1748658 - Crash in [@ audioipc2::ipccore::impl$9::clone]

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: cubeb, defect, P3)

Description

[Calixte Denizet (:calixte)]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/5b1eb86f-5e30-4584-8272-e35070220105

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 xul.dll audioipc2::ipccore::impl$9::clone third_party/rust/audioipc2/src/ipccore.rs:60
1 xul.dll audioipc2_server::audioipc2_server_new_client third_party/rust/audioipc2-server/src/lib.rs:206
2 xul.dll mozilla::CubebUtils::CreateAudioIPCConnectionUnlocked dom/media/CubebUtils.cpp:461
3 xul.dll mozilla::CubebUtils::CreateAudioIPCConnection dom/media/CubebUtils.cpp:486
4 xul.dll mozilla::dom::ContentParent::RecvCreateAudioIPCConnection dom/ipc/ContentParent.cpp:4935
5 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:8436
6 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:1968
7 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1855
8 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:771
9 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1183

There is 1 crash in nightly 97 with buildid 20220104214425. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1748160.

[1] https://hg.mozilla.org/mozilla-central/rev?node=0046175b2c53

Comment 1

[Matthew Gregan [:kinetik]]

This is behind a pref (media.cubeb.sandbox_v2) which is default-off everywhere but macOS and exists only for testing purposes on other platforms.

I just hit the same crash after flipping that pref on and opening a new audio stream without restarting Firefox. Everything works fine after a restart, so this is likely just an issue when flipping the pref at runtime. This will go away when bug 1726279 and bug 1697845 land, since the pref will be removed again.

Comment 2

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1748160

Comment 3

[Matthew Gregan [:kinetik]]

Attachment: Bug 1748658 - Make AudioIPC prefs `mirror: once`. r?#cubeb-reviewers

Comment 4

[Ryan VanderMeulen [:RyanVM]]

The regressing feature was disabled in 97.0b7.

Comment 5

[BugBot [:suhaib / :marco]]

Closing because no crashes reported for 12 weeks.