View Issue Details

IDProjectCategoryView StatusLast Update
0000626OpenMPTGeneralpublic2015-01-23 15:54
Reporter404notfound Assigned ToSaga Musix  
PrioritynormalSeveritycrashReproducibilitysometimes
Status resolvedResolutionfixed 
Platformx86OSWindowsOS VersionXP
Product VersionOpenMPT 1.24.01.* (old testing) 
Target VersionOpenMPT 1.24.02.00 / libopenmpt 0.2-beta10 (upgrade first)Fixed in VersionOpenMPT 1.24.02.00 / libopenmpt 0.2-beta10 (upgrade first) 
Summary0000626: Mistery crash
Description

I leave Archon - SextyFour running in background and mpt locks up, looping whatever is in the sound buffer.

This happened twice. First time, I screencapped error window and took a .dmp.
Second time, I just killed process in task manager directly without saving anything.
It seemed to me like crash happened in about the same position in song playback(this is questionable).
After this, I was unable to reproduce crash.

Attached are the .dmp, screencap, and the tune(just in case).

OpenMPT 1.24.01.01-r4670 32 bit TEST
Build Date: 2014-12-21 19:24:07

Additional Information

I suspect this might be related to my shitty sound hardware/driver that was the actual source of trouble in report https://bugs.openmpt.org/view.php?id=576

TagsNo tags attached.
Attached Files
crash.zip (53,624 bytes)
Has the bug occurred in previous versions?
Tested code revision (in case you know it)

Activities

manx

manx

2014-12-30 11:06

administrator   ~0001891

I have no idea what's going wrong here. I added code that might aid debugging this to the current test versions.
The code is, however, disabled by default because it causes significant increase in memory consumption (about 30MB). Performance will not suffer in any measurable way.
Can you please grab a current test build (at least 1.24.01.03-r4685) and set the following settings (in the advanced settings tab):
Debug.TraceEnable=1
Debug.StopSoundDeviceOnCrash=0
You need to restart OpenMPT for the debug settings to take effect.
From now on, OpenMPT will, in case of a crash, additionally write a trace.log to the crash output directory.
When the crash happens again, please provide the trace.log in addition to the crash.dmp. This might help to further diagnose the problem.

404notfound

404notfound

2014-12-31 22:45

reporter   ~0001893

https://dl.dropboxusercontent.com/u/16644842/mpt/2015-01-01%2000.40.31.zip
Caught fucker.

manx

manx

2015-01-02 10:08

administrator   ~0001894

Has the error message displayed in the last crash you posted actually been the same as in the screenshot which you originally posted (i.e. "ASSERT(false) failed in [SoundDevice::CAudioThread::Deactivate]" or was it something different?
From the trace log, it does not seem so, thus i'm a bit confused now.
OpenMPT will now, from r4696 additionally on, just write out the error message to the crash directory as error.txt so you dont have to copy or screenshot it yourself anymore.

404notfound

404notfound

2015-01-02 18:01

reporter   ~0001895

The last crash didn't produce an error dialog, unlike first. It wrote dmp and log, opened the dump folder and closed app completely.

Or maybe I missed something...

404notfound

404notfound

2015-01-03 11:57

reporter   ~0001896

Last edited: 2015-01-03 12:04

https://dl.dropboxusercontent.com/u/16644842/mpt/2015-01-03%2013.49.17.zip
Caught another crash with the new version. This one locked up MPT instead of exiting cleanly and had to be nuked from taskman.

https://dl.dropboxusercontent.com/u/16644842/mpt/2015-01-03%2013.59.47.zip
Another, smaller log. This time, the app showed error dialog, then crashed and closed without taskman after clicking ok.

manx

manx

2015-01-04 09:43

administrator   ~0001897

So, it looks like I got mislead by the first error message which seemed to indicate problems with the sound device. The last two error messages you posted dont look like that. OpenMPT trying to shut down the sound device during a crash had originally just caused another crash.
Anyway, analysing these crashes requires debug information which we just did not retain for all test builds until very recently (r4697). Can you please try to reproduce this once again with the current version? Sorry for the inconvenience.

404notfound

404notfound

2015-01-04 12:36

reporter   ~0001898

I downloaded latest mptrack.exe and I still get r4696

manx

manx

2015-01-04 12:57

administrator   ~0001899

Oops, looks like our automation scripts got confused. Until I figure out what's wrong there, more current builds are available at http://buildbot.openmpt.org/builds/auto/openmpt-win32/ . It's just the -latest alias that is broken currently.

manx

manx

2015-01-04 13:33

administrator   ~0001900

The -latest builds are now updated correctly again.

404notfound

404notfound

2015-01-04 17:28

reporter   ~0001901

The bug senses our attempt to locate it in r4700 and won't come out to play anymore. Maybe if I write this, MPT will crash just to spite me.

404notfound

404notfound

2015-01-04 17:45

reporter   ~0001902

I'll leave a bunch of instances running overnight, playing song, for the hell of it.

404notfound

404notfound

2015-01-05 01:31

reporter   ~0001904

Almost 8 hours in and the 10 instances running have done nothing crashy. I shall go to bed and see next day. But I doubt results will be any different. But hey, who knows,

Maybe the mystery crash decided to fix itself.

404notfound

404notfound

2015-01-05 08:01

reporter   ~0001905

Nope.

404notfound

404notfound

2015-01-05 10:39

reporter   ~0001906

Last edited: 2015-01-05 14:00

Caught a stop of playback with frozen VU meters, but app didn't crash and it didn't produce anything :<.

EDIT:
Caught another. The playback doesn't stop(I was wrong), but the display stops being updated.
VUs get stuck and patterns don't scroll.
Pausing and playing fixes this.

I have a feeling this has replaced previous crashing.

EDIT:
Caught a proper crash, enjoy.
https://dl.dropboxusercontent.com/u/16644842/mpt/2015-01-05%2015.58.51.zip

manx

manx

2015-01-22 13:09

administrator   ~0001940

Sorry for following up late on this one.
The bug tracker just does not send out notification emails when you just edit a note instead of adding another one, so i had completely missed your newest crashdump until today. Sorry about that. Next time, please just add another note instead of editing a previous one.

OK, to the crash itself.

It looks like this is a crash in the mixing code.
The crash is at MixerInterface.h(90):


89: filter(outSample, c);
90: mix(outSample, c, outBuffer);
91: outBuffer += Traits::numChannelsOut;

which really does not tell much at all on its own.

I have not been able to reproduce this with a VisualStudio build myself at all.

However, openmpt123 built with clang address sanitizer gives the following:


manx@idefix ~/projects/openmpt/trunk-tmp $ bin/openmpt123 --quiet --filter 8 /home/manx/VirtualBox\ VMs/shared/archon_-_sextyfour.mod
ALSA lib pcm_dsnoop.c:618:(snd_pcm_dsnoop_open) unable to open slave
ALSA lib pcm_dmix.c:1022:(snd_pcm_dmix_open) unable to open slave
ALSA lib pcm.c:2239:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.rear
ALSA lib pcm.c:2239:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.center_lfe
ALSA lib pcm.c:2239:(snd_pcm_open_noupdate) Unknown PCM cards.pcm.side
bt_audio_service_open: connect() failed: Connection refused (111)
bt_audio_service_open: connect() failed: Connection refused (111)
bt_audio_service_open: connect() failed: Connection refused (111)
bt_audio_service_open: connect() failed: Connection refused (111)
ALSA lib pcm_dmix.c:1022:(snd_pcm_dmix_open) unable to open slave
Cannot connect to server socket err = No such file or directory
Cannot connect to server request channel
jack server is not running or cannot be started

==15186==ERROR: AddressSanitizer: heap-use-after-free on address 0x60800000b645 at pc 0x7f1d3d535690 bp 0x7fff18f32cd0 sp 0x7fff18f32cc8
READ of size 1 at 0x60800000b645 thread T0
#0 0x7f1d3d53568f in OpenMPT::PolyphaseInterpolation<OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul> >::operator()(int (&) [2], signed char const, int) /home/manx/projects/openmpt/trunk-tmp/soundlib/IntMixer.h:112:16
#1 0x7f1d3d53568f in void OpenMPT::SampleLoop<OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul>, OpenMPT::PolyphaseInterpolation<OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul> >, OpenMPT::NoFilter<OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul> >, OpenMPT::MixMonoRamp<OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul> > >(OpenMPT::ModChannel&, OpenMPT::CResampler const&, OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul>::output_t
, int) /home/manx/projects/openmpt/trunk-tmp/soundlib/MixerInterface.h:88
#2 0x7f1d3d47044a in OpenMPT::CSoundFile::CreateStereoMix(int) /home/manx/projects/openmpt/trunk-tmp/soundlib/Fastmix.cpp:444
0000003 0x7f1d3e083d3f in OpenMPT::CSoundFile::Read(unsigned int, OpenMPT::IAudioReadTarget&) /home/manx/projects/openmpt/trunk-tmp/soundlib/Sndmix.cpp:261
0000004 0x7f1d3e2c7c95 in openmpt::module_impl::read_wrapper(unsigned long, float, float, float, float) /home/manx/projects/openmpt/trunk-tmp/libopenmpt/libopenmpt_impl.cpp:399
0000005 0x7f1d3e2d5e8a in openmpt::module_impl::read(int, unsigned long, float, float) /home/manx/projects/openmpt/trunk-tmp/libopenmpt/libopenmpt_impl.cpp:663
0000006 0x7f1d3e2ab262 in openmpt::module::read(int, unsigned long, float, float) /home/manx/projects/openmpt/trunk-tmp/libopenmpt/libopenmpt_cxx.cpp:218
#7 0x4ec909 in void openmpt123::render_loop<float, openmpt::module>(openmpt123::commandlineflags&, openmpt::module&, double&, openmpt123::textout&, openmpt123::write_buffers_interface&) /home/manx/projects/openmpt/trunk-tmp/openmpt123/openmpt123.cpp:1043
0000008 0x4e5d0f in void openmpt123::render_mod_file<openmpt::module>(openmpt123::commandlineflags&, std::string const&, unsigned long, openmpt::module&, openmpt123::textout&, openmpt123::write_buffers_interface&) /home/manx/projects/openmpt/trunk-tmp/openmpt123/openmpt123.cpp:1390
0000009 0x4aeab4 in openmpt123::render_file(openmpt123::commandlineflags&, std::string const&, openmpt123::textout&, openmpt123::write_buffers_interface&) /home/manx/projects/openmpt/trunk-tmp/openmpt123/openmpt123.cpp:1470
0000010 0x4acdba in openmpt123::render_files(openmpt123::commandlineflags&, openmpt123::textout&, openmpt123::write_buffers_interface&) /home/manx/projects/openmpt/trunk-tmp/openmpt123/openmpt123.cpp:1513
0000011 0x49641a in openmpt123::main(int, char**) /home/manx/projects/openmpt/trunk-tmp/openmpt123/openmpt123.cpp:1935
0000012 0x49237a in main /home/manx/projects/openmpt/trunk-tmp/openmpt123/openmpt123.cpp:2011
0000013 0x7f1d3b7d5ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
0000014 0x49179c in _start (/home/manx/projects/openmpt/trunk-tmp/bin/openmpt123+0x49179c)

0x60800000b645 is located 37 bytes inside of 88-byte region [0x60800000b620,0x60800000b678)
freed by thread T6 (threaded-ml) here:
#0 0x47b539 in free (/home/manx/projects/openmpt/trunk-tmp/bin/openmpt123+0x47b539)
#1 0x7f1d39d9ed5e (/usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-4.0.so+0x10d5e)

previously allocated by thread T0 here:
#0 0x47b789 in calloc (/home/manx/projects/openmpt/trunk-tmp/bin/openmpt123+0x47b789)
#1 0x7f1d39d9eb0e (/usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-4.0.so+0x10b0e)

Thread T6 (threaded-ml) created by T0 here:
#0 0x46ab72 in pthread_create (/home/manx/projects/openmpt/trunk-tmp/bin/openmpt123+0x46ab72)
#1 0x7f1d39dd374c (/usr/lib/x86_64-linux-gnu/pulseaudio/libpulsecommon-4.0.so+0x4574c)

SUMMARY: AddressSanitizer: heap-use-after-free /home/manx/projects/openmpt/trunk-tmp/soundlib/IntMixer.h:112 OpenMPT::PolyphaseInterpolation<OpenMPT::IntToIntTraits<2, 1, int, signed char, 16ul> >::operator()(int (&) [2], signed char const*, int)
Shadow bytes around the buggy address:
0x0c107fff9670: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 04 fa
0x0c107fff9680: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 04 fa
0x0c107fff9690: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 06 fa
0x0c107fff96a0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 06 fa
0x0c107fff96b0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c107fff96c0: fa fa fa fa fd fd fd fd[fd]fd fd fd fd fd fd fa
0x0c107fff96d0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c107fff96e0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c107fff96f0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c107fff9700: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
0x0c107fff9710: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
==15186==ABORTING

The time during playback when this happens varies. It happened so far for all interpolation types except "none".

I currently do not think the use-after-free itself is particularly conclusive. Without having investigated any further, I'd guess that the mixer is trying to read a sample out of bounds for some reason, and at that address, memory had been allocated before.

Saga Musix

Saga Musix

2015-01-22 16:03

administrator   ~0001941

Last edited: 2015-01-22 16:04

I think I recently discovered the same crash with MSVC; when adding thousands of modules to Mod Library, it crashed mid-way on one module in the mixer, but I couldn't reproduce it with that module. Since it's random, I don't really think that the problem is in the mixer itself, since rendering is absolutely identical every time (at least for MOD, where you have no random volume and panning factors).

manx

manx

2015-01-23 10:56

administrator   ~0001942

Ok, i think i found the problem and fixed it in r4728.
When proper ProTracker-compatible sample change handling got introduced in r4223, some cases were missed which resulted in inconsistent sample pointers getting used, ultimately resulting in the buffer overflow causing the crash.
I"m still leaving the bug open and will wait for Saga Musix to comment on the solution as he is more familiar with the code in question than i am.

Saga Musix

Saga Musix

2015-01-23 15:54

administrator   ~0001943

Yup, the new implementation looks good to me.

Issue History

Date Modified Username Field Change
2014-12-29 10:23 404notfound New Issue
2014-12-29 10:23 404notfound File Added: crash.zip
2014-12-30 10:54 manx Assigned To => manx
2014-12-30 10:54 manx Status new => assigned
2014-12-30 11:06 manx Note Added: 0001891
2014-12-30 11:06 manx Status assigned => feedback
2014-12-31 22:45 404notfound Note Added: 0001893
2014-12-31 22:45 404notfound Status feedback => assigned
2015-01-02 10:08 manx Note Added: 0001894
2015-01-02 10:08 manx Status assigned => feedback
2015-01-02 18:01 404notfound Note Added: 0001895
2015-01-02 18:01 404notfound Status feedback => assigned
2015-01-03 11:57 404notfound Note Added: 0001896
2015-01-03 12:04 404notfound Note Edited: 0001896
2015-01-03 12:04 404notfound Note Edited: 0001896
2015-01-04 09:43 manx Note Added: 0001897
2015-01-04 09:43 manx Status assigned => feedback
2015-01-04 12:36 404notfound Note Added: 0001898
2015-01-04 12:36 404notfound Status feedback => assigned
2015-01-04 12:57 manx Note Added: 0001899
2015-01-04 12:57 manx Status assigned => feedback
2015-01-04 13:33 manx Note Added: 0001900
2015-01-04 17:28 404notfound Note Added: 0001901
2015-01-04 17:28 404notfound Status feedback => assigned
2015-01-04 17:45 404notfound Note Added: 0001902
2015-01-05 01:31 404notfound Note Added: 0001904
2015-01-05 08:01 404notfound Note Added: 0001905
2015-01-05 10:39 404notfound Note Added: 0001906
2015-01-05 13:52 404notfound Note Edited: 0001906
2015-01-05 13:54 404notfound Note Edited: 0001906
2015-01-05 14:00 404notfound Note Edited: 0001906
2015-01-22 13:09 manx Note Added: 0001940
2015-01-22 16:03 Saga Musix Note Added: 0001941
2015-01-22 16:04 Saga Musix Note Edited: 0001941
2015-01-23 10:56 manx Note Added: 0001942
2015-01-23 10:56 manx Assigned To manx => Saga Musix
2015-01-23 15:54 Saga Musix Note Added: 0001943
2015-01-23 15:54 Saga Musix Status assigned => resolved
2015-01-23 15:54 Saga Musix Resolution open => fixed
2015-01-23 15:54 Saga Musix Fixed in Version => OpenMPT 1.24.02.00 / libopenmpt 0.2-beta10 (upgrade first)
2015-01-23 15:54 Saga Musix Target Version => OpenMPT 1.24.02.00 / libopenmpt 0.2-beta10 (upgrade first)