801551 - Crash on shutdown after using Audio/Video [@ nsBufferedAudioStream::DataCallback(void*, long)]

Status: RESOLVED DUPLICATE of bug 824359

(Core :: WebRTC, defect, P1)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Firefox Nightly crashed today on shutdown after I was playing around with the testcase in the URL field. In detail I have enabled video first and afterward audio. But not sure what caused the crash exactly because I cannot reproduce it now.

Crash: bp-33ed8bc4-8534-4813-aad5-1647a2121015

0 	XUL 	nsBufferedAudioStream::DataCallback 	
1 	XUL 	audio_unit_output_callback 	cubeb_audiounit.c:59
2 	CoreAudio 	CoreAudio@0x9b46 	
3 	CoreAudio 	CoreAudio@0x9013 	
4 	AudioToolbox 	AudioToolbox@0xd972 	
5 	AudioToolbox 	AudioToolbox@0xd6a4 	
6 	AudioToolbox 	AudioToolbox@0xd62a 	
7 	AudioToolbox 	AudioToolbox@0xdc03 	
8 	AudioToolbox 	AudioToolbox@0xd304 	
9 	libstdc++.6.dylib 	operator new[] 	
10 	AudioToolbox 	AudioToolbox@0xd609
...

Comment 1

[Jason Smith [:jsmith]]

Steps-wise, this is the same as bug 778745. The stack you are getting though doesn't tell me anything (which is strange...) and is different though. I'm going to link the two bugs up for now and review this is triage to determine if it's a dup or not.

Also, STR is the following:

1. Go to the gum page URL specified
2. Select audio and wait until it starts
3. Quit Firefox

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

I don't see the crash with your proposed steps. Would you mind to create a minimized testcase from the one referenced in the URL?

Comment 3

[Jason Smith [:jsmith]]

(In reply to Henrik Skupin (:whimboo) from comment #2)
> I don't see the crash with your proposed steps. Would you mind to create a
> minimized testcase from the one referenced in the URL?

Apparently that crash isn't happening anymore. The test case at the gum page is pretty minimal in what it's actually doing, so i don't think there's value to getting a minimized test case created. I'll try to reproduce it though.

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

There is. Once the test page gets changed we can loose the steps. But even for a crashtest we should reduce the code size as much as possible. Jason, on which platform are you on?

Comment 5

[Jason Smith [:jsmith]]

(In reply to Henrik Skupin (:whimboo) from comment #4)
> There is. Once the test page gets changed we can loose the steps. But even
> for a crashtest we should reduce the code size as much as possible. Jason,
> on which platform are you on?

No need to get overly concerned on this. Anant is in full sync and is on this team. I'll stick a local copy on this bug just in case.

Anyways - Can't reproduce it after trying a few video/audio combinations. Randell - Any ideas on what that crash stack means? Maybe that might help us figure out what's going on here.

Comment 6

[Jason Smith [:jsmith]]

Attachment: Gum Test Copy

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Without any further debugging output and lines it's hard to see. But is aBuffer safe to work with? If not we should check if the pointer is valid:

http://mxr.mozilla.org/mozilla-central/source/content/media/nsAudioStream.cpp#1184

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

Hard to tell without line numbers.  Likely it's a lifetime issue associated with not shutting things down (and waiting for them to be down) before destroying objects.

Comment 9

[Matthew Gregan [:kinetik]]

(In reply to Henrik Skupin (:whimboo) from comment #7)
> Without any further debugging output and lines it's hard to see. But is
> aBuffer safe to work with? If not we should check if the pointer is valid:

Yes, the callback should never be invoked with an invalid aBuffer.  If it is, the bug is higher up the callstack--the user callback is never expected to check that pointer for validity before using it.

Comment 10

[Randell Jesup [:jesup] (needinfo me)]

Retest once we have a reasonably clean shutdown

Comment 11

[Randell Jesup [:jesup] (needinfo me)]

Strongly believe after investigating bug 824359 that this is another signature of the same bug