Bug 64299

Could you provide a backtrace with gdb? This[1] wiki page has some information for how to get the backtrace, but it doesn't mention that you also need to have the debug symbols installed for pulseaudio, and in this case also for alsa-lib (a.k.a. libasound). It's distribution specific how debug symbols are provided, and I don't know how Arch does it (Debian based distros provide packages with -dbg suffix, such as pulseaudio-dbg and libpulse0-dbg). One way to make the debug symbols available is to install pulseaudio and alsa-lib from source.

[1] http://www.freedesktop.org/wiki/Software/PulseAudio/Documentation/User/Community

Arch currently does not provide debug packages, although there are some
debug repos planed.

The easiest way to get debug symbols is to rebuild pulseaudio
with ABS (arch build system) [1].

Just disable the strip option and enable the debug option in /etc/makepkg.config and rebuild the package with makepkg and you should be good to go.

[1] https://wiki.archlinux.org/index.php/ABS

I have compiled PA from git in order to debug the problem, however I can't reproduce the issue now... Maybe it's already solved in git. I'll keep trying though.

Closing this for now. Please reopen if you see this again (with a backtrace, if possible).

What version of alsa-lib do you have? I just hit this one.

pulseaudio: pcm.c:2731: snd_pcm_area_copy: Assertion `dst < src || dst >= src + bytes' failed.

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffed5b5700 (LWP 27410)]
0x00007ffff4389209 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
(gdb) bt
#0  0x00007ffff4389209 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff438a720 in __GI_abort () at abort.c:90
#2  0x00007ffff43821db in __assert_fail_base (fmt=0x7ffff44c17c8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=0x7fffed6bbc48 "dst < src || dst >= src + bytes", file=<optimized out>, line=<optimized out>, function=<optimized out>) at assert.c:92
#3  0x00007ffff4382283 in __GI___assert_fail (assertion=0x7fffed6bbc48 "dst < src || dst >= src + bytes", file=0x7fffed6bf02d "pcm.c", line=2731, 
    function=0x7fffed6bca50 <__PRETTY_FUNCTION__.12828> "snd_pcm_area_copy") at assert.c:101
#4  0x00007fffed6607c0 in snd_pcm_area_copy (format=<optimized out>, samples=<optimized out>, src_offset=<optimized out>, src_area=0x7fffed5b4c20, 
    dst_offset=<optimized out>, dst_area=0x7fffed5b4c30) at pcm.c:2731
#5  snd_pcm_area_copy (dst_area=0x7fffed5b4c30, dst_offset=<optimized out>, src_area=0x7fffed5b4c20, src_offset=<optimized out>, samples=<optimized out>, 
    format=<optimized out>) at pcm.c:2708
#6  0x00007fffed660985 in snd_pcm_areas_copy (dst_areas=0x7cf2b0, dst_offset=22896, src_areas=0x7cf2b0, src_offset=22480, channels=2, frames=5133, 
    format=SND_PCM_FORMAT_S16_LE) at pcm.c:2877
#7  0x00007fffed69e24a in snd_pcm_softvol_write_areas (pcm=0x6f6a10, areas=<optimized out>, offset=<optimized out>, size=5133, slave_areas=0x7cf290, 
    slave_offset=22896, slave_sizep=0x7fffed5b4d48) at pcm_softvol.c:607
#8  0x00007fffed66fe86 in snd_pcm_plugin_mmap_commit (pcm=0x6f6a10, offset=<optimized out>, size=5133) at pcm_plugin.c:424
#9  0x00007fffed918b63 in mmap_write (on_timeout=false, polled=false, sleep_usec=<synthetic pointer>, u=0x6e5070) at ../../src/modules/alsa/alsa-sink.c:647
#10 thread_func (userdata=0x6e5070) at ../../src/modules/alsa/alsa-sink.c:1734
#11 0x00007ffff6cc3ef8 in internal_thread_func (userdata=0x6f9830) at ../../src/pulsecore/thread-posix.c:83
#12 0x00007ffff4708f15 in start_thread (arg=0x7fffed5b5700) at pthread_create.c:308
#13 0x00007ffff44427bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Here's another alsa softvol crash, doesn't look like the same bug, though: https://bugs.freedesktop.org/show_bug.cgi?id=51060

My alsa-lib version is 1.0.27 according to the package manager.

(In reply to comment #5)
> What version of alsa-lib do you have? I just hit this one.
> 
> pulseaudio: pcm.c:2731: snd_pcm_area_copy: Assertion `dst < src || dst >=
> src + bytes' failed.
> 
> Program received signal SIGABRT, Aborted.
> [Switching to Thread 0x7fffed5b5700 (LWP 27410)]
> 0x00007ffff4389209 in __GI_raise (sig=6) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:56
> 56	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
> (gdb) bt
> #0  0x00007ffff4389209 in __GI_raise (sig=6) at
> ../nptl/sysdeps/unix/sysv/linux/raise.c:56
> #1  0x00007ffff438a720 in __GI_abort () at abort.c:90
> #2  0x00007ffff43821db in __assert_fail_base (fmt=0x7ffff44c17c8 "%s%s%s:%u:
> %s%sAssertion `%s' failed.\n%n", 
>     assertion=0x7fffed6bbc48 "dst < src || dst >= src + bytes",
> file=<optimized out>, line=<optimized out>, function=<optimized out>) at
> assert.c:92
> #3  0x00007ffff4382283 in __GI___assert_fail (assertion=0x7fffed6bbc48 "dst
> < src || dst >= src + bytes", file=0x7fffed6bf02d "pcm.c", line=2731, 
>     function=0x7fffed6bca50 <__PRETTY_FUNCTION__.12828> "snd_pcm_area_copy")
> at assert.c:101
> #4  0x00007fffed6607c0 in snd_pcm_area_copy (format=<optimized out>,
> samples=<optimized out>, src_offset=<optimized out>,
> src_area=0x7fffed5b4c20, 
>     dst_offset=<optimized out>, dst_area=0x7fffed5b4c30) at pcm.c:2731
> #5  snd_pcm_area_copy (dst_area=0x7fffed5b4c30, dst_offset=<optimized out>,
> src_area=0x7fffed5b4c20, src_offset=<optimized out>, samples=<optimized
> out>, 
>     format=<optimized out>) at pcm.c:2708


> #6  0x00007fffed660985 in snd_pcm_areas_copy (dst_areas=0x7cf2b0,
> dst_offset=22896, src_areas=0x7cf2b0, src_offset=22480, channels=2,
> frames=5133, 
>     format=SND_PCM_FORMAT_S16_LE) at pcm.c:2877

In frame #6 src_areas == dst_areas (but offset is different), and 22896-22480 = 416 < 5133, which is overlapping!

> #7  0x00007fffed69e24a in snd_pcm_softvol_write_areas (pcm=0x6f6a10,
> areas=<optimized out>, offset=<optimized out>, size=5133,
> slave_areas=0x7cf290, 
>     slave_offset=22896, slave_sizep=0x7fffed5b4d48) at pcm_softvol.c:607

Here slave_areas is 0x7cf290, but dst_areas in frame #6 should be the same as slave_areas in frame #7!


> #8  0x00007fffed66fe86 in snd_pcm_plugin_mmap_commit (pcm=0x6f6a10,
> offset=<optimized out>, size=5133) at pcm_plugin.c:424
> #9  0x00007fffed918b63 in mmap_write (on_timeout=false, polled=false,
> sleep_usec=<synthetic pointer>, u=0x6e5070) at
> ../../src/modules/alsa/alsa-sink.c:647
> #10 thread_func (userdata=0x6e5070) at
> ../../src/modules/alsa/alsa-sink.c:1734
> #11 0x00007ffff6cc3ef8 in internal_thread_func (userdata=0x6f9830) at
> ../../src/pulsecore/thread-posix.c:83
> #12 0x00007ffff4708f15 in start_thread (arg=0x7fffed5b5700) at
> pthread_create.c:308
> #13 0x00007ffff44427bd in clone () at
> ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Hi,

After much code reading, I came with something that *might* be a fix, and it's been accepted into alsa-lib:

http://git.alsa-project.org/?p=alsa-lib.git;a=commitdiff;h=f2d39afe6139ab16aa2aeea0f51f32db79ab1262

Could you please try it and see if it resolves the problem for you?

(In reply to comment #9)
> Hi,
> 
> After much code reading, I came with something that *might* be a fix, and
> it's been accepted into alsa-lib:
> 
> http://git.alsa-project.org/?p=alsa-lib.git;a=commitdiff;
> h=f2d39afe6139ab16aa2aeea0f51f32db79ab1262
> 
> Could you please try it and see if it resolves the problem for you?

The same bug happened for me on Debian sid with libasound 1.0.27. It was happening really often when volume was changing.

After testing alsa-libs from git (sha1 d20e24e) which include your patch, the problem is solved.

I discovered a way to hit the bug fast (skipping video with audio in smplayer2 using the arrow keys) and I confirm that after testing alsa-lib from git, the bug is fixed.

Thanks for the testing!