pulseaudio crashes after ending a voice call

Bug #1306797 reported by Ricardo Salveti
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
android (Ubuntu)
Fix Released
Critical
Ricardo Salveti

Bug Description

current build number: 288
device name: mako
channel: ubuntu-touch/trusty-proposed
last update: 2014-04-11 17:14:35
version version: 288
version ubuntu: 20140411.1
version device: 20140331

Crash file:

#0 __libc_do_syscall () at ../ports/sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:44
No locals.
#1 0xb6cfc0fe in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        _a1 = 0
        _a3tmp = 6
        _a1tmp = 0
        _a3 = 6
        _nametmp = 268
        _a2tmp = 2196
        _a2 = 2196
        _name = 268
        _sys_result = <optimized out>
        pd = 0xb6749000
        pid = 0
        selftid = 2196
#2 0xb6cfe956 in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0xbec33268}
        sigs = {__val = {32, 0 <repeats 31 times>}}
#3 0xb6d22de0 in __libc_message (do_abort=<optimized out>, fmt=0xb6da42b8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
        ap = {__ap = 0xbec332b4}
        fd = 2
        on_2 = <optimized out>
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
        written = <optimized out>
#4 0xb6d2998e in malloc_printerr (action=1, str=0xb6da43ec "double free or corruption (!prev)", ptr=<optimized out>) at malloc.c:4996
        buf = "017e5ba8"
        cp = <optimized out>
#5 0xb6d2a3b4 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3840
        size = <optimized out>
        fb = <optimized out>
        nextchunk = <optimized out>
        nextsize = <optimized out>
        nextinuse = <optimized out>
        prevsize = <optimized out>
        bck = <optimized out>
        fwd = <optimized out>
        errstr = <optimized out>
        locked = <optimized out>
        __func__ = "_int_free"
#6 0xac7839ec in adev_close_output_stream (dev=<optimized out>, stream=0x17e5ba8) at hardware/qcom/audio/hal/audio_hw.c:2031
        out = 0x17e5ba8
        adev = 0x17862a8
        __PRETTY_FUNCTION__ = "adev_close_output_stream"
#7 0xb127f03c in stop_voice_call (hal=0x17d06c0) at modules/alsa/module-android-audio-hal.c:194
        __func__ = "stop_voice_call"
        __PRETTY_FUNCTION__ = "stop_voice_call"
#8 0xb127f38a in teardown_voice_call (u=0x1765030, card=0x1760ed8, card=0x1760ed8) at modules/alsa/module-android-audio-hal.c:368
No locals.
#9 card_profile_before_hook_callback (c=<optimized out>, profile=0x175e958, u=0x1765030) at modules/alsa/module-android-audio-hal.c:439
        c = <optimized out>
        u = 0x1765030
        profile = 0x175e958
#10 0xb6f4cbcc in pa_hook_fire (hook=0x172b600, data=data@entry=0x175e958) at pulsecore/hook-list.c:106
        slot = 0x1738e80
        next = <optimized out>
        result = PA_HOOK_OK
        __func__ = "pa_hook_fire"
        __PRETTY_FUNCTION__ = "pa_hook_fire"
#11 0xb6f49b44 in pa_card_set_profile (c=0x1760ed8, name=<optimized out>, save=save@entry=true) at pulsecore/card.c:275
        profile = 0x175e958
        r = <optimized out>
        __func__ = "pa_card_set_profile"
        __PRETTY_FUNCTION__ = "pa_card_set_profile"
---Type <return> to continue, or q <return> to quit---
#12 0xb5d26cc6 in command_set_card_profile (pd=<optimized out>, command=<optimized out>, tag=18, t=<optimized out>, userdata=0x1778890) at pulsecore/protocol-native.c:4703
        idx = 4294967295
        name = 0x176aba8 "alsa_card.platform-soc-audio.0"
        profile = 0x176abc8 "HiFi"
        card = <optimized out>
        ret = <optimized out>
        __func__ = "command_set_card_profile"
        __PRETTY_FUNCTION__ = "command_set_card_profile"
#13 0xb6f07466 in pa_pdispatch_run () from /usr/lib/arm-linux-gnueabihf/pulseaudio/libpulsecommon-4.0.so
No symbol table info available.
#14 0xb5d2c9a6 in pstream_packet_callback (p=0x177df88, packet=0x176ab88, creds=0x177e130, userdata=0x1778890) at pulsecore/protocol-native.c:4817
        __func__ = "pstream_packet_callback"
        __PRETTY_FUNCTION__ = "pstream_packet_callback"
#15 0xb6f0a15e in ?? () from /usr/lib/arm-linux-gnueabihf/pulseaudio/libpulsecommon-4.0.so
No symbol table info available.

Revision history for this message
Ricardo Salveti (rsalveti) wrote :
description: updated
Changed in android (Ubuntu):
status: New → In Progress
importance: Undecided → Critical
assignee: nobody → Ricardo Salveti (rsalveti)
Revision history for this message
Tiago Salem Herrmann (tiagosh) wrote :

This bug is also getting tp-ofono stuck. It is apparently waiting for the event loop to finish processing the queue, but that never ends, probably caused by the crash.

http://pastebin.ubuntu.com/7236576/

Revision history for this message
Selene ToyKeeper (toykeeper) wrote :

It's not really my call, but given that this completely breaks all phone service after one call, I'm marking this as a blocker.

tags: added: qa-touch-blocker
Revision history for this message
Selene ToyKeeper (toykeeper) wrote :

FWIW, I didn't run into anything like this in image 283... but it happened right away in image 289.

tags: added: r289
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package android - 20140328-2310-0ubuntu2

---------------
android (20140328-2310-0ubuntu2) trusty; urgency=medium

  * audio_hw.c-make-sure-we-don-t-double-free-if-it-s-th.patch:
    - Don't double free if the stream is also part of the primary
      output channel (LP: #1306797)
 -- Ricardo Salveti de Araujo <email address hidden> Fri, 11 Apr 2014 17:32:15 -0300

Changed in android (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.