Closed Bug 1441588 Opened 2 years ago Closed 2 years ago

Assertion failure: sPreferredSampleRate, at /builds/worker/workspace/build/src/dom/media/CubebUtils.cpp:313

Categories

(Core :: Audio/Video: cubeb, defect, P3, critical)

59 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla60
Tracking Status
firefox-esr52 --- unaffected
firefox58 --- unaffected
firefox59 --- unaffected
firefox60 --- fixed

People

(Reporter: jkratzer, Assigned: kamidphish)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase, Whiteboard: [fuzzblocker])

Attachments

(4 files)

Found while fuzzing mozilla-central rev b184be598740.  Currently reducing testcase and will update once available.  Note that this testcase will only reproduce on our headless EC2 spot instances.  Further, this issue is triggering at a rate which requires us to disable fuzzing of getUserMedia until it is resolved.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007fdaddbb32dd   rbx = 0x00007ffe082e7be8
rsi = 0x00007fdadde82770   rdi = 0x00007fdadde81540
rbp = 0x00007ffe082e7c10   rsp = 0x00007ffe082e7be0
r8 = 0x00007fdadde82770    r9 = 0x00007fdadef61740
r10 = 0x0000000000000047   r11 = 0x0000000000000000
r12 = 0x00007ffe082e7bf0   r13 = 0x0000000000000000
r14 = 0x00007ffe082e7c60   r15 = 0x00007fda9ca64d40
rip = 0x00007fdace3a0329
OS|Linux|0.0.0 Linux 4.4.0-1050-aws #59-Ubuntu SMP Tue Jan 30 19:57:10 UTC 2018 x86_64
CPU|amd64|family 6 model 63 stepping 2|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::CubebUtils::InitPreferredSampleRate|hg:hg.mozilla.org/mozilla-central:dom/media/CubebUtils.cpp:b184be59874080e96903183176c0f88dcbfafe25|313|0x21
0|1|libxul.so|mozilla::CubebUtils::PreferredSampleRate|hg:hg.mozilla.org/mozilla-central:dom/media/CubebUtils.cpp:b184be59874080e96903183176c0f88dcbfafe25|319|0x5
0|2|libxul.so|mozilla::MediaStreamGraph::GetInstance|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamGraph.cpp:b184be59874080e96903183176c0f88dcbfafe25|3710|0x5
0|3|libxul.so|mozilla::GetUserMediaStreamRunnable::Run|hg:hg.mozilla.org/mozilla-central:dom/media/MediaManager.cpp:b184be59874080e96903183176c0f88dcbfafe25|1188|0x5
0|4|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b184be59874080e96903183176c0f88dcbfafe25|1040|0x15
0|5|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b184be59874080e96903183176c0f88dcbfafe25|517|0x11
0|6|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b184be59874080e96903183176c0f88dcbfafe25|97|0xa
0|7|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b184be59874080e96903183176c0f88dcbfafe25|326|0x17
0|8|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b184be59874080e96903183176c0f88dcbfafe25|319|0x8
0|9|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b184be59874080e96903183176c0f88dcbfafe25|157|0xd
0|10|libxul.so|nsAppStartup::Run|hg:hg.mozilla.org/mozilla-central:toolkit/components/startup/nsAppStartup.cpp:b184be59874080e96903183176c0f88dcbfafe25|288|0xe
0|11|libxul.so|XREMain::XRE_mainRun|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:b184be59874080e96903183176c0f88dcbfafe25|4679|0x11
0|12|libxul.so|XREMain::XRE_main|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:b184be59874080e96903183176c0f88dcbfafe25|4814|0x8
0|13|libxul.so|XRE_main|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsAppRunner.cpp:b184be59874080e96903183176c0f88dcbfafe25|4906|0x5
0|14|firefox|do_main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b184be59874080e96903183176c0f88dcbfafe25|231|0x22
0|15|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b184be59874080e96903183176c0f88dcbfafe25|304|0xd
0|16|libc-2.23.so||||0x20830
0|17|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b184be59874080e96903183176c0f88dcbfafe25|164|0x5
Flags: needinfo?(apehrson)
Blocks: 792125
Blocks: 1441596
Attached file trigger.html
No longer blocks: 1441596
Depends on: 1441596
Flags: in-testsuite?
Looks like cubeb to me.
Flags: needinfo?(apehrson) → needinfo?(dglastonbury)
Rank: 20
Priority: -- → P3
See Also: → 1442382
Any crash dumps available?
Assignee: nobody → dglastonbury
Flags: needinfo?(dglastonbury)
Attached file Crashdump
Bisected to build range:
> Start: 580d833df9c44acec686a9fb88b5f27e9d29f68d (20180226222013)
> End: c4425fcdfb5b3631f6eb465df9a15c61a8bd2786 (20180227095616)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=580d833df9c44acec686a9fb88b5f27e9d29f68d&tochange=c4425fcdfb5b3631f6eb465df9a15c61a8bd2786
Looks like it might be a side effect of the cubeb update?
I've managed to reproduce the error locally.  Errors are being reported as success. Currently working on a fix.
See Also: → 1442796
Comment on attachment 8955746 [details]
Bug 1441588 - P1: Update audioipc to commit 79c1622.

https://reviewboard.mozilla.org/r/224824/#review230836
Attachment #8955746 - Flags: review?(giles) → review+
Comment on attachment 8955747 [details]
Bug 1441588 - P2: Vendor rust crates.

https://reviewboard.mozilla.org/r/224826/#review230838
Attachment #8955747 - Flags: review?(giles) → review+
Pushed by rgiles@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/e924345d8964
P1: Update audioipc to commit 79c1622. r=rillian
https://hg.mozilla.org/integration/autoland/rev/9f87ddff4b02
P2: Vendor rust crates. r=rillian
https://hg.mozilla.org/mozilla-central/rev/e924345d8964
https://hg.mozilla.org/mozilla-central/rev/9f87ddff4b02
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
Can we land this testcase as a crashtest?
Flags: needinfo?(dglastonbury)
:RyanVM, this issue is that we need to force cubeb to fail so that the mochitest can trigger the error path that failed leading to the assert in CubebUtils.cpp firing. I'm not sure how the fuzzing works. Is it causing cubeb to return error which lead to the assert?
Flags: needinfo?(dglastonbury) → needinfo?(jkratzer)
Duplicate of this bug: 1442382
Flags: needinfo?(jkratzer) → needinfo?(ryanvm)
I guess the naive "add the attached testcase as a crashtest" option isn't enough here? That's all I was trying to ascertain.
Flags: needinfo?(ryanvm)
I think the issue iswe need to run in a special test environment where there's no audio output device. "Note that this testcase will only reproduce on our headless EC2 spot instances."

I guess we could see if the normal taskcluster env qualifies...
You need to log in before you can comment on or make changes to this bug.