Comment 3 for bug 1492483

Revision history for this message
Tony Espy (awe) wrote :

The crash happens because if gprs_context_remove is called and the subsequent send of a DEACTIVATE_CALL fails, then retry_deactivate is added as a timeout callback. When retry_deactivate is invoked two seconds later, the atom data struct ( gprs_context_data ) has already been freed, so retry_deactivate crashes at: /rilmodem/gprs-context.c:line 348:

if (gcd->state == STATE_IDLE) {