1632864 - MTG crashes on cubeb state change to error if the driver is started

Status: RESOLVED FIXED

(Core :: Audio/Video: MediaStreamGraph, defect, P1)

Description

[Alex Chronopoulos [:achronop]]

It has happened in a local build. The steps are the following:

1. echo gUM test with external mic and internal speakers.
2. Unplug the mic.

In an opt build the crash is not very obvious. It does not create a crash report nor the page changes to the common crash page. However, the tab is not usable after.

This is an existing problem but it is easier to happen after 1603384. The cubeb device change behavior has modified in Linux and a device unplug event is followed by a cubeb state change to error. That results in calling the Fallback driver which attempts to restart an already started AudioCallback driver and that is not allowed.

0x00007fffea8db40e in mozilla::AudioCallbackDriver::Start (this=0x7ffff78645c0) at /home/achronop/repos/mozilla/firefox/dom/media/GraphDriver.cpp:733
733	  MOZ_ASSERT(!IsStarted());
Missing separate debuginfos, use: dnf debuginfo-install at-spi2-atk-2.34.2-1.fc31.x86_64 glib2-2.62.5-1.fc31.x86_64 pcre-8.43-3.fc31.x86_64 pcre2-10.34-7.fc31.x86_64
(gdb) bt
#0  0x00007fffea8db40e in mozilla::AudioCallbackDriver::Start() (this=0x7ffff78645c0) at /home/achronop/repos/mozilla/firefox/dom/media/GraphDriver.cpp:733
#1  0x00007fffea8dda05 in mozilla::AudioCallbackDriver::MaybeStartAudioStream() (this=0x7ffff78645c0) at /home/achronop/repos/mozilla/firefox/dom/media/GraphDriver.cpp:1262
#2  0x00007fffea8f83d7 in mozilla::AudioCallbackDriver::FallbackWrapper::OneIteration(long, long, mozilla::AudioMixer*)
    (this=0x7fffcbf16d80, aStateComputedEnd=13184, aIterationEnd=11776, aMixer=0x0) at /home/achronop/repos/mozilla/firefox/dom/media/GraphDriver.cpp:428
#3  0x00007fffea8d8542 in mozilla::ThreadedDriver::RunThread() (this=0x7fffcbf02350) at /home/achronop/repos/mozilla/firefox/dom/media/GraphDriver.cpp:208
#4  0x00007fffea8f8fee in mozilla::MediaTrackGraphInitThreadRunnable::Run() (this=0x7fffce977850) at /home/achronop/repos/mozilla/firefox/dom/media/GraphDriver.cpp:122
#5  0x00007fffe5c537fa in nsThread::ProcessNextEvent(bool, bool*) (this=0x7fffcbf02ac0, aMayWait=true, aResult=0x7fffcb6fea67)
    at /home/achronop/repos/mozilla/firefox/xpcom/threads/nsThread.cpp:1200
#6  0x00007fffe5c59547 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=0x7fffcbf02ac0, aMayWait=true) at /home/achronop/repos/mozilla/firefox/xpcom/threads/nsThreadUtils.cpp:481
#7  0x00007fffe6a0dd79 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) (this=0x7fffcbf43a00, aDelegate=0x7fffcb6fec78)
    at /home/achronop/repos/mozilla/firefox/ipc/glue/MessagePump.cpp:332
#8  0x00007fffe6909567 in MessageLoop::RunInternal() (this=0x7fffcb6fec78) at /home/achronop/repos/mozilla/firefox/ipc/chromium/src/base/message_loop.cc:315
#9  0x00007fffe69094e5 in MessageLoop::RunHandler() (this=0x7fffcb6fec78) at /home/achronop/repos/mozilla/firefox/ipc/chromium/src/base/message_loop.cc:308
#10 0x00007fffe69094a3 in MessageLoop::Run() (this=0x7fffcb6fec78) at /home/achronop/repos/mozilla/firefox/ipc/chromium/src/base/message_loop.cc:290
#11 0x00007fffe5c4fe19 in nsThread::ThreadFunc(void*) (aArg=0x7fffc86f89a0) at /home/achronop/repos/mozilla/firefox/xpcom/threads/nsThread.cpp:444
#12 0x00007ffff7a523ee in _pt_root (arg=0x7fffcbf363a0) at /home/achronop/repos/mozilla/firefox/nsprpub/pr/src/pthreads/ptthread.c:201
#13 0x00007ffff7f914e2 in start_thread (arg=<optimized out>) at pthread_create.c:479
#14 0x00007ffff7b5f6d3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Alex Chronopoulos [:achronop]]

Attachment: Bug 1632864 - Simulate cubeb error state callback in MockCubeb. r?padenot

The MockCubeb has been reformated to save the latest MockCubebStream. Then a flag is exposed that if true the audio callback will fire a cubeb state change callback with error state and will abort. On top of that, a new unit test has been implemented that triggers the error callback. This results in a crash that is being fixed in the following patch.

Comment 2

[Alex Chronopoulos [:achronop]]

Attachment: Bug 1632864 - Handle error state callback in GraphDriver. r?padenot

Till now an AudioCallbackDriver, on error state callback, creates a FallbackDriver, which attempts to start the existing AudioCallbackDriver. If the driver has already started this creates a cr
ash because restart is not allowed.

This patch continues using the FallbackDriver, on cubeb state error but the driver has been enhanced with an error state that will not attempt to restart the driver. The fallback driver will continue advancing the graph similar to a ThreadedDriver until a driver switch takes place.

Depends on D73102

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9b2b8a51ca6b
Simulate cubeb error state callback in MockCubeb. r=padenot
https://hg.mozilla.org/integration/autoland/rev/3220c6749601
Handle error state callback in GraphDriver. r=padenot

Comment 4

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/9b2b8a51ca6b
https://hg.mozilla.org/mozilla-central/rev/3220c6749601