Instacrash with fluid.bufpitch~ (possible buffer memory corruption?)

[rodrigo.constanzo]

So I’ve been getting frequent and fairly consistent crashes in a beta version of Max (which apparently is more verbose about memory funny business) and after thinking it was pointing at font-related things, it turns out there’s something going on with fluid.bufpitch~ and/or it’s handling of buffer~s.

As put by Ben elsewhere:

@benbracken

FWIW, I think the CEF errors are just noise, so that is probably a red herring. The crashes look like they are happening in the fluid.bufpitch~ object, actually now on my machine I get a crash that indicates memory corruption in buffer~. Wondering if this is bad usage of buffer in these objects/abstractions, or a more fundamental issue with buffer itself.

They’ve made a ticket for tracking a potential buffer~ itself, but I figured I’d flag it up here in case there’s something to be gleaned from these crash reports.

Here’s the spicy bit from one of mine:

Thread 0 Crashed:: JUCE Message Thread Dispatch queue: com.apple.main-thread
0   Chromium Embedded Framework   	       0x122884aac fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288876
1   Chromium Embedded Framework   	       0x122884aac fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288876
2   Chromium Embedded Framework   	       0x122884ac4 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288900
3   Chromium Embedded Framework   	       0x122884ae0 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288928
4   Chromium Embedded Framework   	       0x12288a454 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1311828
5   Chromium Embedded Framework   	       0x122887748 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1300296
6   Chromium Embedded Framework   	       0x122887300 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1299200
7   Chromium Embedded Framework   	       0x122895aa4 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1358500
8   Chromium Embedded Framework   	       0x12289d154 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1388884
9   fluid.bufpitch~               	       0x11de7aeb4 foonathan::memory::reference_storage<foonathan::memory::any_allocator>::basic_allocator<foonathan::memory::detail::lowlevel_allocator<foonathan::memory::detail::heap_allocator_impl>>::allocate_impl(unsigned long, unsigned long, unsigned long) + 56
10  fluid.bufpitch~               	       0x11de7bed4 std::__1::vector<double, foonathan::memory::std_allocator<double, fluid::FallbackAllocator>>::vector(unsigned long, foonathan::memory::std_allocator<double, fluid::FallbackAllocator> const&) + 68
11  fluid.bufpitch~               	       0x11de87fa8 fluid::client::pitch::PitchClient::PitchClient(fluid::client::ParameterSetView<fluid::client::ParameterDescriptorSet<std::__1::integer_sequence<unsigned long, 0ul, 0ul, 0ul, 0ul, 0ul, 0ul>, std::__1::tuple<std::__1::tuple<fluid::client::ChoicesT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FloatT, std::__1::tuple<fluid::client::impl::MinImpl<int>, fluid::client::impl::MaxImpl<int>, fluid::client::impl::UpperLimitImpl<3>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FloatT, std::__1::tuple<fluid::client::impl::MinImpl<int>, fluid::client::impl::MaxImpl<int>, fluid::client::impl::LowerLimitImpl<2>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FFTParamsT, std::__1::tuple<fluid::client::FFTParams::FFTSettingsConstraint>, fluid::client::Fixed<false>>>> const>&, fluid::client::FluidContext&) + 336
12  fluid.bufpitch~               	       0x11de7329c fluid::client::FluidMaxWrapper<fluid::client::NRTThreadingAdaptor<fluid::client::impl::NRTClientWrapper<fluid::client::impl::StreamingControl, fluid::client::pitch::PitchClient, fluid::client::ParameterDescriptorSet<std::__1::integer_sequence<unsigned long, 0ul, 0ul, 0ul, 0ul, 0ul, 5ul, 5ul, 7ul, 7ul, 7ul, 7ul, 7ul, 7ul>, std::__1::tuple<std::__1::tuple<fluid::client::InputBufferT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<fluid::client::impl::MinImpl<int>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<fluid::client::impl::MinImpl<int>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::BufferT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::ChoicesT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FloatT, std::__1::tuple<fluid::client::impl::MinImpl<int>, fluid::client::impl::MaxImpl<int>, fluid::client::impl::UpperLimitImpl<3>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FloatT, std::__1::tuple<fluid::client::impl::MinImpl<int>, fluid::client::impl::MaxImpl<int>, fluid::client::impl::LowerLimitImpl<2>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FFTParamsT, std::__1::tuple<fluid::client::FFTParams::FFTSettingsConstraint>, fluid::client::Fixed<false>>>> const, fluid::client::NRTPitchParams, 1ul, 1ul>>>::FluidMaxWrapper(symbol*, long, atom*) + 1356
13  fluid.bufpitch~               	       0x11de701b8 fluid::client::FluidMaxWrapper<fluid::client::NRTThreadingAdaptor<fluid::client::impl::NRTClientWrapper<fluid::client::impl::StreamingControl, fluid::client::pitch::PitchClient, fluid::client::ParameterDescriptorSet<std::__1::integer_sequence<unsigned long, 0ul, 0ul, 0ul, 0ul, 0ul, 5ul, 5ul, 7ul, 7ul, 7ul, 7ul, 7ul, 7ul>, std::__1::tuple<std::__1::tuple<fluid::client::InputBufferT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<fluid::client::impl::MinImpl<int>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<fluid::client::impl::MinImpl<int>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::LongT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::BufferT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::ChoicesT, std::__1::tuple<>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FloatT, std::__1::tuple<fluid::client::impl::MinImpl<int>, fluid::client::impl::MaxImpl<int>, fluid::client::impl::UpperLimitImpl<3>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FloatT, std::__1::tuple<fluid::client::impl::MinImpl<int>, fluid::client::impl::MaxImpl<int>, fluid::client::impl::LowerLimitImpl<2>>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::EnumT, std::__1::tuple<fluid::client::EnumT::EnumConstraint>, fluid::client::Fixed<false>>, std::__1::tuple<fluid::client::FFTParamsT, std::__1::tuple<fluid::client::FFTParams::FFTSettingsConstraint>, fluid::client::Fixed<false>>>> const, fluid::client::NRTPitchParams, 1ul, 1ul>>>::create(symbol*, long, atom*) + 56

Here’s a spicy bit from Ben’s:

Thread 0 Crashed:: CrBrowserMain Dispatch queue: com.apple.main-thread
0   Chromium Embedded Framework   	       0x116b18aac fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288876
1   Chromium Embedded Framework   	       0x116b18aac fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288876
2   Chromium Embedded Framework   	       0x116b18ac4 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288900
3   Chromium Embedded Framework   	       0x116b18ae0 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1288928
4   Chromium Embedded Framework   	       0x116b1e454 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1311828
5   Chromium Embedded Framework   	       0x116b1b748 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1300296
6   Chromium Embedded Framework   	       0x116b1b300 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1299200
7   Chromium Embedded Framework   	       0x116b29aec fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1358572
8   Chromium Embedded Framework   	       0x1168311d0 ChromeAppModeStart_v7 + 3916200
9   Chromium Embedded Framework   	       0x116b31154 fontations_ffi$cxxbridge1$BridgeBitmapGlyph$operator$sizeof + 1388884
10  libsystem_malloc.dylib        	       0x192e07748 _malloc_zone_malloc + 156
11  Max                           	       0x1027dd0b4 c74_debug_malloc + 248 (sysmem.c:483)
12  Max                           	       0x1027dcf74 sysmem_newptr_imp + 48 (sysmem.c:80)
13  Max                           	       0x10276bd58 sysmem_newptr + 24 (sysmem.c:101)
14  buffer~                       	       0x109bbd378 buffer_dosize_insamples + 412 (buffer~.c:3852)
15  Max                           	       0x1028147b4 defer + 72 (defer.c:77)
16  buffer~                       	       0x109bb5e70 buffer_sizeinsamps + 96 (buffer~.c:3808)
17  buffer~                       	       0x109bb7d00 buffer_setsizeinsamps + 112 (buffer~.c:3796)
18  Max                           	       0x10276b89c object_method_imp + 548 (obex.c:2113)
19  Max                           	       0x10277546c attr_args_process_impl + 804 (attribute_util.c:84)
20  Max                           	       0x102775604 attr_args_process + 44 (attribute_util.c:102)
21  buffer~                       	       0x109bb542c buffer_new + 1324 (buffer~.c:757)

In terms or reproducing the bug, I can do it consistently in the beta of Max, but not so much in the release version of Max 8.

I’ve not been able to narrow it down to a tiny patch, but if anyone would like to reproduce you need this package:

Archive.zip

Then open dk.controllermatch.maxhelp followed by dk.corpusconvolver~.maxhelp (audio on or off, doesn’t matter), and you’ll get an insta-crash with crash reports as above.

[weefuzzy]

Thanks. It’s not 100% clear that this is a fluid.bufpitch problem, but we can stay alert. I’m not on the beta programme for Max, and nothing bad is happening for me here on 8.6.4.

Do come at us with any updates though.

[rodrigo.constanzo]

Hmm, looking like there’s something else going on (as you suspect).

Still trying to narrow things down, but getting crashes like crazy. Will report back if I find anything untoward.

[tremblap]

Just a hunch: if Chromium is crashing, could it be gui-related? 9 deep in the crash stack, both from memory, I can imagine so many things, and I don’t have @weefuzzy or @a.harker wisdom of the alloc dances

[jamesbradbury]

Asked around a bit about this. CEF changed versions recently so it is maybe that, but CEF also runs an event loop of its own and shows up in a lot of crashes and may be unrelated.