[Crash] [@ mozilla::MediaStreamGraphImpl::UpdateStreamOrder]

RESOLVED WORKSFORME

Status

Firefox OS
Stability
RESOLVED WORKSFORME
3 years ago
3 years ago

People

(Reporter: ntroast, Unassigned)

Tracking

(Blocks: 1 bug, {crash})

unspecified
ARM
Gonk (Firefox OS)
crash

Firefox Tracking Flags

(blocking-b2g:2.2+)

Details

(Whiteboard: [b2g-crash][caf-crash 530][caf priority: p3][CR 817667])

Attachments

(10 attachments)

(Reporter)

Description

3 years ago
We observed the following crash signature during testing.

[@ mozilla::MediaStreamGraphImpl::UpdateStreamOrder | mozilla::MediaStreamGraphImpl::UpdateGraph | mozilla::MediaStreamGraphImpl::OneIteration | mozilla::AudioCallbackDriver::DataCallback ]

Cafbot will upload the decoded minidump and extra file.
Created attachment 8587995 [details]
EXTRA file attachment -
Created attachment 8587996 [details]
decoded minidump -
roc/ehsan, any ideas here? See some changes from your side on m-c recently, but not sure if they are related. Can you please help investigate this crasher ?
Flags: needinfo?(roc)
Flags: needinfo?(ehsan)

Updated

3 years ago
Whiteboard: [CR 817667]

Updated

3 years ago
Whiteboard: [CR 817667] → [caf priority: p1][CR 817667]

Updated

3 years ago
Whiteboard: [caf priority: p1][CR 817667] → [b2g-crash][caf-crash 530][caf priority: p1][CR 817667]

Updated

3 years ago
Keywords: crash
Created attachment 8588104 [details]
EXTRA file attachment - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.119
Created attachment 8588105 [details]
decoded minidump - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.119

Comment 7

3 years ago
Paul hacks on this stuff nowadays.
Flags: needinfo?(ehsan) → needinfo?(padenot)

Updated

3 years ago
blocking-b2g: 2.2? → 2.2+

Comment 8

3 years ago
Steve, could you help investigate as well?
Flags: needinfo?(slee)
Created attachment 8589080 [details]
EXTRA file attachment - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.124
Created attachment 8589081 [details]
decoded minidump - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.124
Are there specific step to reproduce? It's crashing here [0].

[0]: http://git.mozilla.org/?p=releases/gecko.git;a=blob;f=dom/media/MediaStreamGraph.cpp;h=4a50ea3185be2f8f01ea44d2e52444e119c2e11a;hb=522b546b5d6b8a91da23f0c52e97b85c3e7f3feb#l657
Flags: needinfo?(padenot) → needinfo?(ntroast)

Comment 13

3 years ago
this crash was produced during stability tests which involves monkey testing for several hours and there is no clear STR for this. If we are not able to identify the issue using provided logs then please feel free to provide us a debug patch with additional logging to identify the issue.
Flags: needinfo?(ntroast)
This seems like it could be related to bug 1150923. Both bugs suggest corruption of the graph, so that a destroyed stream is still present as the source or destination of a MediaInputPort. But I don't remember seeing any bugs like that for a long time...

The MediaStream destructor logging patch I just attached to bug 1150923 might help here too. We should also add assertions that the mInputs and mConsumers arrays are empty when we destroy a MediaStream, to ensure that it's fully disconnected. Added here:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=4725d387fbbe
https://hg.mozilla.org/try/rev/f15873e99ce5
Flags: needinfo?(roc)
Created attachment 8589617 [details]
EXTRA file attachment - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.123
Created attachment 8589618 [details]
decoded minidump - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.123

Comment 18

3 years ago
(In reply to cafbot (PoC: ggrisco) from comment #17)
> Created attachment 8589618 [details]
> decoded minidump - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.123

From the log, I found that on frame 7 of Thread 20, it calls NS_ABORT_OOM. It looks like SetLength on [1] requests too many memory.

roc, paul, 
Do you have any thoughts about this?

[1] http://git.mozilla.org/?p=integration/gecko-dev.git;a=blob;f=dom/media/MediaStreamGraph.cpp;h=4a50ea3185be2f8f01ea44d2e52444e119c2e11a;hb=643f37b68305d90ecfa148f81db63891c30e4620#l373
Flags: needinfo?(slee)
Flags: needinfo?(roc)
Flags: needinfo?(padenot)
(In reply to StevenLee[:slee] from comment #18)
> From the log, I found that on frame 7 of Thread 20, it calls NS_ABORT_OOM.
> It looks like SetLength on [1] requests too many memory.
> 
> roc, paul, 
> Do you have any thoughts about this?
> 
> [1]
> http://git.mozilla.org/?p=integration/gecko-dev.git;a=blob;f=dom/media/
> MediaStreamGraph.cpp;h=4a50ea3185be2f8f01ea44d2e52444e119c2e11a;
> hb=643f37b68305d90ecfa148f81db63891c30e4620#l373

In this log, there are two MSGs running, one driven by a ThreadedDriver (system clock or offline, unfortunately I can't tell which), and another driven by the audio callback. That's unusual, but possible if there's an OfflineAudioContext (but should not happen for any other reason).
Flags: needinfo?(roc)

Comment 20

3 years ago
Inder, could you help to provide more information? more log or reproduce steps will be helpful. thanks.
Flags: needinfo?(ikumar)
(Reporter)

Comment 21

3 years ago
Looking at the provided logs I see that Ringtones app may be the culprit.
I am starting to see Ringtones as a recurring theme for these MSG issues.

I do have additional logs for this issue, but please be specific as they are very large.
Flags: needinfo?(ikumar)
Created attachment 8591507 [details]
EXTRA file attachment - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.126
Created attachment 8591508 [details]
decoded minidump - AU_LINUX_GECKO_LF.BR.1.2.3.00.00.00.000.126

Updated

3 years ago
See Also: → bug 1150923

Updated

3 years ago
Flags: needinfo?(padenot)

Updated

3 years ago
Whiteboard: [b2g-crash][caf-crash 530][caf priority: p1][CR 817667] → [b2g-crash][caf-crash 530][caf priority: p3][CR 817667]

Comment 25

3 years ago
Not seen in past few builds, so closing this for now.
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.