Bluedroid crash in GATT main - bluetooth-lowenergy

Question

When donging Bluetooth low energy development, doing stress test to connect one central device (phone) with one peripheral device (smart device), found bluedroid crashed in GATT main function with log as below:
08-04 11:26:44.915 4155 4190 F libc : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x1000000 in tid 4190 (bluedroid wake/)
08-04 11:26:44.975 2303 2303 I DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-04 11:26:44.975 2303 2303 I DEBUG : Build fingerprint:
'marvell/pxa1908FF_tz/pxa1908FF:5.1.1/LMY47V/buildfarm06230955:userdebug/test-keys'
08-04 11:26:44.975 2303 2303 I DEBUG : Revision: '0'
08-04 11:26:44.976 2303 2303 I DEBUG : ABI: 'arm'
08-04 11:26:44.976 2303 2303 I DEBUG : pid: 4155, tid: 4190, name: bluedroid wake/ >>> com.android.bluetooth <<<
08-04 11:26:44.976 2303 2303 I DEBUG : signal 11 (SIGSEGV), code 1
(SEGV_MAPERR), fault addr 0x1000000
08-04 11:26:44.994 2303 2303 I DEBUG : r0 00000001 r1 52aa2c60 r2 00000000 r3 00000001
08-04 11:26:44.994 2303 2303 I DEBUG : r4 00000005 r5 4ac2b734 r6 01000000 r7 00000002
08-04 11:26:44.994 2303 2303 I DEBUG : r8 00000000 r9 00000000 sl 00000013 fp 00000000
08-04 11:26:44.994 2303 2303 I DEBUG : ip 52aa2ba0 sp 52aa2c60 lr 4aacd6c7 pc 01000000 cpsr 600f0010
08-04 11:26:44.995 2303 2303 I DEBUG :
08-04 11:26:44.995 2303 2303 I DEBUG : backtrace:
08-04 11:26:44.995 2303 2303 I DEBUG : #00 pc 01000000 <unknown>
08-04 11:26:44.995 2303 2303 I DEBUG : #01 pc 000c66c5
/system/lib/hw/bluetooth.default.so (gatt_add_a_bonded_dev_for_srv_chg+140)
08-04 11:26:44.995 2303 2303 I DEBUG : #02 pc 000c6e87
/system/lib/hw/bluetooth.default.so
08-04 11:26:44.995 2303 2303 I DEBUG : #03 pc 000d9c3b /system/lib/hw/bluetooth.default.so (l2cu_release_lcb+230)
08-04 11:26:44.996 2303 2303 I DEBUG : #04 pc 000dbbab /system/lib/hw/bluetooth.default.so (l2c_link_hci_disc_comp+254)
08-04 11:26:44.996 2303 2303 I DEBUG : #05 pc 000d40df /system/lib/hw/bluetooth.default.so (btu_hcif_process_event+738)
08-04 11:26:44.996 2303 2303 I DEBUG : #06 pc 000d4ea3 /system/lib/hw/bluetooth.default.so (btu_task+226)
08-04 11:26:44.996 2303 2303 I DEBUG : #07 pc 000a4129 /system/lib/hw/bluetooth.default.so
08-04 11:26:44.996 2303 2303 I DEBUG : #08 pc 00016abf /system/lib/libc.so (__pthread_start(void*)+30)
08-04 11:26:44.997 2303 2303 I DEBUG : #09 pc 000149eb /system/lib/libc.so (__start_thread+6)
08-04 11:26:45.833 2303 2303 I DEBUG :
08-04 11:26:45.833 2303 2303 I DEBUG : Tombstone written to: /data/tombstones/tombstone_06
08-04 11:26:45.834 2786 2808 I BootReceiver: Copying
/data/tombstones/tombstone_06 to DropBox (SYSTEM_TOMBSTONE)
08-04 11:26:45.859 4323 4323 I dumpstate: begin
08-04 11:26:45.838 0 0 E kernel : [ 246.972663] c1 4323 (dumpstate) android: (08-04 11:26:45) process pid: 4155, tid: 4190 crash!
Code (gatt_main.c):
void gatt_add_a_bonded_dev_for_srv_chg (BD_ADDR bda)
{
tGATTS_SRV_CHG *p_buf;
tGATTS_SRV_CHG_REQ req;
tGATTS_SRV_CHG srv_chg_clt;
memcpy(srv_chg_clt.bda, bda, BD_ADDR_LEN);
srv_chg_clt.srv_changed = FALSE;
if (gatt_add_srv_chg_clt(&srv_chg_clt) != NULL)
{
memcpy(req.srv_chg.bda, bda, BD_ADDR_LEN);
req.srv_chg.srv_changed = FALSE;
if (gatt_cb.cb_info.p_srv_chg_callback)
{
GATT_TRACE_ERROR("==========abcd xman debug========");
(*gatt_cb.cb_info.p_srv_chg_callback)(GATTS_SRV_CHG_CMD_ADD_CLIENT, &req, NULL);
}
}
}
Did somebody found the similar issue before?
Or if someone give advance?
This test is under android lp5.1.