Open Bug 1751318 Opened 2 years ago Updated 2 years ago

Crash in [@ audioipc2::ipccore::impl$5::process_inbound<T>]

Categories

(Core :: Audio/Video: cubeb, defect, P3)

Unspecified
Windows 10
defect

Tracking

()

ASSIGNED
Tracking Status
firefox-esr91 --- unaffected
firefox96 --- unaffected
firefox97 --- unaffected
firefox98 --- wontfix
firefox99 --- wontfix
firefox100 --- wontfix
firefox101 --- fix-optional

People

(Reporter: mccr8, Assigned: kinetik)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/221a8c87-5e29-4bab-b340-af9380220118

MOZ_CRASH Reason: assertion failed: n <= MAX_MESSAGE_LEN

Top 10 frames of crashing thread:

0 xul.dll RustMozCrash mozglue/static/rust/wrappers.cpp:17
1 xul.dll mozglue_static::panic_hook mozglue/static/rust/lib.rs:91
2 xul.dll core::ops::function::Fn::call<void  ../02072b482a8b5357f7fb5e5637444ae30e423c40/library/core/src/ops/function.rs:227
3 xul.dll std::panicking::rust_panic_with_hook ../02072b482a8b5357f7fb5e5637444ae30e423c40//library/std/src/panicking.rs:610
4 xul.dll std::panicking::begin_panic_handler::closure$0 ../02072b482a8b5357f7fb5e5637444ae30e423c40//library/std/src/panicking.rs:500
5 xul.dll std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure$0, never$> ../02072b482a8b5357f7fb5e5637444ae30e423c40//library/std/src/sys_common/backtrace.rs:139
6 xul.dll std::panicking::begin_panic_handler ../02072b482a8b5357f7fb5e5637444ae30e423c40//library/std/src/panicking.rs:498
7 xul.dll core::panicking::panic_fmt ../02072b482a8b5357f7fb5e5637444ae30e423c40//library/core/src/panicking.rs:107
8 xul.dll core::panicking::panic ../02072b482a8b5357f7fb5e5637444ae30e423c40//library/core/src/panicking.rs:48
9 xul.dll audioipc2::ipccore::impl$5::process_inbound<audioipc2::rpccore::ServerHandler<audioipc2_client::stream::CallbackServer> > third_party/rust/audioipc2/src/ipccore.rs:608

It looks like this crash started with the 20220118124804 build. I don't know if this is a signature change or what. I think this assertion was added in bug 1726275, about a month ago.

This seems to happen on a specific configuration - every report has identical GPU/CPU/memory/Windows version/storage config. Investigating.

Assignee: nobody → kinetik
Status: NEW → ASSIGNED
Priority: -- → P3
Regressed by: 1726279
Has Regression Range: --- → yes

Set release status flags based on info from the regressing bug 1726279

These crash reports look like they're coming from a single machine. Also note that they all have the value of GetLastError() set to ERROR_IO_INCOMPLETE. If that function is doing asynchronous I/O the issue could lurk somewhere in that behavior.

Attached file GitHub Pull Request

Not a fix, adding debugging to the IPC framing to see if this gives any clues.

(In reply to Gabriele Svelto [:gsvelto] from comment #3)

These crash reports look like they're coming from a single machine. Also note that they all have the value of GetLastError() set to ERROR_IO_INCOMPLETE. If that function is doing asynchronous I/O the issue could lurk somewhere in that behavior.

I think the ERROR_IO_INCOMPLETE is normal, since our EventLoop does an additionalrecv to check if it'd block, then processes any messages read. That recv effectively does a GetOverlappedResult(f, o, n, FALSE), which would result in ERROR_IO_INCOMPLETE.

Bug 1754861 added additional debugging for this, but there have been no reports for this (or related) signatures on Nightly since the 14th. One crash in Beta since the 14th. I'll continue monitoring. This may be solved by the fixes landed in bug 1757473.

Depends on: 1757473

:kinetik any follow-up from your monitoring?
There are a couple of crash reports after the patch landed in bug 1757473.

Flags: needinfo?(kinetik)

This bug is still present. https://crash-stats.mozilla.org/report/index/2bb5fdd4-011e-4ba5-ad98-e8a7c0220316 is a recent crash report triggering the extra debugging I mentioned in comment 4. The assert at https://hg.mozilla.org/releases/mozilla-beta/file/a466f13e839ee56889c724f2c6775067f7c2b78b/third_party/rust/audioipc2/src/codec.rs#l91 is hit, where magic is 0xa4d1019c00000000 rather than the expected 0xa4d1019cc9101d4a.

Flags: needinfo?(kinetik)

Moving to S3 as this crash seems rare.

Severity: S2 → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: