1118141 - [FFOS][MSE] Youtube with browser sometimes crashes at audio memory copy

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Blake Wu [:bwu][:blakewu]]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 23747.23904]
__memcpy_base () at bionic/libc/arch-arm/krait/bionic/memcpy_base.S:153
153		ldr	r3, [r10, #(-1*PLDSIZE)]
(gdb) bt
#0  __memcpy_base () at bionic/libc/arch-arm/krait/bionic/memcpy_base.S:153
#1  0xb565798a in CreateAudioData (eos=false, v=0xafbffbc0, aStreamOffset=4808, this=0xb1b2b850)
    at /Volumes/firefoxos/mFlame/B2G/gecko/dom/media/fmp4/gonk/GonkAudioDecoderManager.cpp:132
#2  mozilla::GonkAudioDecoderManager::CreateAudioData (this=0xb1b2b850, aStreamOffset=<optimized out>, v=0xafbffbc0, eos=false)
    at /Volumes/firefoxos/mFlame/B2G/gecko/dom/media/fmp4/gonk/GonkAudioDecoderManager.cpp:101
#3  0xb5657b08 in mozilla::GonkAudioDecoderManager::Output (this=0xb1b2b850, aStreamOffset=<optimized out>, aOutData=...)
    at /Volumes/firefoxos/mFlame/B2G/gecko/dom/media/fmp4/gonk/GonkAudioDecoderManager.cpp:167
#4  0xb5657b3c in mozilla::GonkAudioDecoderManager::Output (this=0xb1b2b850, aStreamOffset=<optimized out>, aOutData=...)
    at /Volumes/firefoxos/mFlame/B2G/gecko/dom/media/fmp4/gonk/GonkAudioDecoderManager.cpp:182
#5  0xb5657b3c in mozilla::GonkAudioDecoderManager::Output (this=0xb1b2b850, aStreamOffset=<optimized out>, aOutData=...)
    at /Volumes/firefoxos/mFlame/B2G/gecko/dom/media/fmp4/gonk/GonkAudioDecoderManager.cpp:182
#6  0xb56570f4 in mozilla::GonkMediaDataDecoder::ProcessOutput (this=0xb1b2b880)
    at /Volumes/firefoxos/mFlame/B2G/gecko/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp:94
#7  0xb4e13408 in nsRunnableMethodImpl<tag_nsresult (mozilla::net::Dashboard::*)(mozilla::net::ConnectionData*), nsRefPtr<mozilla::net::ConnectionData>, true>::Run (
    this=<optimized out>) at ../../../dist/include/nsThreadUtils.h:361
#8  0xb5600f78 in mozilla::MediaTaskQueue::Runner::Run (this=0xb16fd7f0) at ../../../gecko/dom/media/MediaTaskQueue.cpp:230
#9  0xb4defdf2 in nsThreadPool::Run (this=0xafdb1330) at ../../../gecko/xpcom/threads/nsThreadPool.cpp:225
#10 0xb4def208 in nsThread::ProcessNextEvent (this=0xb2275cc0, aMayWait=<optimized out>, aResult=0xafbffd27) at ../../../gecko/xpcom/threads/nsThread.cpp:855
#11 0xb4dfaf84 in NS_ProcessNextEvent (aThread=<optimized out>, aMayWait=aMayWait@entry=false)
    at /Volumes/firefoxos/mFlame/B2G/gecko/xpcom/glue/nsThreadUtils.cpp:265
#12 0xb4f3a6da in mozilla::ipc::MessagePumpForNonMainThreads::Run (this=0xafda8940, aDelegate=0xb02ec120) at ../../../gecko/ipc/glue/MessagePump.cpp:339
#13 0xb4f2ef0c in MessageLoop::RunInternal (this=this@entry=0xb02ec120) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:233
#14 0xb4f2efc0 in RunHandler (this=0xb02ec120) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:226
#15 MessageLoop::Run (this=this@entry=0xb02ec120) at ../../../gecko/ipc/chromium/src/base/message_loop.cc:200
#16 0xb4def436 in nsThread::ThreadFunc (aArg=0xb2275cc0) at ../../../gecko/xpcom/threads/nsThread.cpp:356
#17 0xb69bb1da in _pt_root (arg=0xb3062280) at ../../../../../gecko/nsprpub/pr/src/pthreads/ptthread.c:212
#18 0xb6e8122c in __thread_entry (func=0xb69bb141 <_pt_root>, arg=0xb3062280, tls=0xafbffdd0) at bionic/libc/bionic/pthread_create.cpp:105
#19 0xb6e813c4 in pthread_create (thread_out=0xafc3fac4, attr=<optimized out>, start_routine=0xb69bb141 <_pt_root>, arg=0x78)
    at bionic/libc/bionic/pthread_create.cpp:224
#20 0x00000000 in ?? ()

From my code base, 
it occurs @ memcpy(buffer.get(), data+dataOffset, size) in CreateAudioData();

Comment 1

[Blake Wu [:bwu][:blakewu]]

The rootcause is we didn't update buffers[1] when we receive INFO_OUTPUT_BUFFERS_CHANGED notification[2].
So memory copy is trying to access invalid address. 

[1]https://dxr.mozilla.org/mozilla-central/source/dom/media/fmp4/gonk/GonkAudioDecoderManager.cpp?from=GonkAudioDecoderManager.cpp#166
[2]https://dxr.mozilla.org/mozilla-central/source/dom/media/omx/MediaCodecProxy.cpp?from=MediaCodecProxy.cpp#512

Comment 2

[Blake Wu [:bwu][:blakewu]]

See also Bug 1098994

Comment 3

[Blake Wu [:bwu][:blakewu]]

Attachment: Bug-1118141-Update-Audio-buffers-when-receiving-INFO.patch

As comment 1,
Update audio buffers when receiving INFO_OUTPUT_BUFFERS_CHANGED from OMX.

Comment 4

[Blake Wu [:bwu][:blakewu]]

Attachment: Bug-1118141-Update-Audio-Buffers-when-receiving-INFO_OUTPUT_BUFFERS_CHANGED.patch

Carry r+ from edwin.

Comment 5

[Blake Wu [:bwu][:blakewu]]

Testing results look good. https://treeherder.mozilla.org/#/jobs?repo=try&revision=a50e19ea8eff
No need to run test cases since currently the pref related to FFOS MSE is off.

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7460be688f60

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7460be688f60