1268719 - Very large allocations in refill_callback_duplex

Status: RESOLVED FIXED

(Core :: Audio/Video: cubeb, defect, P1)

Description

[Andrew McCreight [:mccr8]]

I see a number of these large allocations on Nightly. The allocation sizes are around 1GB. It looks like these first showed up in the 4/27 build. Maybe this is a regression from bug 1266623?

Comment 1

[Matthew Gregan [:kinetik]]

Andrew, are you seeing these locally or is this just from crash reports?  Looking for a way to repro and/or more information about the audio config.

Those allocation sizes might suggest an underflow but I'm not seeing a way for that to happen.  The linear_buffer should be pretty small in general and we assert that we empty it during every callback cycle, so I don't think it's a case where it's growing without bound and eventually hitting an overflow/huge alloc directly.

ccing Paul in case he has ideas.

Comment 2

[Paul Adenot (:padenot)]

Do we have stacks, or ways to repro for this, or any other info ?

Comment 3

[Andrew McCreight [:mccr8]]

(In reply to Paul Adenot (:padenot) from comment #2)
> Do we have stacks, or ways to repro for this, or any other info ?

I filed this based on crash-stats. If you click on the link in "Crash Signature" it will take you to the crash reports. Unfortunately none of the reports have a URL or user comment so I don't have any more information about how to reproduce.

Comment 4

[Matthew Gregan [:kinetik]]

This is probably bug 1270135.

Comment 5

[Liz Henry (:lizzard) (relman/hg->git project)]

This was likely fixed in bug 1270062. There aren't any crashes in 49 with this signature after 05/03.

Comment 6

[Liz Henry (:lizzard) (relman/hg->git project)]

Fixed based on bug 1270062 and crash-stats.

Comment 7

[[:philipp]]

i'm reopening this bug since the signature is on the rise in 50.0b builds again, the allocation sizes are smaller now though like in https://crash-stats.mozilla.com/report/index/43269eab-085c-4037-b95e-4b4602161014

Comment 8

[Paul Adenot (:padenot)]

I think this is because of this `ceilf` [0]. We're rounding the size of the buffer up each time, and it accumulates, and then crashes.

[0]: https://hg.mozilla.org/releases/mozilla-release/annotate/2d931a5eaf8a/media/libcubeb/src/cubeb_resampler_internal.h#l266

Comment 9

[Paul Adenot (:padenot)]

The cause and fix are different, I'm opening a new bug for this.

Comment 10

[Paul Adenot (:padenot)]

See https://bugzilla.mozilla.org/show_bug.cgi?id=1310224

Comment 11

[Andrew McCreight [:mccr8]]

I agree, a new bug is appropriate.

Comment 12

[Maire Reavy [:mreavy]]

We really want to be tracking Bug 1310206, which I just nominated for tracking-firefox50 -- which fixes bug 1310224.  This was reopened under the assumption that bug 1310224 was this bug, and they are different.