1739676 - Crash in [@ <audioipc::messagestream_unix::AsyncMessageStream as audioipc::async_msg::AsyncRecvMsg>::recv_msg_buf]

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: cubeb, defect, P3)

Description

[Andrew McCreight [:mccr8]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/d02d1a4e-c732-44f0-a125-819e30211104

MOZ_CRASH Reason: assertion failed: len <= INLINE_CAP

Top 10 frames of crashing thread:

0 libxul.so RustMozCrash mozglue/static/rust/wrappers.cpp:18
1 libxul.so mozglue_static::panic_hook mozglue/static/rust/lib.rs:91
2 libxul.so core::ops::function::Fn::call library/core/src/ops/function.rs:70
3 libxul.so std::panicking::rust_panic_with_hook library/std/src/panicking.rs:628
4 libxul.so std::panicking::begin_panic_handler::{{closure}} library/std/src/panicking.rs:519
5 libxul.so std::sys_common::backtrace::__rust_end_short_backtrace library/std/src/sys_common/backtrace.rs:141
6 libxul.so rust_begin_unwind library/std/src/panicking.rs:517
7 libxul.so core::panicking::panic_fmt library/core/src/panicking.rs:101
8 libxul.so core::panicking::panic library/core/src/panicking.rs:50
9 libxul.so <audioipc::messagestream_unix::AsyncMessageStream as audioipc::async_msg::AsyncRecvMsg>::recv_msg_buf third_party/rust/audioipc/src/async_msg.rs:119

There's only a single instance of this crash, but it has a release assert, so it might be interesting.

Comment 1

[Matthew Gregan [:kinetik]]

The assert is in bytes 0.4: https://hg.mozilla.org/mozilla-central/file/d4abbebb13272217a92126f468002f1379b3ce46/third_party/rust/bytes-0.4.12/src/bytes.rs#l1875

I can't see how the calling code could exceed the allocated buffer size in this case. Perhaps we're hitting this bug: https://github.com/tokio-rs/bytes/issues/327. Migrating to bytes 0.5 might solve this.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.