1594216 - Crash when unpluging headset with rust backend and audio IPC on

Status: RESOLVED DUPLICATE of bug 1612044

(Core :: Audio/Video: cubeb, defect, P2)

Description

[Nils Ohlmeier [:drno]]

I was in a webrtc call where the audio (to my surprise) was coming out of the MBP speakers although I had a headset pluged in to the 3.5mm jack. In my attempt to improve the situation I unpluged the 3.5mm which resulted in the following crash:

https://crash-stats.mozilla.org/report/index/778c2c6f-ae49-4f16-8b33-e100f0191105

Note: this was with rust backend and audio IPC turned on.

Comment 1

[Matthew Gregan [:kinetik]]

No luck reproducing locally. Crash is on macOS 10.15 but I'm still on 10.14, not expecting this to be OS version specific though.

Unfortunately the inlining makes the crash stack too vague to know which message was being processed. The debug symbols don't contain much more useful info for the crash location either:

0x40e13deb: Compile Unit: length = 0x00144d7c version = 0x0002 abbr_offset = 0x0000 addr_size = 0x08 (next unit at 0x40f58b6b)

0x40e13df6: DW_TAG_compile_unit
              DW_AT_producer	("clang LLVM (rustc version 1.38.0 (625451e37 2019-09-23))")
              DW_AT_language	(DW_LANG_Rust)
              DW_AT_name	("media/audioipc/server/src/lib.rs/@/audioipc_server.6bgdno06-cgu.0")
              DW_AT_stmt_list	(0x05d00c61)
              DW_AT_comp_dir	("/builds/worker/workspace/build/src")
              DW_AT_APPLE_optimized	(0x01)
              DW_AT_low_pc	(0x0000000005358a60)
              DW_AT_high_pc	(0x000000000565b479)

0x40f232d9:   DW_TAG_inlined_subroutine
                DW_AT_abstract_origin	(0x0000000040e93e62 "_ZN5alloc3vec12Vec$LT$T$GT$3len17h84ebaa340f718f4dE")
                DW_AT_ranges	(0x04d5b1f0
                   [0x000000000535cdd0, 0x000000000535cdd5)
                   [0x000000000535cdfb, 0x000000000535ce00)
                   [0x000000000535cfe1, 0x000000000535cfe6)
                   [0x000000000535d109, 0x000000000535d10e))
                DW_AT_call_file	("/builds/worker/workspace/build/src/third_party/rust/futures/src/task_impl/core.rs")
                DW_AT_call_line	(248)
                DW_AT_call_column	(0x08)
Line info: file 'result.rs', line 0, column 15, start line 1272

The panic string "invalid key" in the crash is almost certainly from the slab crate, which is used to store the per-stream state on the server. The same panic string occurs for invalid indices via [] and remove.

I'll add exterior index validation to the slab accesses to avoid the panic, with additional logging to help debug this further.

Comment 2

[Matthew Gregan [:kinetik]]

Attachment: GitHub Pull Request

Comment 3

[Matthew Gregan [:kinetik]]

This will be fixed via bug 1612044 now.