1131960 - crash in cft1st_128_neon

Status: VERIFIED FIXED

(Core :: WebRTC, defect)

Description

[Cristina Madaras, QA [:CristinaM]]

This bug was filed from the Socorro interface and is 
report bp-4566f943-5c4f-4381-b4fd-20e272150211.
=============================================================
Environment:
Device: Asus Transformer TF101 (Android 4.0.3);
Build: Firefox for Android 38.0a1 (2015-02-10);

Steps to reproduce:
1. Go to http://mozilla.github.com/webrtc-landing/gum_test.html;
2. Tap on 'Audio & Video';
3. Choose 'Share'.

Notes: Probably device specific, since I am not able to reproduce this on other devices.

0	libxul.so	cft1st_128_neon	android-ndk/toolchains/arm-linux-androideabi-4.7/prebuilt/linux-x86_64/lib/gcc/arm-linux-androideabi/4.7/include/arm_neon.h
1	libxul.so	cftfsub_128_C	media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_rdft.c
2	libxul.so	aec_rdft_forward_128	media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_rdft.c
3	libxul.so	TimeToFrequency	media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_core.c
4	libxul.so	WebRtcAec_BufferFarendPartition	media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_core.c
5	libxul.so	WebRtcAec_BufferFarend	media/webrtc/trunk/webrtc/modules/audio_processing/aec/echo_cancellation.c
6	libxul.so	webrtc::EchoCancellationImpl::ProcessRenderAudio(webrtc::AudioBuffer const*)	media/webrtc/trunk/webrtc/modules/audio_processing/echo_cancellation_impl.cc
7	libxul.so	webrtc::AudioProcessingImpl::AnalyzeReverseStreamLocked()	media/webrtc/trunk/webrtc/modules/audio_processing/audio_processing_impl.cc
8	libxul.so	webrtc::AudioProcessingImpl::AnalyzeReverseStream(webrtc::AudioFrame*)	media/webrtc/trunk/webrtc/modules/audio_processing/audio_processing_impl.cc
9	libxul.so	webrtc::voe::OutputMixer::APMAnalyzeReverseStream(webrtc::AudioFrame&)	media/webrtc/trunk/webrtc/voice_engine/output_mixer.cc
10	libxul.so	webrtc::VoEExternalMediaImpl::ExternalPlayoutData(short*, int, int, int, int&)	media/webrtc/trunk/webrtc/voice_engine/voe_external_media_impl.cc
11	libxul.so	mozilla::MediaEngineWebRTCAudioSource::Process(int, webrtc::ProcessingTypes, short*, int, int, bool)	dom/media/webrtc/MediaEngineWebRTCAudio.cpp
12	libxul.so	webrtc::voe::Channel::PrepareEncodeAndSend(int)	media/webrtc/trunk/webrtc/voice_engine/channel.cc
13	libxul.so	webrtc::voe::TransmitMixer::DemuxAndMix()	media/webrtc/trunk/webrtc/voice_engine/transmit_mixer.cc
14	libxul.so	webrtc::VoEBaseImpl::ProcessRecordedDataWithAPM(int const*, int, void const*, unsigned int, unsigned char, unsigned int, unsigned int, int, unsigned int, bool)	media/webrtc/trunk/webrtc/voice_engine/voe_base_impl.cc
15	libxul.so	webrtc::VoEBaseImpl::RecordedDataIsAvailable(void const*, unsigned int, unsigned char, unsigned char, unsigned int, unsigned int, int, unsigned int, bool, unsigned int&)	media/webrtc/trunk/webrtc/voice_engine/voe_base_impl.cc
16	libxul.so	webrtc::AudioDeviceBuffer::DeliverRecordedData()	media/webrtc/trunk/webrtc/modules/audio_device/audio_device_buffer.cc
17	libxul.so	webrtc::OpenSlesInput::CbThreadImpl()	media/webrtc/trunk/webrtc/modules/audio_device/android/opensles_input.cc
18	libxul.so	webrtc::ThreadPosix::Run()	media/webrtc/trunk/webrtc/system_wrappers/source/thread_posix.cc
19	libxul.so	webrtc::StartThread	media/webrtc/trunk/webrtc/system_wrappers/source/thread_posix.cc
Ø 20	libc.so	libc.so@0x12e2e	
Ø 21	libc.so	libc.so@0x12982

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

Seems actionable. There are a good number of tft101s floating around Mozilla.

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Snorp said in triage that this is Neon code being called on a device that does not support neon (Tegra 2).

Comment 3

[Gian-Carlo Pascutto [:gcp]]

Upstream bug:
https://dxr.mozilla.org/mozilla-central/source/media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_rdft.c?from=aec_rdft.c&case=true#583

This is missing a check for NEON. aec_rdft_init_neon unconditionally replaces the routines.

Comment 4

[Gian-Carlo Pascutto [:gcp]]

But wait, there's more:

#1  FilterFarNEON (aec=0x71301000, yf=0x753cd1c0)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_core_neon.c:51
#2  0x650c29d6 in ProcessBlock (aec=aec@entry=0x71301000)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_core.c:1239
#3  0x650c43d2 in WebRtcAec_ProcessFrame (aec=0x71301000, nearend=nearend@entry=0x71213800, nearendH=nearendH@entry=
    0x0, knownDelay=knownDelay@entry=0, out=out@entry=0x71213800, outH=outH@entry=0x0)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/aec/aec_core.c:1682
#4  0x650c9c26 in ProcessExtended (skew=<optimized out>, reported_delay_ms=<optimized out>, 
    num_samples=<optimized out>, out_high=<optimized out>, out=<optimized out>, near_high=<optimized out>, 
    near=<optimized out>, self=<optimized out>)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/aec/echo_cancellation.c:834
#5  WebRtcAec_Process (aecInst=0x7077d280, nearend=<optimized out>, nearendH=<optimized out>, out=<optimized out>, 
    outH=0x0, nrOfSamples=160, msInSndCardBuf=<optimized out>, skew=0)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/aec/echo_cancellation.c:393
#6  0x650cf87a in webrtc::EchoCancellationImpl::ProcessCaptureAudio (this=0x6b408080, audio=0x6e41fee0)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/echo_cancellation_impl.cc:138
#7  0x650d2db8 in webrtc::AudioProcessingImpl::ProcessStreamLocked (this=this@entry=0x6f232c50)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/audio_processing_impl.cc:486
#8  0x650d48c4 in webrtc::AudioProcessingImpl::ProcessStream (this=0x6f232c50, frame=0x715d9030)
    at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/modules/audio_processing/audio_processing_impl.cc:440
#9  0x6517ab82 in webrtc::voe::TransmitMixer::ProcessAudio (this=this@entry=0x715d9000, delay_ms=delay_ms@entry=55, 
    clock_drift=clock_drift@entry=0, current_mic_level=current_mic_level@entry=0, key_pressed=key_pressed@entry=
    false) at /home/morbo/git/gecko-dev/media/webrtc/trunk/webrtc/voice_engine/transmit_mixer.cc:1274

Comment 5

[Gian-Carlo Pascutto [:gcp]]

Attachment: Check for NEON capability before using NEON code.

Comment 6

[Gian-Carlo Pascutto [:gcp]]

Attachment: v2 Check for NEON capability before using NEON code.

Comment 7

[Gian-Carlo Pascutto [:gcp]]

Upstream bug filed: https://code.google.com/p/webrtc/issues/detail?id=4304

Comment 8

[Gian-Carlo Pascutto [:gcp]]

Instead of a try run I will offer one Belgian beer to the relevant sheriff if this goes red on m-i.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/ff356750af3a

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ff356750af3a

Comment 11

[Flaviu Cos]

Verified as fixed in build 38.0a1 2015-02-17;
Device: Asus Transformer TF101 (Android 4.0.3)