new_value=<optimized out>) at /usr/include/core/property.h:147
#3 0xb6c7cd92 in operator= (rhs=@0xb4afe998: false, this=0xb1701968) at /usr/include/core/property.h:82
#4 detail::CachedRadioCell::on_network_registration_property_changed (this=0xb17018d0, tuple=...)
    at /build/buildd/location-service-2.1+14.10.20141013/src/location_service/com/ubuntu/location/connectivity/cached_radio_cell.cpp:495
#5 0xb6ca0d48 in core::dbus::Signal<org::Ofono::Manager::Modem::NetworkRegistration::PropertyChanged, std::tuple<std::string, core::dbus::types::Variant> >::operator() (
    this=0x1759550, msg=...) at /usr/include/core/dbus/impl/signal.h:343
#6 0xb6e1f546 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#7 0xb6e15d54 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#8 0xb6e14572 in core::dbus::Bus::handle_message(std::shared_ptr<core::dbus::Message> const&) () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#9 0xb6e1460e in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#10 0xb6a202e2 in dbus_connection_dispatch () from /lib/arm-linux-gnueabihf/libdbus-1.so.3
#11 0xb6e2c9c8 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#12 0xb6e2a4d8 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#13 0xb6e2a7b6 in ?? () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#14 0xb6e13958 in core::dbus::Bus::run() () from /usr/lib/arm-linux-gnueabihf/libdbus-cpp.so.4
#15 0xb6bf0360 in ?? () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#16 0xb6c27f98 in start_thread () from /lib/arm-linux-gnueabihf/libpthread.so.0
#17 0xb6ae322c in ?? () from /lib/arm-linux-gnueabihf/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Whichs is not realted to the previous backtrace.

[Thomas Voß (thomas-voss)]

This issue arises as the CachedRadioCell is still registered with the PropertyChanged signal coming in from Ofono, despite the object already being dead and removed from the cache.

[Thomas Voß (thomas-voss)]

This should be fixed with the latest images. Closing the bug. Feel free to reopen if you manage to reproduce.