1535621 - Crash in [@ arena_dalloc | audiounit_setup_stream]

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: cubeb, defect, P2)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-dc6d53c6-831f-481b-ae9a-b8dff0190315.

Seen while looking at nightly crash stats - at least 3 Mac crashes in builds from 3-14 : https://bit.ly/2CnfoQX, all with the same Moz Crash Reason:

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)

There appear to be crashes in this signature as far back as 20190202094451. Based on that idea the regression range could be https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d58901c5036ffa06da6144f22a31479116ee0835&tochange=63348118ef1d564a659f793c0ec9afe5d7f1cc8b

Top 10 frames of crashing thread:

0 libmozglue.dylib arena_dalloc memory/build/mozjemalloc.cpp:2178
1 XUL audiounit_setup_stream memory/mozalloc/mozalloc.h:161
2 XUL audiounit_stream_init media/libcubeb/src/cubeb_audiounit.cpp:2789
3 XUL cubeb_stream_init media/libcubeb/src/cubeb.c:315
4 XUL mozilla::AsyncCubebTask::Run dom/media/GraphDriver.cpp:620
5 XUL nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:241
6 XUL non-virtual thunk to nsThreadPool::Run xpcom/threads/nsThreadPool.cpp
7 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1179
8 XUL NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:482
9 XUL mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:333

Comment 1

[Paul Adenot (:padenot)]

There is often a device change handler stack here in another thread. Alex, can you have a look?

Comment 2

[Alex Chronopoulos [:achronop]]

It's not very obvious what is going on. Optimization hides the real line number in audiounit_setup_stream(). The listener handler in the other thread is waiting in the context lock which makes sense since stream_init is taking place and holds that lock. However, it is strange that there is a listener every time (just one report does not have it).

The good thing is that the crash rate is small. I'll keep an eye on it.

Comment 3

[Neha Kochar [:neha]]

Alex, any further updates? I don't see any crashes in 67 beta yet, but please let me know if I'm missing something.

Comment 4

[Alex Chronopoulos [:achronop]]

Sorry no further update, unfortunately, I haven't had the time to look at it again since my previous comment but I don't see a new crash report also.

Comment 5

[Neha Kochar [:neha]]

Alex, I don’t see any 67 beta crashes. Could you please confirm that and should we close this bug if it isn’t crashing anymore?

Comment 6

[Alex Chronopoulos [:achronop]]

I confirm that I don't see any new occurrence in beta or nightly. We can go on and close it, I monitor audiounit crashes anyway. If I see something that is related to this one I will reopen.