camera-app crashes after quickly opening and closing app

[Chris Gagnon]

summary:
camera-app crashes after quickly opening and closing app

steps:
1. open camera app
2. close camera app
3. open camera app
4. close camera app

expected result:
no crash happens

actual results:
camera app crashes

[Chris Gagnon (chris.gagnon)]

you can watch the /var/crash directory while opening and closing the camera app to see the crash happen.

[Chris Gagnon (chris.gagnon)]

https://errors.ubuntu.com/oops/329a1cca-39fa-11e4-b914-fa163e4ccdf2

This bug might belong higher up in the stack like qtubuntu-camera

[Chris Gagnon (chris.gagnon)]

After the crash happens it can take a long time for the camera app to open again

[Bill Filler (bfiller)]

what device, what build?

[Bill Filler (bfiller)]

How are you closing the app?

[Chris Gagnon (chris.gagnon)]

device: krillin
build_number: 30
version_detail: ubuntu=20140911.2,device=20140908-d8c11f3,custom=1410379789,version=30

com.ubuntu.camera 3.0.0.387

I am swiping the screen right and then swiping up on the camera app

[Chris Gagnon (chris.gagnon)]

The errors.u.c link in comment 2 has more details on software installed

[Jean-Baptiste Lallement (jibel)]

Confirmed on krillin rtm #32 with the steps in the description. On second launch camera app crashes.

[Ricardo Salveti (rsalveti)]

Adding bugtask for hybris and moving to high, definitely not critical.

[Bill Filler (bfiller)]

Here is the stack trace with libhybris debug packages installed from http://ddebs.ubuntu.com/pool/main/libh/libhybris/

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
Core was generated by `./camera-app'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 my_pthread_mutex_lock (__mutex=0x8) at hooks.c:479
479 hooks.c: No such file or directory.
(gdb) bt
#0 my_pthread_mutex_lock (__mutex=0x8) at hooks.c:479
#1 0xa9d3cb58 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

[Victor Tuson Palau (vtuson)]

I think this bug should be critical

[Bill Filler (bfiller)]

changing priority per victor request

[Julien Funk (jaboing)]

It's worth mentioning that this is the new "top crasher" as per our "“Top Crashers of the Day”: 20140915" in the RTM Readiness report and if past experience is any indicator this crash is the reason we went from 8 hours to 1.5 minutes Mean Time Before Failure.

[Ricardo Salveti (rsalveti)]

The proper backtrace from android:

#0 my_pthread_mutex_lock (__mutex=0x8) at hooks.c:479
#1 0xa9e23b58 in memmove (src=0x0, dest=0x8, len=1) at bionic/libc/include/string.h:114
#2 move_forward_type<android::key_value_pair_t<android::String8, android::String8> > (n=2850176545, s=0x0, d=0x8) at system/core/include/utils/TypeHelpers.h:181
#3 android::SortedVector<android::key_value_pair_t<android::String8, android::String8> >::do_move_forward (this=<optimized out>, dest=0x8, from=0x0, num=2850176545) at system/core/include/utils/SortedVector.h:264

The crash in hybris is a quite weird one, as it's not able to access the pointer given to mutex_lock:
static int my_pthread_mutex_lock(pthread_mutex_t *__mutex)
unsigned int value = (*(unsigned int *) __mutex); <----- crash

Wonder when this crash started to happen, and nothing really changed in libhybris for quite a while.

[Ricardo Salveti (rsalveti)]

This seems to be a mix of issues, but the crash itself is caused because android_camera_set_scene_mode gets called after control gets released. In theory the correct result here would be an abort, but it seems assert is not behaving properly, which I'm now investigating why.

Besides that, the release/closing race seems to be actually part of qtubuntu-camera, and not hybris.

#0 my_pthread_mutex_lock (__mutex=0x8) at hooks.c:479
#1 0xa9d66f9c in android::Mutex::lock (this=this@entry=0x8) at system/core/include/utils/Mutex.h:112
#2 0xa9d67266 in Autolock (mutex=..., this=0xbef1ba70) at system/core/include/utils/Mutex.h:65
#3 android_camera_set_scene_mode (control=0x0, mode=SCENE_MODE_AUTO) at ubuntu/libhybris/compat/camera/camera_compatibility_layer.cpp:304
#4 0xac3413e4 in android_camera_set_scene_mode (n1=0x0, n2=SCENE_MODE_AUTO) at camera.c:50
#5 0xac37f848 in AalCameraExposureControl::setValue(QCameraExposureControl::ExposureParameter, QVariant const&) () from /usr/lib/arm-linux-gnueabihf/qt5/plugins/mediaservice/libaalcamera.so
#6 0xacd1c0fc in AdvancedCameraSettings::setHdrEnabled(bool) () from /usr/share/click/preinstalled/com.ubuntu.camera/3.0.0.387/lib/arm-linux-gnueabihf/CameraApp/libcamera-qml.so
#7 0xacd2147c in AdvancedCameraSettings::qt_metacall(QMetaObject::Call, int, void**) () from /usr/share/click/preinstalled/com.ubuntu.camera/3.0.0.387/lib/arm-linux-gnueabihf/CameraApp/libcamera-qml.so
#8 0xb6620c74 in QQmlPropertyPrivate::write(QObject*, QQmlPropertyData const&, QVariant const&, QQmlContextData*, QFlags<QQmlPropertyPrivate::WriteFlag>) () from /usr/lib/arm-linux-gnueabihf/libQt5Qml.so.5
#9 0xb662135a in QQmlPropertyPrivate::writeValueProperty(QObject*, QQmlPropertyData const&, QVariant const&, QQmlContextData*, QFlags<QQmlPropertyPrivate::WriteFlag>) () from /usr/lib/arm-linux-gnueabihf/libQt5Qml.so.5
#10 0xb66213f4 in QQmlPropertyPrivate::writeValueProperty(QVariant const&, QFlags<QQmlPropertyPrivate::WriteFlag>) () from /usr/lib/arm-linux-gnueabihf/libQt5Qml.so.5
#11 0xb6621474 in QQmlProperty::write(QVariant const&) const () from /usr/lib/arm-linux-gnueabihf/libQt5Qml.so.5
#12 0xb66995b6 in ?? () from /usr/lib/arm-linux-gnueabihf/libQt5Qml.so.5

[Ricardo Salveti (rsalveti)]

Yeah, even when hybris is actually working with a proper assert, that still causes a crash with an abort. The real fix here is in qtubuntu-camera, to make sure control is actually valid when using it.

This is a race when shutting down the app, and seems to be easier to crash now that for some unknown reason the startup is a bit slower.

[Ricardo Salveti (rsalveti)]

Made a simple patch to avoid this crash, but it's now showing up a different one in libQt5QML, so this needs to be investigated by someone that knows the stack better than I do.

Patch I used to avoid the crash described by this bug:

rsalveti@evasys:/tmp/camera/qtubuntu-camera$ bzr diff
=== modified file 'src/aalcameraexposurecontrol.cpp'
--- src/aalcameraexposurecontrol.cpp 2014-07-10 14:59:10 +0000
+++ src/aalcameraexposurecontrol.cpp 2014-09-19 06:06:32 +0000
@@ -65,7 +65,8 @@
         return false;
     }

- if (parameter == QCameraExposureControl::ExposureMode) {
+ if ((parameter == QCameraExposureControl::ExposureMode) &&
+ (m_service->androidControl() != NULL)) {
         m_requestedExposureMode = value.value<QCameraExposure::ExposureMode>();
         Q_EMIT requestedValueChanged(QCameraExposureControl::ExposureMode);

[Ricardo Salveti (rsalveti)]

Bill, mind assigning this bug to Florian or someone else in your team?

[Michael Sheldon (michael-sheldon)]

Second crash (after applying Ricardo's fix) appears to be unrelated to qtubuntu-camera or camera-app, and is instead caused by an issue in the QML compiler when being terminated whilst still compiling components asynchronously, I've opened a new bug to track that issue here: https://bugs.launchpad.net/ubuntu/+source/qtdeclarative-opensource-src/+bug/1373039