ubuntuappmanager crashes

[Petr Bláha]

While porting Ubuntu Touch to new device (HP Touchpad aka Tenderloin) I have observed Ubuntu App Manager crash on daily builds images. Same on Quantal as on Raring builds while with MWC demo build no crash. After start device ends with BlackScreen with ADB working.

There is a part of logcat around crash :

I/ubuntu::detail::ApplicationManager( 4473): virtual void ubuntu::detail::ApplicationManager::binderDied(const android::wp<android::IBinder>&)():397
F/libc ( 4473): Fatal signal 11 (SIGSEGV) at 0x000399a8 (code=1), thread 4473 (ubuntuappmanage)
I/DEBUG ( 136): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 136): Build fingerprint: 'hp/hp_tenderloin/tenderloin:4.2.2/JDQ39/573038:user/release-keys'
I/DEBUG ( 136): Revision: '3'
I/DEBUG ( 136): pid: 4473, tid: 4473, name: ubuntuappmanage >>> /system/bin/ubuntuappmanager <<<
I/DEBUG ( 136): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 000399a8
I/DEBUG ( 136): r0 000399a4 r1 7ef999c0 r2 0001e3c0 r3 00027b90
I/DEBUG ( 136): r4 7ef999c0 r5 0000000a r6 00001bc9 r7 00024184
I/DEBUG ( 136): r8 00033064 r9 000197d5 sl 0001937d fp 000190d5
I/DEBUG ( 136): ip 0001f618 sp 7ef999b0 lr 00014217 pc 2abe22d8 cpsr 000e0030
I/DEBUG ( 136): d0 696f72646e612074 d1 6e613c70773a3a64
I/DEBUG ( 136): d2 493a3a64696f7264 d3 263e7265646e6942
I/DEBUG ( 136): d4 6e6f69746163696c d5 3a726567616e614d
I/DEBUG ( 136): d6 615f74726174733a d7 7365735f77656e5f
I/DEBUG ( 136): d8 0000000000000000 d9 0000000000000000
I/DEBUG ( 136): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 136): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 136): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 136): d16 4d6e6f6974616369 d17 6553726567616e61
I/DEBUG ( 136): d18 63202c745f323374 d19 646e612074736e6f
I/DEBUG ( 136): d20 74533a3a64696f72 d21 202c2638676e6972
I/DEBUG ( 136): d22 6e612074736e6f63 d23 533a3a64696f7264
I/DEBUG ( 136): d24 0000000000000000 d25 0000000000000000
I/DEBUG ( 136): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 136): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 136): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 136): scr 00000010
I/DEBUG ( 136):
I/DEBUG ( 136): backtrace:
I/DEBUG ( 136): #00 pc 0000f2d8 /system/lib/libutils.so (android::RefBase::incStrong(void const*) const+1)
I/DEBUG ( 136): #01 pc 0000c213 /system/bin/ubuntuappmanager
I/DEBUG ( 136):
I/DEBUG ( 136): stack:
I/DEBUG ( 136): 7ef99970 00000000
I/DEBUG ( 136): 7ef99974 00000001
I/DEBUG ( 136): 7ef99978 000330b0 [heap]
I/DEBUG ( 136): 7ef9997c 00033150 [heap]
I/DEBUG ( 136): 7ef99980 7ef99a00 [stack]
I/DEBUG ( 136): 7ef99984 00000010
I/DEBUG ( 136): 7ef99988 00000000
I/DEBUG ( 136): 7ef9998c 00024158 [heap]
I/DEBUG ( 136): 7ef99990 7ef999b4 [stack]
I/DEBUG ( 136): 7ef99994 00024158 [heap]
I/DEBUG ( 136): 7ef99998 7ef99a34 [stack]
I/DEBUG ( 136): 7ef9999c 000155bf /system/bin/ubuntuappmanager
I/DEBUG ( 136): 7ef999a0 00000000
I/DEBUG ( 136): 7ef999a4 00015e07 /system/bin/ubuntuappmanager
I/DEBUG ( 136): 7ef999a8 df0027ad
I/DEBUG ( 136): 7ef999ac 00000000
I/DEBUG ( 136): #00 7ef999b0 7ef999c0 [stack]
I/DEBUG ( 136): ........ ........
I/DEBUG ( 136): #01 7ef999b0 7ef999c0 [stack]
I/DEBUG ( 136): 7ef999b4 00014217 /system/bin/ubuntuappmanager
I/DEBUG ( 136): 7ef999b8 00024184 [heap]
I/DEBUG ( 136): 7ef999bc 00016d7f /system/bin/ubuntuappmanager
I/DEBUG ( 136): 7ef999c0 00027b90 [heap]
I/DEBUG ( 136): 7ef999c4 00028338 [heap]
I/DEBUG ( 136): 7ef999c8 00024184 [heap]
I/DEBUG ( 136): 7ef999cc 00016da1 /system/bin/ubuntuappmanager
I/DEBUG ( 136): 7ef999d0 00024158 [heap]
I/DEBUG ( 136): 7ef999d4 00017507 /system/bin/ubuntuappmanager
I/DEBUG ( 136): 7ef999d8 00000000
I/DEBUG ( 136): 7ef999dc 2ab0208d /system/lib/libc.so (free+16)
I/DEBUG ( 136): 7ef999e0 00000001
I/DEBUG ( 136): 7ef999e4 2abe24f7 /system/lib/libutils.so (android::SharedBuffer::dealloc(android::SharedBuffer const*)+10)
I/DEBUG ( 136): 7ef999e8 00024198 [heap]
I/DEBUG ( 136): 7ef999ec 2abe5605 /system/lib/libutils.so (android::VectorImpl::_shrink(unsigned int, unsigned int)+148)

Object dump of linked library from OUT directory :

void RefBase::incStrong(const void* id) const
{
    f2d6: b510 push {r4, lr}
    weakref_impl* const refs = mRefs;
    f2d8: 6844 ldr r4, [r0, #4]
    refs->incWeak(id);
    f2da: 4620 mov r0, r4
    f2dc: f7ff ffe2 bl f2a4 <_ZN7android7RefBase12weakref_type7incWeakEPKv>

    refs->addStrongRef(id);
    const int32_t c = android_atomic_inc(&refs->mStrong);
    f2e0: 4620 mov r0, r4
    f2e2: f7fd ea02 blx c6e8 <__on_dlclose-0x468>
    ALOG_ASSERT(c > 0, "incStrong() called on %p after last strong ref", refs);

It seems that mRefs has incorrect value.

This bug affects all daily builds since March 4th.

[Daniel Winzen (q-d-deactivatedaccount)]

I can confirm this for haida (Neo V) and all other Xperia2011 Devices from Sony Ericsson.