1599922 - Intermittent Assertion failure: !OnGraphThread(), at GraphDriver.cpp:971 | application crashed [@ mozilla::AudioCallbackDriver::StateCallback(cubeb_state)]

Reporter

Description

•

5 years ago

treeherder

Filed by: aiakab [at] mozilla.com
Parsed log: https://treeherder.mozilla.org/logviewer.html#?job_id=278500941&repo=autoland
Full log: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/Wvx9Mku6Riimr4MwrOIUxg/runs/0/artifacts/public/logs/live_backing.log

[task 2019-11-27T21:36:44.167Z] 21:36:44 [task 2019-11-27T21:36:44.167Z] 21:36:44 [task 2019-11-27T21:36:44.167Z] 21:36:44 [task 2019-11-27T21:36:50.791Z] 21:36:50 [task 2019-11-27T21:36:50.791Z] 21:36:50 [task 2019-11-27T21:36:56.374Z] 21:36:56 [task 2019-11-27T21:36:56.534Z] 21:36:56 [task 2019-11-27T21:36:56.534Z] 21:36:56 [task 2019-11-27T21:36:56.534Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.535Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.536Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.537Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.538Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 [task 2019-11-27T21:36:56.539Z] 21:36:56 INFO - TEST-OK | /webaudio/the-audio-api/the-audionode-interface/audionode-connect-return-value.html | took 723ms
INFO - TEST-START | /webaudio/the-audio-api/the-audionode-interface/audionode-disconnect-audioparam.html
INFO - Closing window 22
INFO - mozcrash .............
INFO - mozcrash Copy/paste: /builds/worker/workspace/build/linux64-minidump_stackwalk /tmp/tmpcL7W_9/664c3806-7166-17d0-95ca-7e65c95c3659.dmp /builds/worker/workspace/build/symbols
INFO - mozcrash Saved minidump as /builds/worker/workspace/build/blobber_upload_dir/664c3806-7166-17d0-95ca-7e65c95c3659.dmp
INFO - PROCESS-CRASH | /webaudio/the-audio-api/the-audionode-interface/audionode-disconnect-audioparam.html | application crashed [@ mozilla::AudioCallbackDriver::StateCallback(cubeb_state)]
INFO - Crash dump filename: /tmp/tmpcL7W_9/664c3806-7166-17d0-95ca-7e65c95c3659.dmp
INFO - Operating system: Android
INFO - 0.0.0 Linux 3.10.0+ #260 SMP PREEMPT Fri May 19 12:48:14 PDT 2017 x86_64
INFO - CPU: amd64
INFO - family 6 model 6 stepping 3
INFO - 4 CPUs
INFO -
INFO - GPU: UNKNOWN
INFO -
INFO - Crash reason: SIGSEGV /SEGV_MAPERR
INFO - Crash address: 0x0
INFO - Process uptime: not available
INFO -
INFO - Thread 37 (crashed)
INFO - 0 libxul.so!mozilla::AudioCallbackDriver::StateCallback(cubeb_state) [GraphDriver.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 971 + 0x29]
INFO - rax = 0x00007a4456db1ddd rdx = 0x0000000000000001
INFO - rcx = 0x00007a4471815a80 rbx = 0x00007a4446ed6bb0
INFO - rsi = 0x00007a44482f6ad0 rdi = 0x00007a44482f6820
INFO - rbp = 0x00007a44482f6b20 rsp = 0x00007a44482f6b10
INFO - r8 = 0x00000000000069ad r9 = 0x00007a44482f7450
INFO - r10 = 0x00007a44527659f0 r11 = 0x0000000000000000
INFO - r12 = 0x00007a44482f6c30 r13 = 0x00007a446b3722e0
INFO - r14 = 0x0000000000000001 r15 = 0x00007a44480358f0
INFO - rip = 0x00007a4452765a02
INFO - Found by: given as instruction pointer in context
INFO - 1 libxul.so!opensl_stream_stop [cubeb_opensl.c:758b24645eb10067adb0e0d2bee938a5d6a63322 : 1515 + 0x10]
INFO - rbp = 0x00007a44482f6b40 rsp = 0x00007a44482f6b30
INFO - rip = 0x00007a44536ffc4a
INFO - Found by: previous frame's frame pointer
INFO - 2 libxul.so!mozilla::AudioCallbackDriver::Stop() [GraphDriver.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 713 + 0x9]
INFO - rbp = 0x00007a44482f6b60 rsp = 0x00007a44482f6b50
INFO - rip = 0x00007a445276473d
INFO - Found by: previous frame's frame pointer
INFO - 3 libxul.so!mozilla::AsyncCubebTask::Run() [GraphDriver.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 433 + 0x10]
INFO - rbp = 0x00007a44482f6b90 rsp = 0x00007a44482f6b70
INFO - rip = 0x00007a4452763ee1
INFO - Found by: previous frame's frame pointer
INFO - 4 libxul.so!nsThreadSyncDispatch::Run() [nsThreadSyncDispatch.h:758b24645eb10067adb0e0d2bee938a5d6a63322 : 35 + 0xe]
INFO - rbp = 0x00007a44482f6bd0 rsp = 0x00007a44482f6ba0
INFO - rip = 0x00007a445097dc6b
INFO - Found by: previous frame's frame pointer
INFO - 5 libxul.so!nsThreadPool::Run() [nsThreadPool.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 304 + 0x11]
INFO - rbp = 0x00007a44482f6cb0 rsp = 0x00007a44482f6be0
INFO - rip = 0x00007a44509779fa
INFO - Found by: previous frame's frame pointer
INFO - 6 libxul.so!non-virtual thunk to nsThreadPool::Run() [nsThreadPool.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 0 + 0xd]
INFO - rbp = 0x00007a44482f6cc0 rsp = 0x00007a44482f6cc0
INFO - rip = 0x00007a4450977ea3
INFO - Found by: previous frame's frame pointer
INFO - 7 libxul.so!nsThread::ProcessNextEvent(bool, bool*) [nsThread.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 1250 + 0x11]
INFO - rbp = 0x00007a44482f7230 rsp = 0x00007a44482f6cd0
INFO - rip = 0x00007a445097316b
INFO - Found by: previous frame's frame pointer
INFO - 8 libxul.so!NS_ProcessNextEvent(nsIThread*, bool) [nsThreadUtils.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 486 + 0x10]
INFO - rbp = 0x00007a44482f7270 rsp = 0x00007a44482f7240
INFO - rip = 0x00007a4450976203
INFO - Found by: previous frame's frame pointer
INFO - 9 libxul.so!mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) [MessagePump.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 333 + 0xb]
INFO - rbp = 0x00007a44482f72c0 rsp = 0x00007a44482f7280
INFO - rip = 0x00007a4450ea3789
INFO - Found by: previous frame's frame pointer
INFO - 10 libxul.so!MessageLoop::RunInternal() [message_loop.cc:758b24645eb10067adb0e0d2bee938a5d6a63322 : 315 + 0x17]
INFO - rbp = 0x00007a44482f7300 rsp = 0x00007a44482f72d0
INFO - rip = 0x00007a4450e572ac
INFO - Found by: previous frame's frame pointer
INFO - 11 libxul.so!MessageLoop::Run() [message_loop.cc:758b24645eb10067adb0e0d2bee938a5d6a63322 : 290 + 0x8]
INFO - rbp = 0x00007a44482f7340 rsp = 0x00007a44482f7310
INFO - rip = 0x00007a4450e57215
INFO - Found by: previous frame's frame pointer
INFO - 12 libxul.so!nsThread::ThreadFunc(void*) [nsThread.cpp:758b24645eb10067adb0e0d2bee938a5d6a63322 : 458 + 0xd]
INFO - rbp = 0x00007a44482f73a0 rsp = 0x00007a44482f7350
INFO - rip = 0x00007a4450970a06
INFO - Found by: previous frame's frame pointer
INFO - 13 libnss3.so!_pt_root [ptthread.c:758b24645eb10067adb0e0d2bee938a5d6a63322 : 201 + 0xa]
INFO - rbp = 0x00007a44482f73e0 rsp = 0x00007a44482f73b0
INFO - rip = 0x00007a4459361af2
INFO - Found by: previous frame's frame pointer
INFO - 14 libnss3.so!pt_recvfrom_cont [ptio.c:758b24645eb10067adb0e0d2bee938a5d6a63322 : 0 + 0x5]
INFO - rbp = 0x00007a44482f73e0 rsp = 0x00007a44482f73d0
INFO - rip = 0x00007a445936199d
INFO - Found by: stack scanning
INFO - 15 libc.so + 0x89772
INFO - rsp = 0x00007a44482f73f0 rip = 0x00007a4473649772
INFO - Found by: stack scanning
INFO - 16 libnss3.so!pt_recvfrom_cont [ptio.c:758b24645eb10067adb0e0d2bee938a5d6a63322 : 0 + 0x5]
INFO - rsp = 0x00007a44482f7428 rip = 0x00007a445936199d
INFO - Found by: stack scanning
INFO - 17 libc.so + 0x299ec
INFO - rsp = 0x00007a44482f7440 rip = 0x00007a44735e99ec
INFO - Found by: stack scanning
INFO - 18 libc.so + 0x896c0
INFO - rsp = 0x00007a44482f7448 rip = 0x00007a44736496c0
INFO - Found by: stack scanning
INFO - 19 libc.so + 0x1ca66
INFO - rsp = 0x00007a44482f7450 rip = 0x00007a44735dca66
INFO - Found by: stack scanning
INFO - 20 libnss3.so!pt_recvfrom_cont [ptio.c:758b24645eb10067adb0e0d2bee938a5d6a63322 : 0 + 0x5]
INFO - rsp = 0x00007a44482f74b8 rip = 0x00007a445936199d
INFO - Found by: stack scanning
INFO -
INFO - Thread 0
INFO - 0 libc.so + 0x8c66a

Karl Tomlinson (:karlt)

Assignee

Updated

•

5 years ago

Comment 4

•

4 years ago

PRThread pointers dangle after the thread is joined.

After thread join, nsIEventTarget::IsOnCurrentThread() tests against a dangling PRThread* mVirtualThread.

This can return true unexpectedly if another PRThread has been created with the same address.

This is arguably a regression from previous nsThread code testing mThread.
https://hg.mozilla.org/mozilla-central/rev/36ef70762b74b3c6b8bd0f26c57ab4b54467f64b#l29.560
PRThread* mThread is cleared after join but this is actually after the PRThread is deleted, which may be a problem if another thread has access to the nsThread.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=46cf96890ebf68a27a68fde73bb5aba97bad2dd2

Assignee: nobody → karlt

Status: NEW → ASSIGNED

Component: Web Audio → XPCOM

Regressed by: 1382922

Updated

•

4 years ago

Keywords: regression

Karl Tomlinson (:karlt)

Assignee

Comment 5

•

4 years ago

Attached file Bug 1599922 clear PRThread references before the PRThread is deleted r?froydnj — Details

Virtual thread references are used for IsOnCurrentThread(), which would
spuriously return true when the dangling pointer happened to match that of a
new PRThread.

Pulsebot

Comment 6

•

4 years ago

Pushed by ktomlinson@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/3f0b4e206853
clear PRThread references before the PRThread is deleted r=froydnj

Karl Tomlinson (:karlt)

Assignee

Updated

•

4 years ago

Regressions: 1602646

Narcis Beleuzu [:NarcisB]

Comment 7

•

4 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/3f0b4e206853

Status: ASSIGNED → RESOLVED

Closed: 4 years ago

status-firefox73: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla73

Noemi Erli[:noemi_erli]

Updated

•

4 years ago

Regressions: 1602682

Ryan VanderMeulen [:RyanVM]

Updated

•

4 years ago

status-firefox71: --- → wontfix

status-firefox72: --- → wontfix

status-firefox-esr68: --- → wontfix

Karl Tomlinson (:karlt)

Assignee

Updated

•

4 years ago

Regressions: 1603153

Karl Tomlinson (:karlt)

Assignee

Updated

•

4 years ago

Regressions: 1604005

BugBot [:suhaib / :marco/ :calixte]

Updated

•

2 years ago

Has Regression Range: --- → yes

Bugzilla

Quick Search

Intermittent Assertion failure: !OnGraphThread(), at GraphDriver.cpp:971 | application crashed [@ mozilla::AudioCallbackDriver::StateCallback(cubeb_state)]

Categories

(Core :: XPCOM, defect)

Tracking

()

People

(Reporter: intermittent-bug-filer, Assigned: karlt)

References

(Regression)

Details

(Keywords: crash, intermittent-failure, regression)

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Updated

Comment 1

Comment 2

Comment 3

Comment 4

Updated

Comment 5

Comment 6

Updated

Comment 7

Updated

Updated

Updated

Updated

Updated

Attachment

General

Description

File Name

Content Type