1496669 - Crash in arena_t::DallocSmall | BaseAllocator::free | je_free | mozilla::AudioMixer::RemoveCallback

Status: RESOLVED DUPLICATE of bug 1497751

(Core :: Audio/Video: MediaStreamGraph, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is
report bp-c7482d30-7924-4931-9b73-41fcc0181004.
=============================================================

Top 10 frames of crashing thread:

0 mozglue.dll arena_t::DallocSmall memory/build/mozjemalloc.cpp:3450
1 mozglue.dll BaseAllocator::free memory/build/mozjemalloc.cpp:4264
2 mozglue.dll je_free memory/build/malloc_decls.h:40
3 xul.dll mozilla::AudioMixer::RemoveCallback dom/media/AudioMixer.h:122
4 xul.dll void mozilla::AudioCallbackDriver::StateCallback dom/media/GraphDriver.cpp:1093
5 xul.dll static int `anonymous namespace'::wasapi_stream_stop media/libcubeb/src/cubeb_wasapi.cpp:2024
6 xul.dll mozilla::AsyncCubebTask::Run dom/media/GraphDriver.cpp:532
7 xul.dll nsThreadSyncDispatch::Run xpcom/threads/nsThreadSyncDispatch.h:39
8 xul.dll nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:231
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1161

=============================================================

this is a new content crash signature that is newly showing up in low volume during the firefox 63 beta cycle.
all the reports are annotated with MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?) that got added in 1439474.

could this be related to the changes in 63 from bug 1460346?

Comment 1

[Alex Chronopoulos [:achronop]]

It could be. I am wondering, if it is from bug 1460346 why it does not fail in Nightly? Bug 1439474 landed in 60, and MOZ_RELEASE_ASSERT is available in Nightly, isn't it? Is your testing different in Nightly and Beta?

Comment 2

[Andreas Pehrson [:pehrsons]]

(In reply to Alex Chronopoulos [:achronop] from comment #1)
> It could be. I am wondering, if it is from bug 1460346 why it does not fail
> in Nightly? Bug 1439474 landed in 60, and MOZ_RELEASE_ASSERT is available in
> Nightly, isn't it? Is your testing different in Nightly and Beta?

If the frequency in beta is low the frequency in nightly might be so low that it's in reality 0.

Comment 3

[Karl Tomlinson (:karlt)]

Thread 0 is shutting down the graph in AudioCallbackDriver::Shutdown(), presumably waiting for the crashing thread 33.

Suspiciously, thread 34 has only just completed cubeb_resampler_fill().

Comment 4

[Karl Tomlinson (:karlt)]

The lack of reports on 64 beta and 63 release, is evidence to indicate that this was caused by bug 1497751.

Comment 5

[David Lawrence [:dkl]]

Removing employee no longer with company from CC list of private bugs.