757905 - segfault in DeadlockDetector from cubeb_alsa

Status: RESOLVED WORKSFORME

(Core :: XPCOM, defect)

Description

[Ralph Giles (:rillian)]

Debugging another issue, I got a segfault inside sBufferedAudioStream::DataCallback with an asan build on Linux. It seems to happen playing any audio file, for example content/media/test/file_a4_tone.ogg.

Note this is is the address sanitizer build, clang version 3.1 (trunk 152341) with -faddress-sanitizer based on the instructions at https://developer.mozilla.org/en/Building_Firefox_with_Address_Sanitizer

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffc9051700 (LWP 6464)]
0x00007fffe4fac1e2 in mozilla::CallStack::CallStack (this=Unhandled dwarf expression opcode 0xa2
)
    at ../../dist/include/mozilla/DeadlockDetector.h:56
56	../../dist/include/mozilla/DeadlockDetector.h: No such file or directory.
	in ../../dist/include/mozilla/DeadlockDetector.h
Missing separate debuginfos, use: debuginfo-install nss-mdns-0.10-9.fc15.x86_64
(gdb) bt
#0  0x00007fffe4fac1e2 in mozilla::CallStack::CallStack (this=Unhandled dwarf expression opcode 0xa2
)
    at ../../dist/include/mozilla/DeadlockDetector.h:56
#1  0x00007fffe74aa905 in mozilla::Mutex::Lock (this=<optimized out>)
    at BlockingResourceBase.cpp:225
#2  0x00007fffe13bb913 in mozilla::Monitor::Lock (this=<optimized out>)
    at ../../dist/include/mozilla/Monitor.h:37
#3  0x00007fffe13bb7d6 in mozilla::MonitorAutoLock::MonitorAutoLock (
    this=<optimized out>, aMonitor=<optimized out>)
    at ../../dist/include/mozilla/Monitor.h:92
#4  0x00007fffe13acb68 in mozilla::MonitorAutoLock::MonitorAutoLock (
    this=<optimized out>, aMonitor=<optimized out>)
    at ../../dist/include/mozilla/Monitor.h:93
#5  0x00007fffe202f9de in nsBufferedAudioStream::DataCallback (this=Unhandled dwarf expression opcode 0x0
)
    at /home/giles/mozilla/firefox/content/media/nsAudioStream.cpp:1170
#6  0x00007fffe2029e71 in nsBufferedAudioStream::DataCallback_S (
    aThis=<optimized out>, aBuffer=<optimized out>, aFrames=<optimized out>)
    at /home/giles/mozilla/firefox/content/media/nsAudioStream.cpp:879
#7  0x00007fffeb5f7b8c in cubeb_refill_stream (stm=<optimized out>)
    at /home/giles/mozilla/firefox/media/libcubeb/src/cubeb_alsa.c:292
#8  0x00007fffeb5f3ffe in cubeb_run (ctx=<optimized out>)
    at /home/giles/mozilla/firefox/media/libcubeb/src/cubeb_alsa.c:374
#9  0x00007fffeb5ecc06 in cubeb_run_thread (context=<optimized out>)
    at /home/giles/mozilla/firefox/media/libcubeb/src/cubeb_alsa.c:406
#10 0x00000000004b1615 in __asan::AsanThread::ThreadStart() ()
#11 0x00000033a1607d90 in start_thread (arg=0x7fffc9051700)
    at pthread_create.c:309
#12 0x00000033a0ef0f5d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115

Comment 1

[Ralph Giles (:rillian)]

This is mozilla-central hg revision 8cf563a575fd/git commit 56a73ed9be5e.

Comment 2

[Ralph Giles (:rillian)]

Kinetik pointed out that this is actually crashing getting the stack trace, so maybe it isn't a cubeb bug a la bug 752401. Trying a different component.

It may also be a compatibility issue with asan.

Comment 3

[Matthew Gregan [:kinetik]]

It's also possible that this crash is caused by stack exhaustion (I got this idea from Tim's comment in bug 750231 comment 20), because the cubeb_run_thread was running with only 16kB of stack.  I bumped the stack size of this thread up to 256kB in bug 759677 recently to solve a stack exhaustion problem with certain ALSA configurations, so it's possible that this crash has been fixed by that change.

Comment 4

[Christian Holler (:decoder)]

Ralph, can you still reproduce the crash with the change? You can use pre-built binaries to verify: http://people.mozilla.org/~choller/firefox/asan/

Comment 5

[Ralph Giles (:rillian)]

I can't reproduce with http://people.mozilla.org/~choller/firefox/asan/20120705-mozilla-central-macosx64-debug-675f55c4310c+asan.html

Might as well close, I guess.