Here's what can be worked out from the romlog (used the 100d firmware here):
assert happens here due to the failure of TryPostMessageQueue (assumption: the queue became full):
loc_ff0ec028: ; 7 refs
ff0ec028: push {r3, r4, r5, r6, r7, lr}
ff0ec02c: ldr r5, =0x5ff4
ff0ec030: mov r6, #0
ff0ec034: mov r4, r0
ff0ec038: str r6, [sp]
ff0ec03c: ldr r0, [r5, #116] ; 0x74
ff0ec040: mov r1, sp
ff0ec044: bl loc_ff02b098 ; <TryReceiveMessageQueue>
ff0ec048: ldr r1, [sp]
ff0ec04c: orr r0, r0, r1
ff0ec050: tst r0, #1
ff0ec054: ldm r4, {r0, r2}
ff0ec058: movne r1, r6
ff0ec05c: stm r1, {r0, r2}
ff0ec060: ldr r0, [r5, #72] ; 0x48
ff0ec064: bl loc_ff02b1d4 ; <TryPostMessageQueue> @ 0x5ff4 + 0x48
ff0ec068: cmp r0, #0
ff0ec06c: beq loc_ff0ec07c
ff0ec070: ldr r1, =0x10f ; 271
ff0ec074: add r0, pc, #524 ; *"ChaseFrame.c"
ff0ec078: bl loc_ff00edc8 ; <DebugAssert>
loc_ff0ec07c:
ff0ec07c: pop {r3, r4, r5, r6, r7, pc}the message queue is read by this task:
NSTUB(task_ChaseFrame, 0xff0ec080):
ff0ec080: push {r3, r4, r5, r6, r7, lr}
ff0ec084: ldr r4, =0x5ff4
ff0ec088: ldr r6, =0x131
ff0ec08c: add r5, r4, #152 ; 0x98
loc_ff0ec090:
ff0ec090: ldr r0, [r4, #72] ; 0x48
ff0ec094: mov r2, #0
ff0ec098: mov r1, sp
ff0ec09c: bl loc_ff02afd0 ; <ReceiveMessageQueue> @ 0x5ff4 + 0x48
...this routine tried to send the message:
loc_ff0ec17c:
ff0ec17c: push {r2, r3, r4, lr}
...
ff0ec22c: bl loc_ff0ec028
loc_ff0ec230:
ff0ec230: pop {r2, r3, r4, pc}
loc_ff0ec17c is registered as a function pointer by loc_ff16a660
ff0ecc24: add r0, pc, #500 ; *"ChaseFrame"
ff0ecc28: bl loc_ff02b808 ; <CreateTaskStrictly>
ff0ecc2c: ldr r0, =0xff0ec17c
ff0ecc30: bl loc_ff16a660
...
loc_ff16a660:
ff16a660: ldr r1, =0x7a94
ff16a664: str r0, [r1]
ff16a668: bx lrthe function pointer is called by this task:
NSTUB(task_MotionVector, 0xff169de8):
ff169de8: push {r4, r5, r6, r7, r8, r9, sl, fp, lr}
ff169dec: ldr r9, =0x7a94
...
ff16a0e4: ldr r1, [r9]
ff16a0e8: cmp r1, #0 ; can be NULL !
ff16a0ec: beq loc_ff16a118
ff16a0f0: ldr r0, [r9, #36]
ff16a0f4: str r0, [sp, #228]
ff16a0f8: ldr r0, [sp, #500]
ff16a0fc: str r0, [sp, #224]
ff16a100: ldr r0, [r9, #40]
ff16a104: str r0, [sp, #236]
ff16a108: ldr r0, [sp, #496]
ff16a10c: str r0, [sp, #232]
ff16a110: add r0, sp, #224
ff16a114: blx r1
...So, the routine that causes the assert can be disabled by setting 0x7a94 to 0. I have no idea what the consequences of this can be, it will likely still crash, but somewhere else.
I haven't been able to reproduce the issue on my cameras (tried 3 of them).
