1720586 - Crash in [@ abort | webrtc::UpdateLogRatioMetric]

Status: RESOLVED WORKSFORME

(Core :: WebRTC, defect)

Description

[alex_mayorga]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/c4a2bcc3-15e2-4007-841c-4fa900210714

Reason: STATUS_STACK_BUFFER_OVERRUN / FAST_FAIL_FATAL_APP_EXIT

Top 10 frames of crashing thread:

0 ucrtbase.dll abort 
1 xul.dll rtc::FatalMessage::~FatalMessage third_party/libwebrtc/webrtc/rtc_base/checks.cc:69
2 xul.dll webrtc::UpdateLogRatioMetric third_party/libwebrtc/webrtc/modules/audio_processing/aec/aec_core.cc:454
3 xul.dll webrtc::ProcessNearendBlock third_party/libwebrtc/webrtc/modules/audio_processing/aec/aec_core.cc:1458
4 xul.dll webrtc::WebRtcAec_ProcessFrames third_party/libwebrtc/webrtc/modules/audio_processing/aec/aec_core.cc:1932
5 xul.dll webrtc::WebRtcAec_Process third_party/libwebrtc/webrtc/modules/audio_processing/aec/echo_cancellation.cc:350
6 xul.dll webrtc::EchoCancellationImpl::ProcessCaptureAudio third_party/libwebrtc/webrtc/modules/audio_processing/echo_cancellation_impl.cc:176
7 xul.dll webrtc::AudioProcessingImpl::ProcessCaptureStreamLocked third_party/libwebrtc/webrtc/modules/audio_processing/audio_processing_impl.cc:1213
8 xul.dll webrtc::AudioProcessingImpl::ProcessStream third_party/libwebrtc/webrtc/modules/audio_processing/audio_processing_impl.cc:873
9 xul.dll mozilla::AudioInputProcessing::PacketizeAndProcess dom/media/webrtc/MediaEngineWebRTCAudio.cpp:1061

Comment 1

[Chris Peterson [:cpeterson]]

Only one crash report so far.

Comment 2

[Chris Peterson [:cpeterson]]

This doesn't look like a Fission crash, even though the crash report in comment 0 has DOMFissionEnabled=1.

Comment 3

[Michael Froman [:mjf]]

We're missing a line of the stack where ProcessNearendBlock calls UpdateMetrics, so we don't have info on which of the 3 calls to UpdateLogRatioMetric might have caused the actual crash here. We'd need that to know which of the denominator params passed into UpdateLogRatioMetric was negative. Each of those fields (nearLevel, lineoutLevel, and nlpoutLevel) are PowerLevels.

It seems like a PowerLevel shouldn't be negative, but this is new code to me. padenot, do you have any thoughts here?

Comment 4

[Michael Froman [:mjf]]

I'm thinking with this code changing when we land the libwebrtc uplift soon, and that we only have one crash on record, this can probably be downgraded to an S3. We can move it back if it becomes more prevalent.

Comment 5

[Paul Adenot (:padenot)]

I agree with the assessment in comment 3.

Comment 6

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.