With Mir enabled: platform-api apps crash with SIGABRT in __gnu_cxx::__verbose_terminate_handler(), thrown from mir::client::DisplayConfiguration::copy_to_client()

[Jean-Baptiste Lallement]

This crash file is in /var/crash/ with Mir is enabled.

TEST CASE:
1. Flash a device with latest build
2. Enable Mir support
3. Reboot
  -> Verify that /var/crash is empty

ACTUAL RESULT:
This crash

TEST CASE 2: (from 1236705)
1. Load some songs on the device
2. Go to the Music scope and play a song
3. Don't stop playing and switch back to the music scope
4. While music is still playing, play another song

ProblemType: Crash
DistroRelease: Ubuntu 13.10
Package: maliit-framework 0.99.0+git20130615+97e8335-0ubuntu3
Uname: Linux 3.4.0-3-mako armv7l
ApportVersion: 2.12.5-0ubuntu1
Architecture: armhf
Date: Wed Oct 2 05:46:34 2013
ExecutablePath: /usr/bin/maliit-server
InstallationDate: Installed on 2013-10-01 (0 days ago)
InstallationMedia: Ubuntu Saucy Salamander (development branch) - armhf (20131001.3)
LocalLibraries: /android/system/lib/libgccdemangle.so /android/system/lib/egl/libGLESv2_adreno200.so /android/system/lib/libdsyscalls.so /android/system/lib/libgsl.so /android/system/lib/libc.so /android/system/lib/libstdc++.so /android/system/lib/libGLESv2.so /android/system/lib/libcutils.so /android/system/lib/liblog.so /android/system/lib/libm.so /android/system/lib/egl/libEGL_adreno200.so /android/system/lib/libEGL.so /android/system/lib/libcorkscrew.so /android/system/lib/libGLES_trace.so /android/system/lib/libz.so /android/system/lib/libstlport.so /android/system/lib/egl/libGLESv1_CM_adreno200.so /android/system/lib/libhardware.so /android/system/lib/libutils.so /android/system/lib/libgenlock.so
MarkForUpload: True
ProcCmdline: maliit-server
Signal: 6
SourcePackage: maliit-framework
StacktraceTop:
 ?? () from /lib/arm-linux-gnueabihf/libc.so.6
 raise () from /lib/arm-linux-gnueabihf/libc.so.6
 abort () from /lib/arm-linux-gnueabihf/libc.so.6
 __gnu_cxx::__verbose_terminate_handler() () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
 ?? () from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
Title: maliit-server crashed with SIGABRT in raise()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm autopilot cdrom dialout dip nopasswdlogin plugdev sudo tty video

[Apport retracing service (apport)]

StacktraceTop:
 __gnu_cxx::__verbose_terminate_handler() () at ../../../../src/libstdc++-v3/libsupc++/vterminate.cc:95
 __cxxabiv1::__terminate(void (*)()) () at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:38
 std::terminate() () at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:48
 __cxa_throw () at ../../../../src/libstdc++-v3/libsupc++/eh_throw.cc:84
 std::__throw_system_error(int) () at ../../../../../src/libstdc++-v3/src/c++11/functexcept.cc:104

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Para Siva (psivaa)]

The crash is occurring with the following version.. just to confirm
current build number: 78
device name: maguro
channel: devel-proposed
last update: 2013-10-03 08:59:26
version version: 78
version ubuntu: 20131003
version device: 20131002.1

[Michał Sawicz (saviq)]

Confirmed with image #80.

[Günter Schwann (schwann)]

A longer backtrace for the same issue:

phablet@ubuntu-phablet:~/maliit-framework-0.99.0+git20130615+97e8335/tests/ft_exampleplugin$ gdb ./ft_exampleplugin GNU gdb (GDB) 7.6-ubuntu
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/phablet/maliit-framework-0.99.0+git20130615+97e8335/tests/ft_exampleplugin/ft_exampleplugin...done.
(gdb) run
Starting program: /home/phablet/maliit-framework-0.99.0+git20130615+97e8335/tests/ft_exampleplugin/ft_exampleplugin
Traceback (most recent call last):
  File "/usr/lib/debug/usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.18-gdb.py", line 59, in <module>
    from libstdcxx.v6.printers import register_libstdcxx_printers
ImportError: No module named 'libstdcxx'
Traceback (most recent call last):
  File "/usr/lib/debug/usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.18-gdb.py", line 59, in <module>
    from libstdcxx.v6.printers import register_libstdcxx_printers
ImportError: No module named 'libstdcxx'
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
__pthread_gettid -2
terminate called after throwing an instance of 'std::system_error'
  what(): Operation not permitted

Program received signal SIGABRT, Aborted.
__libc_do_syscall () at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
44 ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory.
(gdb) bt
#0 __libc_do_syscall () at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
#1 0x406785fe in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#2 0x4067ae1a in __GI_abort () at abort.c:90
#3 0x405d07b4 in __gnu_cxx::__verbose_terminate_handler () at ../../../../src/libstdc++-v3/libsupc++/vterminate.cc:95
#4 0x405cf1d4 in __cxxabiv1::__terminate (handler=<optimized out>) at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:38
#5 0x405cf1f0 in std::terminate () at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:48
#6 0x405cf41a in __cxxabiv1::__cxa_throw (obj=0x2b780, tinfo=<optimized out>, dest=<optimized out>)
    at ../../../../src/libstdc++-v3/libsupc++/eh_throw.cc:84
#7 0x40606f8a in std::__throw_system_error (__i=1) at ../../../../../src/libstdc++-v3/src/c++11/functexcept.cc:104
#8 0x420245fc in mir::client::DisplayConfiguration::copy_to_client() const () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3
#9 0x42026638 in MirConnection::create_copy_of_display_config() () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3
#10 0x42025298 in mir_connection_get_display_info () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3
#11 0x41f19344 in ua_ui_display_new_with_index () from /usr/lib/arm-linux-gnueabihf/libubuntu_application_api_mirclient.so.1
#12 0x41edf1f2 in QUbuntuBaseScreen::QU...

[Günter Schwann (schwann)]

So my backtrace from before shows, that it's not related to maliit. It's using an "empty" test of maliit, that does not touch any maliit code. So I mark the maliit task as invalid

[Alan Griffiths (alan-griffiths)]

> terminate called after throwing an instance of 'std::system_error'
> what(): Operation not permitted
...
> #7 0x40606f8a in std::__throw_system_error (__i=1) at ../../../../../src/libstdc++-v3/src/c++11/functexcept.cc:104
> #8 0x420245fc in mir::client::DisplayConfiguration::copy_to_client() const () from /usr/lib/arm-linux-gnueabihf/libmirclient.so.3

Looking at the code in DisplayConfiguration::copy_to_client() the only reason I can see for it to be raising a system_error is for the host application to be linked without pthreads.

A small test program confirms that I can get this system_error("Operation not permitted") by attempting to use locks without enapling pthreads.

I'll try to reproduce the problem as described (but need to get my phone image updated).

[Daniel van Vugt (vanvugt)]

There is a second more likely explanation for the exception at /usr/include/c++/4.8/mutex:506.
That would be an invalid "this" pointer for DisplayConfiguration. Looking at mir_connection.cpp, it could happen if either:
  (1) The client (platform-api) sets an invalid DisplayConfiguration on the MirConnection; or
  (2) platform-api passes libmirclient an invalid MirConnection.

I'm not sure if there is any code path in which the fault could be in libmirclient. Looks most likely platform-api misusing the client API.

[Daniel van Vugt (vanvugt)]

Are you sure the bug is unrelated to Maliit? The crash is originating from a Maliit main() ...

#22 0x00013b0e in main () at main.cpp:139
        Maliit::SettingEntryAttributes::valueRangeMax = 0x22854 "valueRangeMax"
        Maliit::InputMethodQuery::translucentInputMethod = 0x228f4 "maliit-translucent-input-method"
        Maliit::SettingEntryAttributes::defaultValue = 0x22864 "defaultValue"
        Maliit::SettingEntryAttributes::valueDomain = 0x22820 "valueDomain"
        Maliit::SettingEntryAttributes::valueDomainDescriptions = 0x2282c "valueDomainDescriptions"
        Maliit::InputMethodQuery::correctionEnabledQuery = 0x22874 "maliit-correction-enabled"
        Maliit::InputMethodQuery::westernNumericInputEnforced = 0x228cc "maliit-western-numeric-input-enforced"
        RGB_MASK = 16777215
        Maliit::InputMethodQuery::attributeExtension = 0x228b0 "maliit-attribute-extension"
        Maliit::InputMethodQuery::suppressInputMethod = 0x22914 "maliit-suppress-input-method"
        Maliit::InputMethodQuery::attributeExtensionId = 0x22890 "maliit-attribute-extension-id"
        Maliit::SettingEntryAttributes::valueRangeMin = 0x22844 "valueRangeMin"

[Daniel van Vugt (vanvugt)]

Yep, the stack trace in comment #3 seems to show MirConnection::valid_connections is empty. So platform-api and/or Maliit is passing an invalid MirConnection pointer.

Although the stack trace also shows other globals uninitialized, which supports Alan's theory of comment #11.

[Alexandros Frantzis (afrantzis)]

One aspect of this bug is the strange crash that we get. This is caused by platform-api failing to properly detect failed connections
(https://code.launchpad.net/~afrantzis/platform-api/fix-1233988-somewhat/+merge/190378). With the proposed fix the client still aborts, since the connection fails, but with a much cleaner "Assertion `connect_suceeded' failed.", giving hints as to what's happening.

[Launchpad Janitor (janitor)]

This bug was fixed in the package platform-api - 0.19+13.10.20131010.1-0ubuntu1

---------------
platform-api (0.19+13.10.20131010.1-0ubuntu1) saucy; urgency=low

  [ Alexandros Frantzis ]
  * mirclient: Properly check for failed connections to the server
    Failing to do so leads to invalid/error connections being used
    platform-api, leading to crashes. . (LP: #1233988)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 163
 -- Ubuntu daily release <email address hidden> Thu, 10 Oct 2013 20:03:35 +0000

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:~mir-team/mir/development-branch at revision 1128, scheduled for release in mir, milestone Unknown

[Michał Sawicz (saviq)]

This seems to be an issue still.

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:qtubuntu at revision 188, scheduled for release in qtubuntu, milestone ubuntu-13.05

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:platform-api at revision 165, scheduled for release in platform-api, milestone ubuntu-13.05

[Launchpad Janitor (janitor)]

This bug was fixed in the package platform-api - 0.19+13.10.20131015.1-0ubuntu1

---------------
platform-api (0.19+13.10.20131015.1-0ubuntu1) saucy; urgency=low

  [ Robert Carr ]
  * It seems events of mir_event_type_surface may lead to passing an
    uninitialized ubuntu event in to qtubuntu. Drop these events for
    now.

  [ Kevin Gunn ]
  * bump mir build dep 0.0.15 & libmirserver7.

  [ Alexandros Frantzis ]
  * mirclient: Return a null UApplicationInstance* when failing to
    connect to the mir server. (LP: #1233988)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 167
 -- Ubuntu daily release <email address hidden> Tue, 15 Oct 2013 02:39:54 +0000

[Timo Jyrinki (timo-jyrinki)]

Mir fix released in https://launchpad.net/ubuntu/+source/mir/0.0.15+13.10.20131014-0ubuntu1 (changelog at https://code.launchpad.net/~mir-team/mir/development-branch/+merge/191055).

[Launchpad Janitor (janitor)]

This bug was fixed in the package qtubuntu - 0.52+13.10.20131016-0ubuntu1

---------------
qtubuntu (0.52+13.10.20131016-0ubuntu1) saucy; urgency=low

  [ Michał Sawicz ]
  * Map PowerDown and PowerOff keys and fix indentation. (LP: #1232122)

  [ Alexandros Frantzis ]
  * Abort if we can't get an ubuntu application instance. (LP: #1233988)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 189
 -- Ubuntu daily release <email address hidden> Wed, 16 Oct 2013 02:33:02 +0000