[Crash] [@ mozilla::MediaStreamGraphImpl::UpdateStreamOrder]



4 years ago
4 years ago


(Reporter: ntroast, Unassigned)



Gonk (Firefox OS)
Dependency tree / graph

Firefox Tracking Flags



(Whiteboard: [b2g-crash][caf-crash 530][caf priority: p3][CR 817667])


(10 attachments)



4 years ago
We observed the following crash signature during testing.

[@ mozilla::MediaStreamGraphImpl::UpdateStreamOrder | mozilla::MediaStreamGraphImpl::UpdateGraph | mozilla::MediaStreamGraphImpl::OneIteration | mozilla::AudioCallbackDriver::DataCallback ]

Cafbot will upload the decoded minidump and extra file.
roc/ehsan, any ideas here? See some changes from your side on m-c recently, but not sure if they are related. Can you please help investigate this crasher ?
Flags: needinfo?(roc)
Flags: needinfo?(ehsan)
Whiteboard: [CR 817667]
Whiteboard: [CR 817667] → [caf priority: p1][CR 817667]
Whiteboard: [caf priority: p1][CR 817667] → [b2g-crash][caf-crash 530][caf priority: p1][CR 817667]
Keywords: crash

Comment 7

4 years ago
Paul hacks on this stuff nowadays.
Flags: needinfo?(ehsan) → needinfo?(padenot)
blocking-b2g: 2.2? → 2.2+

Comment 8

4 years ago
Steve, could you help investigate as well?
Flags: needinfo?(slee)

Comment 13

4 years ago
this crash was produced during stability tests which involves monkey testing for several hours and there is no clear STR for this. If we are not able to identify the issue using provided logs then please feel free to provide us a debug patch with additional logging to identify the issue.
Flags: needinfo?(ntroast)
This seems like it could be related to bug 1150923. Both bugs suggest corruption of the graph, so that a destroyed stream is still present as the source or destination of a MediaInputPort. But I don't remember seeing any bugs like that for a long time...

The MediaStream destructor logging patch I just attached to bug 1150923 might help here too. We should also add assertions that the mInputs and mConsumers arrays are empty when we destroy a MediaStream, to ensure that it's fully disconnected. Added here:
Flags: needinfo?(roc)

Comment 18

4 years ago
(In reply to cafbot (PoC: ggrisco) from comment #17)
> Created attachment 8589618 [details]
> decoded minidump - AU_LINUX_GECKO_LF.BR.

From the log, I found that on frame 7 of Thread 20, it calls NS_ABORT_OOM. It looks like SetLength on [1] requests too many memory.

roc, paul, 
Do you have any thoughts about this?

[1] http://git.mozilla.org/?p=integration/gecko-dev.git;a=blob;f=dom/media/MediaStreamGraph.cpp;h=4a50ea3185be2f8f01ea44d2e52444e119c2e11a;hb=643f37b68305d90ecfa148f81db63891c30e4620#l373
Flags: needinfo?(slee)
Flags: needinfo?(roc)
Flags: needinfo?(padenot)
(In reply to StevenLee[:slee] from comment #18)
> From the log, I found that on frame 7 of Thread 20, it calls NS_ABORT_OOM.
> It looks like SetLength on [1] requests too many memory.
> roc, paul, 
> Do you have any thoughts about this?
> [1]
> http://git.mozilla.org/?p=integration/gecko-dev.git;a=blob;f=dom/media/
> MediaStreamGraph.cpp;h=4a50ea3185be2f8f01ea44d2e52444e119c2e11a;
> hb=643f37b68305d90ecfa148f81db63891c30e4620#l373

In this log, there are two MSGs running, one driven by a ThreadedDriver (system clock or offline, unfortunately I can't tell which), and another driven by the audio callback. That's unusual, but possible if there's an OfflineAudioContext (but should not happen for any other reason).
Flags: needinfo?(roc)

Comment 20

4 years ago
Inder, could you help to provide more information? more log or reproduce steps will be helpful. thanks.
Flags: needinfo?(ikumar)

Comment 21

4 years ago
Looking at the provided logs I see that Ringtones app may be the culprit.
I am starting to see Ringtones as a recurring theme for these MSG issues.

I do have additional logs for this issue, but please be specific as they are very large.
Flags: needinfo?(ikumar)


4 years ago
See Also: → 1150923
Flags: needinfo?(padenot)
Whiteboard: [b2g-crash][caf-crash 530][caf priority: p1][CR 817667] → [b2g-crash][caf-crash 530][caf priority: p3][CR 817667]

Comment 25

4 years ago
Not seen in past few builds, so closing this for now.
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.