1376000 - All Tabs Crash in libpulse

Status: RESOLVED FIXED

(Core :: Audio/Video: cubeb, defect, P1)

Description

[Sean Stangl [:sstangl]]

As of today (and possibly yesterday's) Nightly, I am completely unable to load any tabs. On load, every tab immediately crashes with a NULL dereference on load. Attaching GDB, I was able to get the following backtrace:

> #0  0x0000000000405b17 in mozalloc_abort(char const*) ()
> #1  0x0000000000405b34 in moz_xvalloc ()
> #2  0x00007f238ff90109 in  () at /home/sstangl/bin/nightly/libxul.so
> #3  0x00007f238ff8fb6a in std::panicking::rust_panic_with_hook::h3635757261b59272 ()
>     at /home/sstangl/bin/nightly/libxul.so
> #4  0x00007f238ff8f9a0 in std::panicking::rust_panic_with_hook::h3635757261b59272 ()
>     at /home/sstangl/bin/nightly/libxul.so
> #5  0x00007f238ff8f94a in  () at /home/sstangl/bin/nightly/libxul.so
> #6  0x00007f238ff9d567 in  () at /home/sstangl/bin/nightly/libxul.so
> #7  0x00007f238ffa2b88 in  () at /home/sstangl/bin/nightly/libxul.so
> #8  0x00007f238f97ee2c in  () at /home/sstangl/bin/nightly/libxul.so
> #9  0x00007f23714c9b3c in context_get_sink_info_callback () at /lib64/libpulse.so.0
> #10 0x00007f237126ad51 in run_action () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #11 0x00007f237126b0db in pa_pdispatch_run () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #12 0x00007f23714be81e in pstream_packet_callback () at /lib64/libpulse.so.0
> #13 0x00007f237126dad7 in do_read () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #14 0x00007f237127072b in do_pstream_read_write () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #15 0x00007f2371270ac9 in srb_callback () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #16 0x00007f237127134a in srbchannel_rwloop () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #17 0x00007f23714d374c in pa_mainloop_dispatch () at /lib64/libpulse.so.0
> #18 0x00007f23714d3b4c in pa_mainloop_iterate () at /lib64/libpulse.so.0
> #19 0x00007f23714d3bf0 in pa_mainloop_run () at /lib64/libpulse.so.0
> #20 0x00007f23714e1bd9 in thread () at /lib64/libpulse.so.0
> #21 0x00007f23712811d8 in internal_thread_func () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
> #22 0x00007f239d8cc73a in start_thread () at /lib64/libpthread.so.0
> #23 0x00007f239c952e0f in clone () at /lib64/libc.so.6

This is on a Fedora 25 x86_64 machine that was upgraded from Fedora 24. My other Fedora machine, installed directly to 25, appears to work just fine.

Unfortunately, this makes Firefox unusable on my primary development machine.

Comment 1

[Sean Stangl [:sstangl]]

Paul suggested a temporary workaround by setting the preference "media.cubeb.backend" to "pulse". With that set, tabs load successfully.

Comment 2

[u480271]

(In reply to Sean Stangl [:sstangl] from comment #0)
> This is on a Fedora 25 x86_64 machine that was upgraded from Fedora 24. My
> other Fedora machine, installed directly to 25, appears to work just fine.

Curious. I develop on Fedora 25 and have not seen this issue.  On the machine that crashes, do you have pacmd installed?  What is the output from `pacmd list-sinks`?

Comment 3

[Sean Stangl [:sstangl]]

Attachment: pacmd-broken.txt

In reply to Comment 2, this is the output of `pacmd list-sinks` from the Fedora machine that experiences crashes.

Comment 4

[Sean Stangl [:sstangl]]

Attachment: pacmd-working.txt

In reply to Comment 2, this is the output of `pacmd list-sinks` from the Fedora machine that does not experience crashes.

Comment 5

[Sean Stangl [:sstangl]]

Backtrace with libxul symbols, from a local debug build:

#0  0x00000000004073cf in mozalloc_abort(char const*) (msg=0x4312d8 "Redirecting call to abort() to mozalloc_abort\n")
    at /home/sstangl/dev/gecko-dev/memory/mozalloc/mozalloc_abort.cpp:33
#1  0x00000000004073f9 in abort() () at /home/sstangl/dev/gecko-dev/memory/mozalloc/mozalloc_abort.cpp:80
#2  0x00007f7748c75a89 in panic_abort::__rust_start_panic::abort () at /checkout/src/libpanic_abort/lib.rs:61
#3  0x00007f7748c75a89 in panic_abort::__rust_start_panic () at /checkout/src/libpanic_abort/lib.rs:56
#4  0x00007f7748c714cd in std::panicking::rust_panic () at /checkout/src/libstd/panicking.rs:580
#5  0x00007f7748c7147f in std::panicking::rust_panic_with_hook () at /checkout/src/libstd/panicking.rs:565
#6  0x00007f7748c712a5 in std::panicking::begin_panic<collections::string::String> ()
    at /checkout/src/libstd/panicking.rs:511
#7  0x00007f7748c711da in std::panicking::begin_panic_fmt () at /checkout/src/libstd/panicking.rs:495
#8  0x00007f7748c71168 in std::panicking::rust_begin_panic () at /checkout/src/libstd/panicking.rs:471
#9  0x00007f7748c85bde in core::panicking::panic_fmt () at /checkout/src/libcore/panicking.rs:69
#10 0x00007f7748c85c6e in core::option::expect_failed () at /checkout/src/libcore/option.rs:794
#11 0x00007f7748c0a5c7 in core::option::Option<pulse::SinkFlags>::expect<pulse::SinkFlags> (self=..., msg=...)
    at /checkout/src/libcore/option.rs:297
#12 0x00007f7748c12055 in cubeb_pulse::backend::context::{{impl}}::new::server_info_cb::sink_info_cb (i=0x7f77295798f0, eol=0, u=0x7f77318f61f0) at /home/sstangl/dev/gecko-dev/media/libcubeb/cubeb-pulse-rs/src/backend/context.rs:123
#13 0x00007f7748c0be3f in core::ops::Fn::call<fn(&pulse::context::Context, *const pulse_ffi::ffi_types::pa_sink_info, i32, *mut std::os::raw::c_void),(&pulse::context::Context, *const pulse_ffi::ffi_types::pa_sink_info, i32, *mut std::os::raw::c_void)> () at /checkout/src/libcore/ops.rs:2531
#14 0x00007f7748c0f6be in pulse::context::{{impl}}::get_sink_info_by_name::wrapped<fn(&pulse::context::Context, *const pulse_ffi::ffi_types::pa_sink_info, i32, *mut std::os::raw::c_void)> (c=0x7f775607cd00, info=0x7f77295798f0, eol=0, userdata=0x7f77318f61f0) at /home/sstangl/dev/gecko-dev/media/libcubeb/cubeb-pulse-rs/pulse-rs/src/context.rs:228
#15 0x00007f772a9c7b3c in context_get_sink_info_callback () at /lib64/libpulse.so.0
#16 0x00007f772a768d51 in run_action () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#17 0x00007f772a7690db in pa_pdispatch_run () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#18 0x00007f772a9bc81e in pstream_packet_callback () at /lib64/libpulse.so.0
#19 0x00007f772a76bad7 in do_read () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#20 0x00007f772a76e72b in do_pstream_read_write () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#21 0x00007f772a76eac9 in srb_callback () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#22 0x00007f772a76f34a in srbchannel_rwloop () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#23 0x00007f772a9d174c in pa_mainloop_dispatch () at /lib64/libpulse.so.0
#24 0x00007f772a9d1b4c in pa_mainloop_iterate () at /lib64/libpulse.so.0
#25 0x00007f772a9d1bf0 in pa_mainloop_run () at /lib64/libpulse.so.0
#26 0x00007f772a9dfbd9 in thread () at /lib64/libpulse.so.0
#27 0x00007f772a77f1d8 in internal_thread_func () at /usr/lib64/pulseaudio/libpulsecommon-10.0.so
#28 0x00007f775736873a in start_thread () at /lib64/libpthread.so.0
#29 0x00007f77565f6e0f in clone () at /lib64/libc.so.6

Comment 6

[u480271]

Attachment: Drop any unknown flags in SinkInfo.flags.

MozReview-Commit-ID: 4RWFB5iGW6Z

Comment 7

[u480271]

(In reply to Dan Glastonbury :kamidphish from comment #6)
> Created attachment 8880963 [details] [diff] [review]
> Drop any unknown flags in SinkInfo.flags.
> 
> MozReview-Commit-ID: 4RWFB5iGW6Z

Sean, could you try applying this patch and see if it stops the crash?

Comment 8

[Sean Stangl [:sstangl]]

In reply to Comment 7, applying the patch from Comment 6 does indeed stop the crash.

I also verified that audio on YouTube plays from the correct device.

Comment 9

[u480271]

Attachment: Bug 1376000: Drop any unknown flags in SinkInfo.flags.

Rust expect() is bad in C callbacks.  Replace TryFrom() with
from_bits_truncate() to drop any unknown PulseAudio flags.

Review commit: https://reviewboard.mozilla.org/r/152332/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/152332/

Comment 10

[u480271]

Comment on attachment 8880963 [details] [diff] [review]
Drop any unknown flags in SinkInfo.flags.

># HG changeset patch
># User Dan Glastonbury <[e-mail]>
>
>Bug 1376000: Drop any unknown flags in SinkInfo.flags.
>
>MozReview-Commit-ID: 4RWFB5iGW6Z
>
>diff --git a/media/libcubeb/cubeb-pulse-rs/src/backend/context.rs b/media/libcubeb/cubeb-pulse-rs/src/backend/context.rs
>index 023fa40..502872e 100644
>--- a/media/libcubeb/cubeb-pulse-rs/src/backend/context.rs
>+++ b/media/libcubeb/cubeb-pulse-rs/src/backend/context.rs
>@@ -115,17 +115,17 @@ impl Context {
>     }
> 
>     pub fn new(name: *const c_char) -> Result<Box<Self>> {
>         fn server_info_cb(context: &pulse::Context, info: &pulse::ServerInfo, u: *mut c_void) {
>             fn sink_info_cb(_: &pulse::Context, i: *const pulse::SinkInfo, eol: i32, u: *mut c_void) {
>                 let mut ctx = unsafe { &mut *(u as *mut Context) };
>                 if eol == 0 {
>                     let info = unsafe { &*i };
>-                    let flags = pulse::SinkFlags::try_from(info.flags).expect("SinkInfo contains invalid flags");
>+                    let flags = pulse::SinkFlags::from_bits_truncate(info.flags);
>                     ctx.default_sink_info = Some(DefaultInfo {
>                                                      sample_spec: info.sample_spec,
>                                                      channel_map: info.channel_map,
>                                                      flags: flags,
>                                                  });
>                 }
>                 ctx.mainloop.signal();
>             }
>

Comment 11

[Paul Adenot (:padenot)]

Comment on attachment 8880972 [details]
Bug 1376000: Drop any unknown flags in SinkInfo.flags.

https://reviewboard.mozilla.org/r/152332/#review157392

Looks good. Ideally we would log a message when we find something that we don't expect.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7f3ed467852b
Drop any unknown flags in SinkInfo.flags. r=padenot

Comment 14

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/7f3ed467852b