New issue
Advanced search Search tips

Issue 813292 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jul 9
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

ArcBluetoothBridge should wait until bluetooth_adapter_ is ready before continuing the handshake

Project Member Reported by lhchavez@chromium.org, Feb 17 2018

Issue description

Found in https://crash.corp.google.com/browse?q=stable_signature%3D%27bluez%3A%3ABluetoothAdapterBlueZ%3A%3AGetUUIDs-7df1bb51%27&stbtiq=&reportid=&index=0

Thread 0 (id: 1246) CRASHED [SIGSEGV @ 0x00000230 ] MAGIC SIGNATURE THREAD
Stack Quality99%Show frame trust levels
0x00005c5344da7f20	(chrome -stl_vector.h:728 )	bluez::BluetoothAdapterBlueZ::GetUUIDs() const
0x00005c534308cae1	(chrome -arc_bluetooth_bridge.cc:2300 )	arc::ArcBluetoothBridge::GetAdapterProperties(arc::mojom::BluetoothPropertyType) const
0x00005c534308c7d3	(chrome -arc_bluetooth_bridge.cc:849 )	arc::ArcBluetoothBridge::GetAdapterProperty(arc::mojom::BluetoothPropertyType)
0x00005c5342fa99ab	(chrome -bluetooth.mojom.cc:5284 )	arc::mojom::BluetoothHostStubDispatch::Accept(arc::mojom::BluetoothHost*, mojo::Message*)
0x00005c53484a7773	(chrome -interface_endpoint_client.cc:418 )	mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*)
0x00005c53484a9f58	(chrome -multiplex_router.cc:875 )	mojo::internal::MultiplexRouter::Accept(mojo::Message*)
0x00005c53484a73cb	(chrome -connector.cc:440 )	mojo::Connector::ReadAllAvailableMessages()
0x00005c53427eb821	(chrome + 0x013fe821 )	(anonymous namespace)::OnCopyFileLocalError(base::RepeatingCallback<void (base::File::Error)> const&, base::File::Error)
0x00005c53484ac66b	(chrome -callback.h:92 )	mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&)
0x00005c5348488458	(chrome -callback.h:64 )	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x00005c534848ae18	(chrome -message_loop.cc:394 )	base::MessageLoop::RunTask(base::PendingTask*)
0x00005c534848b922	(chrome -message_loop.cc:406 )	base::MessageLoop::DoWork()
0x00005c534848c1f7	(chrome -message_pump_libevent.cc:220 )	base::MessagePumpLibevent::Run(base::MessagePump::Delegate*)
0x00005c5343e41f73	(chrome -run_loop.cc:114 )	sync_pb::EntitySpecifics::set_has_theme()
0x00005c5343b1f287	(chrome -chrome_browser_main.cc:1939 )	ChromeBrowserMainParts::MainMessageLoopRun(int*)
0x00005c534282cec3	(chrome -browser_main_loop.cc:1157 )	content::BrowserMainLoop::RunMainMessageLoopParts()
0x00005c534282fb81	(chrome -browser_main_runner.cc:140 )	content::BrowserMainRunnerImpl::Run()
0x00005c5342828e0b	(chrome -browser_main.cc:46 )	content::BrowserMain(content::MainFunctionParams const&)
0x00005c5343b0bc9b	(chrome -content_main_runner.cc:710 )	content::ContentMainRunnerImpl::Run()
0x00005c5343b150d1	(chrome -main.cc:469 )	service_manager::Main(service_manager::MainParams const&)
0x00005c5343b0ac70	(chrome -content_main.cc:19 )	content::ContentMain(content::ContentMainParams const&)
0x00005c53421c7967	(chrome -chrome_main.cc:123 )	ChromeMain
0x00007f673bd92735	(libc-2.23.so + 0x00020735 )	
0x00005c53421c787f	(chrome + 0x00dda87f )	_init
0x00005c5348ae6c3f	(chrome + 0x076f9c3f )	__udivmodti4
0x00007f673d13cc0b	(ld-2.23.so + 0x0000fc0b )	
0x00005c53486dc17f	(chrome + 0x072ef17f )	
0x00005c53486dc1a8	(chrome + 0x072ef1a8 )	_start
0x00007ffe15a44f97		

The solution is to wait until both the |bluetooth_adapter_| and |ARC_GET_INSTANCE_FOR_METHOD(arc_bridge_service_->bluetooth(), Init)| are non-null before calling |bluetooth_instance->Init(...);|
 

Comment 1 by khmel@chromium.org, Feb 20 2018

Owner: khmel@chromium.org
Status: Started (was: Untriaged)
Project Member

Comment 3 by bugdroid1@chromium.org, Jul 9

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9945d46bede4b225f3acedd17f717b86bdc5848b

commit 9945d46bede4b225f3acedd17f717b86bdc5848b
Author: khmel@google.com <khmel@google.com>
Date: Mon Jul 09 18:27:15 2018

arc: Fix race in BT mojo connection and device init.

This fixes the issue when Bluetooth mojo instance is established
faster than Bluetooth device is initialized in ARC Bluetooth bridge.
It causes a crash when accessing device via instance.

TEST=Simulate artificial delay in Bluetooth device initialization and
could repro the crash. With this fix it works stable and
GetAdapterProperty is called after device is inited.
BUG= 813292 

Change-Id: Ibbdd85745c51a0e181eafe4a927ca665ce682e3d
Reviewed-on: https://chromium-review.googlesource.com/1125301
Commit-Queue: Yury Khmel <khmel@google.com>
Reviewed-by: Luis Hector Chavez <lhchavez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#573371}
[modify] https://crrev.com/9945d46bede4b225f3acedd17f717b86bdc5848b/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.cc

Status: Fixed (was: Started)

Sign in to add a comment