605861 - crash using OSS when trying to rewind video

Status: RESOLVED DUPLICATE of bug 562488

(Core :: Audio/Video, defect)

Description

[Ilya A. Archipov]

User-Agent:       Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.2.10) Gecko/20100930 Firefox/3.6.10
Build Identifier: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.2.10) Gecko/20100930 Firefox/3.6.10

Сrash when trying to rewind html5 video in freebsd head ff 3.6.10

Reproducible: Always

Steps to Reproduce:
1. open http://fosscasts.com/screencasts/6-System-Monitoring-With-Monit
2. start html5 video
3. try to rewind... crash :(
Actual Results:  
bus error (core dump)

Expected Results:  
all work

%uname -a
FreeBSD micro 9.0-CURRENT FreeBSD 9.0-CURRENT #3: Tue Oct 19 19:56:40 MSD 2010     root@micro:/usr/obj/usr/src/sys/GENERIC  amd64
%firefox3 --version
Mozilla Firefox 3.6.10, Copyright (c) 1998 - 2010 mozilla.org

Comment 1

[Matthias Versen [:Matti]]

we need a stacktrace with debug symvols...

Comment 2

[Ilya A. Archipov]

i upgrade ff to 3.6.11 && kldload sem, but...

Program received signal SIGBUS, Bus error.
[Switching to Thread 8123ed300 (LWP 100337)]
0x00000008059966cf in pthread_mutex_lock () from /lib/libthr.so.3
(gdb) bt
#0  0x00000008059966cf in pthread_mutex_lock () from /lib/libthr.so.3
#1  0x00000008015cdc70 in std::__adjust_heap<__gnu_cxx::__normal_iterator<nsRefPtr<imgCacheEntry>*, std::vector<nsRefPtr<imgCacheEntry>, std::allocator<nsRefPtr<imgCacheEntry> > > >, long, nsRefPtr<imgCacheEntry>, bool (*)(nsRefPtr<imgCacheEntry> const&, nsRefPtr<imgCacheEntry> const&)> () from /usr/local/lib/firefox3/libxul.so
#2  0x0000000805990149 in pthread_getprio () from /lib/libthr.so.3
#3  0x00007ffffcbe8000 in ?? ()
Error accessing memory address 0x7ffffcde8000: Bad address.

Comment 3

[timeless]

I can't tell if you have symbols for firefox, please install symbols for both libthr.so.3 and firefox3 (libxul.so)

Comment 4

[Ilya A. Archipov]

how can i do this?

Comment 5

[Ilya A. Archipov]

i rebuild /usr/ports/www/libxul 
micro# make showconfig
===> The following configuration options are available for libxul-1.9.2.9_1:
     DBUS=on "Enable D-BUS support"
     JAVA=off "Enable JAVA xpcom"
     DEBUG=on "Build a debugging image"
     LOGGING=on "Enable additional log messages"
     OPTIMIZED_CFLAGS=on "Enable some additional optimizations"
and rebuild /usr/src/lib/libthr
make DEBUG_FLAGS=-g && make intall clean
but backtrace don't change

Comment 6

[Ilya A. Archipov]

i386 crash too

Comment 7

[timeless]

http://www.freebsd.org/gnome/docs/bugging.html says:

make WITH_DEBUG=yes install

Comment 8

[Ilya A. Archipov]

i have DEBUG_FLAGS=-g in /etc/make.conf

Comment 9

[Matthew Gregan [:kinetik]]

Can you reproduce this with any video, or only the specific one you linked to?  Can you try with both http://media.tinyvid.tv/3d198wqepg78m.ogg and http://flim.org/~kinetik/3d198wqepg78m_nosound.ogg and report the results?

Comment 10

[Ilya A. Archipov]

http://media.tinyvid.tv/3d198wqepg78m.ogg <- crash
http://flim.org/~kinetik/3d198wqepg78m_nosound.ogg <- don't crash

Comment 11

[Matthew Gregan [:kinetik]]

If you're able to recompile, insert:

mAudioHandle = nsnull;

in this file: http://mxr.mozilla.org/mozilla1.9.2/source/content/media/nsAudioStream.cpp#101 like so:

96   if (sa_stream_open(static_cast<sa_stream_t*>(mAudioHandle)) != SA_SUCCESS) {
97     sa_stream_destroy(static_cast<sa_stream_t*>(mAudioHandle));
98     mAudioHandle = nsnull;
99     PR_LOG(gAudioStreamLog, PR_LOG_ERROR, ("nsAudioStream: sa_stream_open error"));
100     return;
101   }
      mAudioHandle = nsnull;
102 }

And retest the first link I provided.  If it no longer crashes, that pretty strongly suggests the crash is caused by the OSS sydneyaudio implementation found here: http://mxr.mozilla.org/mozilla1.9.2/source/media/libsydneyaudio/src/sydney_audio_oss.c

I'm not sure who maintains that, but at least if we can narrow the suspect code down to that file it'll be easier to find a solution to this.

Comment 12

[Matthew Gregan [:kinetik]]

Actually, it'd be better to return from Init() early just in case a re-init is causing the crash.  Add the following lines after line 84:

     mAudioHandle = nsnull;
     return;

...like so:

80 void nsAudioStream::Init(PRInt32 aNumChannels, PRInt32 aRate, SampleFormat aFormat)
81 {
82   mRate = aRate;
83   mChannels = aNumChannels;
84   mFormat = aFormat;
     mAudioHandle = nsnull;
     return;
85   if (sa_stream_create_pcm(reinterpret_cast<sa_stream_t**>(&mAudioHandle),
86                            NULL, 
87                            SA_MODE_WRONLY, 
88                            SA_PCM_FORMAT_S16_NE,
89                            aRate,
90                            aNumChannels) != SA_SUCCESS) {

Comment 13

[Ilya A. Archipov]

ok, but after work, it's a few hour's

Comment 14

[Ilya A. Archipov]

thx it work for me

Comment 15

[Ilya A. Archipov]

oy.. ff didn't crash but no sound

Comment 16

[Matthew Gregan [:kinetik]]

Yeah, it's not a fix--just a way to narrow down where the problem lies.  Thanks to your tests, it's almost definitely caused by a bug in sydney_audio_oss.c.

While looking for maintainers of that file to CC on this bug I found bug 562488, which is fixed on trunk but not on the 1.9.2 branch.  Can you please apply the patch in that bug and report if it solves the problem (with working sound)?

Comment 17

[Ilya A. Archipov]

ff didn't crash but and sound no didn't work

Comment 18

[Matthew Gregan [:kinetik]]

Did you remove the changes I suggested in comment 12?

Comment 19

[Ilya A. Archipov]

hmm no, one moment rebuild

Comment 20

[Ilya A. Archipov]

yep, it's nice work, i will write to maintainers about this patch, thx

Comment 21

[Matthew Gregan [:kinetik]]

Thanks for confirming!  I'll mark this a duplicate.