AudioRenderThread panics when opening google

[tipowol]

nightly build from servo.org

 ~/Downloads/servo$ ./servo https://www.google.com
index out of bounds: the len is 1 but the index is 18446744073709551615 (thread AudioRenderThread, at /root/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/buffer_source_node.rs:405)
[2020-05-26T10:54:19Z ERROR servo] index out of bounds: the len is 1 but the index is 18446744073709551615

debug build from github (commit 7170a69)

~/code/tipowol/servo$ ./mach run https://www.google.com --dev
attempt to subtract with overflow (thread AudioRenderThread, at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/buffer_source_node.rs:405)
   0: servo::backtrace::print
             at /home/tipowol/code/tipowol/servo/ports/glutin/backtrace.rs:17
   1: servo::main::{{closure}}
             at /home/tipowol/code/tipowol/servo/ports/glutin/main2.rs:150
   2: std::panicking::rust_panic_with_hook
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/panicking.rs:481
   3: rust_begin_unwind
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/panicking.rs:385
   4: core::panicking::panic_fmt
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libcore/panicking.rs:89
   5: core::panicking::panic
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libcore/panicking.rs:52
   6: servo_media_audio::buffer_source_node::AudioBuffer::interpolate
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/buffer_source_node.rs:405
   7: <servo_media_audio::buffer_source_node::AudioBufferSourceNode as servo_media_audio::node::AudioNodeEngine>::process
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/buffer_source_node.rs:308
   8: servo_media_audio::graph::AudioGraph::process
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/graph.rs:436
   9: servo_media_audio::render_thread::AudioRenderThread::process
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/render_thread.rs:218
  10: servo_media_audio::render_thread::AudioRenderThread::event_loop
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/render_thread.rs:311
  11: servo_media_audio::render_thread::AudioRenderThread::start
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/render_thread.rs:159
  12: servo_media_audio::context::AudioContext::new::{{closure}}
             at /home/tipowol/.cargo/git/checkouts/media-c23a3cd5aa97076a/62cd58a/audio/context.rs:150
  13: std::sys_common::backtrace::__rust_begin_short_backtrace
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/sys_common/backtrace.rs:130
  14: std::thread::Builder::spawn_unchecked::{{closure}}::{{closure}}
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/thread/mod.rs:475
  15: <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/panic.rs:318
  16: std::panicking::try::do_call
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/panicking.rs:297
  17: __rust_try
  18: std::panicking::try
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/panicking.rs:274
  19: std::panic::catch_unwind
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/panic.rs:394
  20: std::thread::Builder::spawn_unchecked::{{closure}}
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/thread/mod.rs:474
  21: core::ops::function::FnOnce::call_once{{vtable.shim}}
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libcore/ops/function.rs:232
  22: <alloc::boxed::Box<F> as core::ops::function::FnOnce<A>>::call_once
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/liballoc/boxed.rs:1034
      <alloc::boxed::Box<F> as core::ops::function::FnOnce<A>>::call_once
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/liballoc/boxed.rs:1034
      std::sys::unix::thread::Thread::new::thread_start
             at /rustc/a74d1862d4d87a56244958416fd05976c58ca1a8/src/libstd/sys/unix/thread.rs:87
  23: start_thread
  24: __clone
[2020-05-26T10:56:20Z ERROR servo] attempt to subtract with overflow

[jdm]

This will likely be fixed by #26611.

[jdm]

Nevermind, that's a different panic stack but similar panic message. Maybe it's related to #26271 instead.

[tipowol]

After reverting commit servo/media@f5f10c4 I no longer have this problem when opening google.

[jdm]

cc @khodzha

[jdm]

The linear extrapolation looks like it can panic if pos is 0.

[camelid]

I don't have this on the latest Servo build on my Ubuntu VM.

Commit hash: bb80eb1da

The Google logo is off to the left, but no panics.

EDIT: I thought ./servo --version outputted the commit hash, but it seems that's not a valid commit. Either way, it's the latest nightly as of today

[jdm]

Aha, it might have been triggered by a special google doodle. That's frustrating.

[camelid]

I don't get the error on my Mac either by the way.

[camelid]

Time to look at the Google Doodle archives! Or I could try archive.org maybe

[camelid]

There doesn't seem to have been a Google Doodle when this bug happened! I tried https://web.archive.org/web/20200526105453/http://www.google.com/ in Servo, which is from the same time as the panic log report, and there was just the regular Google logo. It worked fine aside from a layout bug.

The only thing I can think of is that the timezones don't match.

[camelid]

Or, perhaps Archive.org is blocking the audio

[camelid]

Could we add an automated test to check for this?

[jdm]

we would have to work backwards from the code, but it definitely should be possible (also desirable).

[camelid]

Is it possible to have the CI run ./servo https://www.google.com as a test?

[jdm]

We could, but any tests where the content can change at any time are inherently risky and difficult to determine whether a PR is responsible for a new failure or not.

[tipowol]

jdm was right, it was doodle that day, so google doesn't crash now. I am able to reproduce same stack trace after manually starting doodle on: https://www.google.com/doodles/mothers-day-2020-nicaragua
commit hash: 1a6193703

[camelid]

Weirdly, when I go to that page, it still doesn't panic. Does yours panic every time or is it random?

Commit hash: 5dae012

[tipowol]

Panic occurred every time I tested. Today i tried also testing on VM, same results.

[camelid]

Hmm. What OS are you on?

[tipowol]

arch linux

[khodzha]

could you try again please compiling with servo-media from master? i (think i) fixed the error in BufferSourceNode

[atouchet]

This hasn't been updated in Servo yet.

[tipowol]

Servo crashes no more for me on google doodle, after compiling with the most recent servo/media.

[jdm]

It would be really great to create an automated test that reproduces the same issue without the change to servo/media.

[camelid]

What confuses me about this is that the issue was when the position was zero, but shouldn’t that happen at the beginning of every audio clip? Am I missing something?

[jdm]

Only for audiobuffersoucenode when the slow path in this code requires interpolation.