Closed Bug 1602724 Opened 4 years ago Closed 2 years ago

Crash in [@ arena_t::DallocSmall | free | audiounit_setup_stream]

Categories

(Core :: Audio/Video: cubeb, defect, P2)

Desktop
macOS
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox-esr68 --- affected
firefox71 --- affected
firefox72 --- affected
firefox73 --- unaffected

People

(Reporter: bmaris, Assigned: chunmin)

References

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-3aadf722-40bf-470b-91a0-87ecc0191210.

Top 10 frames of crashing thread:

0 libmozglue.dylib arena_t::DallocSmall memory/build/mozjemalloc.cpp:3257
1 libmozglue.dylib free memory/build/malloc_decls.h:54
2 XUL audiounit_setup_stream media/libcubeb/src/cubeb_audiounit.cpp:2558
3 CoreAudio HALC_ProxyObjectMap::ReleaseObject 
4 CoreAudio HALB_Mutex::Locker::~Locker 
5 CoreAudio AudioObjectGetPropertyData 
6 CoreAudio HALB_Mutex::Lock 
7 XUL audiounit_stream_init media/libcubeb/src/cubeb_audiounit.cpp:2802
8 XUL cubeb_stream_init media/libcubeb/src/cubeb.c:335
9 XUL XUL@0x250b93f 

Prerequisites

  • Headset without microphone
  • MacBook with 10.14 or 10.15

Steps to reproduce

  1. Join a room from https://talky.io (must have two people in the room)
  2. Disconnect headphones
  3. Reconnect headphones
  4. Click mute icon button (mute button from the one that is using the headphones and macbook)
  5. Click the same icon to unmute (unmute by clicking the mute icon from the one that is using the headphones and macbook)

Notes

Priority: -- → P2

(In reply to Bogdan Maris [:bogdan_maris], Release Desktop QA from comment #0)

Thanks for the report! Would you mind uploading the about:support data in Firefox here?

  1. Enter about:support in URL bar
  2. Click copy raw data and past it to a text file
  3. Upload the text file here

Prerequisites

  • Headset without microphone

Is this a USB headset or a headset with a 3.5mm Jack plug ?

Steps to reproduce

Unfortunately, I am unable to reproduce this problem in Firefox Nightly. I use a speaker-only headset with a 3.5mm Jack plug to do this test. This headset is plugged in my Macbook and set as the default output device before running the following steps.

  1. Join a room from https://talky.io (must have two people in the room)

I create a talky a room from another device and then join that room on my MacBook. The devices used on the MacBook are

  • speaker: default output device, which is a speaker-only headset with a 3.5mm Jack plug
  • camera: built-in camera on the MacBook
  • microphone: built-in microphone on the MacBook
  1. Disconnect headphones

Do you mean unplug the headset here?

  1. Reconnect headphones

Do you mean plug the headset here? Does this headphone become the default output device again (Does the headphone produce sound again)?

  1. Click mute icon button (mute button from the one that is using the headphones and macbook)
  2. Click the same icon to unmute (unmute by clicking the mute icon from the one that is using the headphones and macbook)

There three mute icons I can see. One is for the microphone, and one for the speaker and you could also find one(speaker icon) next to the tab title. I tried mute and then unmute all of these icons, but I am unable to reproduce it.

Are the steps above the same as what you did?

BTW, What version of Firefox you test? Does this happen in Firefox Nightly as well?

Flags: needinfo?(bogdan.maris)

I am taking for now to see if I can reproduce this.

Assignee: nobody → cchang
Attached file about support raw.txt

(In reply to C.M.Chang[:chunmin] from comment #1)

(In reply to Bogdan Maris [:bogdan_maris], Release Desktop QA from comment #0)

Thanks for the report! Would you mind uploading the about:support data in Firefox here?

  1. Enter about:support in URL bar
  2. Click copy raw data and past it to a text file
  3. Upload the text file here

I've uploaded the raw version of about:support.

Prerequisites

  • Headset without microphone

Is this a USB headset or a headset with a 3.5mm Jack plug ?

The headset is one with 3.5mm jack plug without microphone (Sennheiser HD201 or Philips SHP2000)

Steps to reproduce

Unfortunately, I am unable to reproduce this problem in Firefox Nightly. I use a speaker-only headset with a 3.5mm Jack plug to do this test. This headset is plugged in my Macbook and set as the default output device before running the following steps.

Unfortunately I did not reproduce the crash on Nightly as well, see below for more details.

  1. Join a room from https://talky.io (must have two people in the room)

I create a talky a room from another device and then join that room on my MacBook. The devices used on the MacBook are

  • speaker: default output device, which is a speaker-only headset with a 3.5mm Jack plug
  • camera: built-in camera on the MacBook
  • microphone: built-in microphone on the MacBook

I have the same except that for output I have "Headphones - Headphone port" which is to be expected

  1. Disconnect headphones

Do you mean unplug the headset here?

Yes, remove the 3.5mm jack of the headset from MacBook.

  1. Reconnect headphones

Do you mean plug the headset here? Does this headphone become the default output device again (Does the headphone produce sound again)?

Yes, plug back in the headset. Yes, the default output is "Headphones" when plugged in, switches to Internal Speaker when unplugged, switches again to "Headphones" when plugged in and no sound can be heard after that.

  1. Click mute icon button (mute button from the one that is using the headphones and macbook)
  2. Click the same icon to unmute (unmute by clicking the mute icon from the one that is using the headphones and macbook)

There three mute icons I can see. One is for the microphone, and one for the speaker and you could also find one(speaker icon) next to the tab title. I tried mute and then unmute all of these icons, but I am unable to reproduce it.

After more testing I discovered that toggling the microphone option is not required, just unplug -> plug -> wait a bit -> crash.

Are the steps above the same as what you did?

BTW, What version of Firefox you test? Does this happen in Firefox Nightly as well?

I've reproduced on 72.0b4 and 72.0b5 on two different MacBooks with 10.14 and 10.15.
I tried with latest Nightly 73.0a1 but I it did not crash, I encountered one of these three results here:

  1. After reconnecting (re-plug) the headphones, no sound can be heard for about 20-30 seconds, then it works again
  2. After reconnecting the headphones, no sound can be heard for more then 1 minute (I did not wait longer then this, maybe it does work again after this interval)
  3. After reconnecting the headphones the sound comes back right away.

bp-a260d592-4a22-4026-979d-23f240191212
bp-9a8c8090-b2e6-497e-a702-583c00191212
bp-4e19ffd2-dc9f-40bf-bee6-3c7050191212
bp-8b3d0251-ab39-40f1-ad00-432e70191212
bp-d2559097-8a08-4463-b136-345dd0191212
bp-9b920720-c770-4c36-990a-334bf0191212
bp-c4e6d479-ea44-480c-9bf9-c10920191212 (crash reproduced without toggling microphone option)

Let me know if there are more information I can provide here.

Flags: needinfo?(bogdan.maris)

Also I got a similar crash signature, adding it here as well. (@huge_dalloc | free | audiounit_setup_stream)

Crash Signature: [@ arena_t::DallocSmall | free | audiounit_setup_stream] → [@ arena_t::DallocSmall | free | audiounit_setup_stream] [@ huge_dalloc | free | audiounit_setup_stream]
Flags: needinfo?(cchang)

I am still unable to reproduce this.

Bogdan, can you help me to test the following things?

  1. Test if this happens in one audio backend only, in Firefox Nightly (Firefox Nightly uses a new audio backend)
    • Open about:config in Firefox Nightly
    • Delete the the media.cubeb.backend (media.cubeb.backend will be blank) or set it to audiounit
    • See it the problem can be reproduce
  2. Get the log of audio backend when running the test in Firefox (current release version)
    • Launch Terminal
    • Launch the Firefox by this command: MOZ_LOG="cubeb:5" /Applications/Firefox.app/Contents/MacOS/firefox
    • You will see something like [Child 2562: MediaDecoderStateMachine #1]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:2448: (0x19ee37600) Opening output side: rate 48000, channels 2, format 2, latency in frames 512. in the Terminal
    • Do the step that will make Firefox crash (comment 0)
    • Copy the log on the Terminal and paste or upload it to here (the log can help us to identify where it goes wrong)
  3. Test the problem with different device
    • Test with the 3.5mm jack headset with microphone to see if Firefox still crashes
    • Test with a USB headset. If this USB headset has microphone, then select MacBook's built-in microphone when joining the talky room
Flags: needinfo?(cchang) → needinfo?(bogdan.maris)

From those reports, the crash is in audiounit_create_aggregate_device and the reason is MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?) in mozjemalloc.cpp.

I don't know why audiounit_create_aggregate_device hit the assertions in mozjemalloc.cpp. audiounit_create_aggregate_device doesn't use *alloc uor free directly. The *alloc and free stuff in gecko will allocate or deallocate the memory by mozjemalloc.cpp, but audiounit_create_aggregate_device only use the MacOSX system API to create or destroy object. Those audio system APIs we used are dynamic libraries.

The crashes happen when the MediaStreamGraph switches drivers. Not sure if it's related.

I did not forgot about this, I'm just way to busy right now, hopefully I can get some time next week and investigate further. I'll leave the needinfo as a reminder.

See Also: → 1602722

(In reply to C.M.Chang[:chunmin] from comment #5)

I am still unable to reproduce this.

Bogdan, can you help me to test the following things?

  1. Test if this happens in one audio backend only, in Firefox Nightly (Firefox Nightly uses a new audio backend)
    • Open about:config in Firefox Nightly
    • Delete the the media.cubeb.backend (media.cubeb.backend will be blank) or set it to audiounit
    • See it the problem can be reproduce

I disabled media.cubeb.backend but I could not reproduce the issue on Latest Nightly 73.0a1.

  1. Get the log of audio backend when running the test in Firefox (current release version)
    • Launch Terminal
    • Launch the Firefox by this command: MOZ_LOG="cubeb:5" /Applications/Firefox.app/Contents/MacOS/firefox
    • You will see something like [Child 2562: MediaDecoderStateMachine #1]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:2448: (0x19ee37600) Opening output side: rate 48000, channels 2, format 2, latency in frames 512. in the Terminal
    • Do the step that will make Firefox crash (comment 0)
    • Copy the log on the Terminal and paste or upload it to here (the log can help us to identify where it goes wrong)

The log is huge (13+MB in size) unfortunately, I've attached it to Mozilla Gdrive: https://drive.google.com/open?id=1R8sWmT6hF9rAEYYy5TzymxuZZDVLPdFs

  1. Test the problem with different device
    • Test with the 3.5mm jack headset with microphone to see if Firefox still crashes
    • Test with a USB headset. If this USB headset has microphone, then select MacBook's built-in microphone when joining the talky room

I've tested with MEMT T5 earphones (with mic) and I could also reproduce the crash https://crash-stats.mozilla.org/report/index/2ed2a594-a024-4e75-a03d-adf1d0191230
I've tested with a USB headset but I could not reproduce no matter how much I've tried. And yes the microphone was set as build-in, only output (audio) was set on UBS headset.

Let me know if there is you need me to investigate things further.

Flags: needinfo?(bogdan.maris) → needinfo?(cchang)

(In reply to Bogdan Maris [:bogdan_maris], Release Desktop QA from comment #8)

  1. Get the log of audio backend when running the test in Firefox (current release version)
    • Launch Terminal
    • Launch the Firefox by this command: MOZ_LOG="cubeb:5" /Applications/Firefox.app/Contents/MacOS/firefox
    • You will see something like [Child 2562: MediaDecoderStateMachine #1]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:2448: (0x19ee37600) Opening output side: rate 48000, channels 2, format 2, latency in frames 512. in the Terminal
    • Do the step that will make Firefox crash (comment 0)
    • Copy the log on the Terminal and paste or upload it to here (the log can help us to identify where it goes wrong)

The log is huge (13+MB in size) unfortunately, I've attached it to Mozilla Gdrive: https://drive.google.com/open?id=1R8sWmT6hF9rAEYYy5TzymxuZZDVLPdFs

Thanks, that helps a lot.

The first error appears when setting the new created aggregate device to the current device of the new AudioUnit (code here)

...
[Child 635: Unnamed thread 0x10b45da10]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:1710: Add devices input 49 and output 39 into aggregate device 128
[Child 635: Unnamed thread 0x10b45da10]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:2104: AudioUnitSetProperty/kAudioOutputUnitProperty_CurrentDevice rv=-10851
[Child 635: Unnamed thread 0x10b45da10]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:2577: (0x11a1d9200) AudioUnit creation for input failed.
[Child 635: Unnamed thread 0x10b45da10]: E/cubeb /builds/worker/workspace/build/src/media/libcubeb/src/cubeb_audiounit.cpp:838: (0x11a1d9200) Stream reinit failed.
...

The error is kAudioUnitErr_InvalidPropertyValue (-10851), which means

The property is valid, but the value of the property being provided is not

by its definition.

That is, the AudioDeviceID of the new created aggregate device is invalid when it is being set to the new AudioUnit's current device. I guess the reason is the new aggregate device is not fully initialized at that time.

This problem is fixed in the Rust backend but we have not yet port this to the C backend. It's the same problem noted here. That can explain why it doesn't happen in Firefox Nightly with default media.cubeb.backend setting (audiounit-rust). (But this bug should be reproducible if media.cubeb.backend is audiounit or (empty).)

Flags: needinfo?(cchang)
Component: WebRTC → Audio/Video: cubeb

Closing because no crashes reported for 12 weeks.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.