1076017 - Crash in mozilla::TrackUnionStream::CopyTrackData

Status: RESOLVED INCOMPLETE

(Core :: WebRTC: Audio/Video, defect)

Description

[Byron Campen [:bwc]]

Just got this crash on Nightly while trying to diagnose bug 1073799:

Thread 53 Crashed:: com.apple.audio.IOThread.client
0   XUL                               0x0000000103130214 mozilla::TrackUnionStream::CopyTrackData(mozilla::StreamBuffer::Track*, unsigned int, long long, long long, bool*) + 1460 (nsTArray.h:892)
1   XUL                               0x000000010312f7bc mozilla::TrackUnionStream::ProcessInput(long long, long long, unsigned int) + 812 (TrackUnionStream.h:77)
2   XUL                               0x0000000103119d83 mozilla::MediaStreamGraphImpl::Process(long long, long long) + 195 (MediaStreamGraph.cpp:1335)
3   XUL                               0x000000010311a1a6 mozilla::MediaStreamGraphImpl::OneIteration(long long, long long, long long, long long) + 310 (Monitor.h:35)
4   XUL                               0x00000001030e30c3 mozilla::AudioCallbackDriver::DataCallback(float*, long) + 611 (GraphDriver.cpp:834)
5   XUL                               0x0000000103e43ac3 audiounit_output_callback + 275 (cubeb_audiounit.c:100)
6   com.apple.audio.units.Components    0x000000012d508839 AUConverterBase::RenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) + 413
7   com.apple.audio.units.Components    0x000000012d5063a1 AUBase::DoRenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, AUOutputElement*, unsigned int, AudioBufferList&) + 127
8   com.apple.audio.units.Components    0x000000012d504aed AUBase::DoRender(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int, AudioBufferList&) + 429
9   com.apple.audio.units.Components    0x000000012d50bc63 AUHAL::AUIOProc(unsigned int, AudioTimeStamp const*, AudioBufferList const*, AudioTimeStamp const*, AudioBufferList*, AudioTimeStamp const*, void*) + 2029
10  com.apple.audio.CoreAudio         0x00007fff92f8dfd7 HALC_ProxyIOContext::IOWorkLoop() + 2439
11  com.apple.audio.CoreAudio         0x00007fff92f8d5bf HALC_ProxyIOContext::IOThreadEntry(void*) + 83
12  com.apple.audio.CoreAudio         0x00007fff92f8d497 HALB_IOThread::Entry(void*) + 75
13  libsystem_c.dylib                 0x00007fff8949d772 _pthread_start + 327
14  libsystem_c.dylib                 0x00007fff8948a1a1 thread_start + 13

Comment 1

[Daniel Veditz [:dveditz]]

It's been a week, have you seen this since or have any idea how to reproduce it? Maybe close it incomplete?

Comment 2

[Byron Campen [:bwc]]

Jesup, what would you like to do with this? I'm a little swamped so I can't dig into it right now.

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

I'm afraid without more info, a sequence used to create it, something, this is not actionable right now.  We don't even know if it was a null-deref or not.  I don't even know what test was being run.  I know we'd get crashes running mochitests in CopyTrackData after an assertion randomly, which is now fixed.

Comment 4

[Byron Campen [:bwc]]

Just saw a similar stack while running a mochitest:

[3974] WARNING: Slice out of range: 'aStart >= 0 && aEnd <= aSource.mDuration', file ../../../content/media/MediaSegment.h, line 282
[3974] WARNING: Slice out of range: 'aStart >= 0 && aEnd <= aSource.mDuration', file ../../../content/media/MediaSegment.h, line 282
Assertion failure: startTicks == TimeToTicksRoundUp(rate, outputStart) (Samples missing), at ../../../content/media/TrackUnionStream.h:267
2468 INFO TEST-START | /tests/dom/media/tests/mochitest/test_getUserMedia_exceptions.html
mozilla::MediaStreamGraphImpl::Process(long long, long long) (MediaStreamGraph.cpp:1335, in XUL)
mozilla::MediaStreamGraphImpl::OneIteration(long long, long long, long long, long long) (Monitor.h:35, in XUL)
mozilla::AudioCallbackDriver::DataCallback(float*, long) (GraphDriver.cpp:834, in XUL)
audiounit_output_callback (cubeb_audiounit.c:100, in XUL)
AUConverterBase::RenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int) (in CoreAudio) + 413
AUBase::DoRenderBus(unsigned int&, AudioTimeStamp const&, unsigned int, AUOutputElement*, unsigned int, AudioBufferList&) (in CoreAudio) + 127
AUBase::DoRender(unsigned int&, AudioTimeStamp const&, unsigned int, unsigned int, AudioBufferList&) (in CoreAudio) + 429
AUHAL::AUIOProc(unsigned int, AudioTimeStamp const*, AudioBufferList const*, AudioTimeStamp const*, AudioBufferList*, AudioTimeStamp const*, void*) (in CoreAudio) + 2029
HALC_ProxyIOContext::IOWorkLoop() (in CoreAudio) + 2439
HALC_ProxyIOContext::IOThreadEntry(void*) (in CoreAudio) + 83
HALB_IOThread::Entry(void*) (in CoreAudio) + 75
_pthread_start (in libsystem_c.dylib) + 327
TEST-INFO | Main app process: killed by SIGHUP
2469 ERROR TEST-UNEXPECTED-FAIL | /tests/dom/media/tests/mochitest/test_getUserMedia_exceptions.html | application terminated with exit code 1

Comment 5

[Byron Campen [:bwc]]

jesup, is this the crash you alluded to in comment 3 (this was on our jsep session rewrite branch, which we forked the week of Sept 15)?

Comment 6

[Randell Jesup [:jesup] (needinfo me)]

Assertion failure: startTicks == TimeToTicksRoundUp(rate, outputStart) (Samples missing), at ../../../content/media/TrackUnionStream.h:267

That's a MOZ_CRASH().  You will crash out with a semi-deterministic stack

That is the bug that was fixed, I'd say.

Comment 7

[Byron Campen [:bwc]]

Ok, I'd be willing to bet that I tripped over the same bug when I filed this ticket. We're probably ok here.