Closed Bug 1754877 Opened 3 years ago Closed 3 years ago

Crash in [@ memcpy | audioipc2_server::server::data_cb_c]

Categories

(Core :: Audio/Video: cubeb, defect, P3)

Firefox 98
All
Windows 10
defect

Tracking

()

RESOLVED FIXED
Tracking Status
firefox-esr91 --- unaffected
firefox97 --- unaffected
firefox98 --- wontfix
firefox99 --- fixed

People

(Reporter: kinetik, Assigned: kinetik)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/a7e3db86-fe92-42a0-a726-8c2d30220210

Reason: EXCEPTION_ACCESS_VIOLATION_WRITE

Top 10 frames of crashing thread:

0 vcruntime140.dll memcpy d:\a01\_work\4\s\src\vctools\crt\vcruntime\src\string\amd64\memcpy.asm:338
1 xul.dll audioipc2_server::server::data_cb_c third_party/rust/audioipc2-server/src/server.rs:838
2 xul.dll passthrough_resampler<float>::fill media/libcubeb/src/cubeb_resampler.cpp:110
3 xul.dll `anonymous namespace'::refill media/libcubeb/src/cubeb_wasapi.cpp:870
4 xul.dll `anonymous namespace'::refill_callback_output media/libcubeb/src/cubeb_wasapi.cpp:1256
5 xul.dll `anonymous namespace'::wasapi_stream_render_loop media/libcubeb/src/cubeb_wasapi.cpp:1394
6 ucrtbase.dll thread_start<unsigned int , 1> 
7 kernel32.dll BaseThreadInitThunk 
8 mozglue.dll patched_BaseThreadInitThunk toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:572
9 ntdll.dll RtlUserThreadStart 
Has Regression Range: --- → yes

Crash after write attempted at 0x2540b9f1260. The buffer we're writing to is owned by the OS's WASAPI API, which informed us the buffer is at least 3840 bytes; the buffer's base address is 0x2540b9f1240... so the failing write offset is 32 bytes from the buffer base pointer. IIUC we have an exclusive lease on that buffer until we release it back to WASAPI, so it should not be deallocated underneath us - but that seems to be the cause of this crash.

One crash only on 98, beta, marking as fix-optional for this version.

The fixes in bug 1757473 should address this crash.

Depends on: 1757473

Resolving as fixed based no crash reports in 99 since the depends on bug 1757473 landed

Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.