Data abort on Sansa Clip+ with latest daily build

[Carlo]

This blue one is a 4 GB Clip+ with 2,5 GB Used.

Prefetch abort at b89ce088
FSR 0x3
(domain 0, fault 3)
pc: b89ce088
sp:300d46c8

Exact same .rockbox folder as the other four. As I wrote in the previous post, just skipping tracks as fast as possible triggers the bug.

[Bilgus]

I was finally able to reproduce it by this procedure

start player
goto files
choose new12 (14 files in folder) larger folder seem to be less likely to trigger

press select several times to get it to start the playback over a few times

skip tracks like mad

bam crash

[Carlo]

Let's hope fixing the bug will be easier than reproducing it.. I'm available for testing any potential bug fix.

[Bilgus]

As long as i can reproduce it i will eventually find it.. Thank you for the help so far

[Bilgus]

the problem (at least the one I'm currently reproducing) appears to have something to do with the scroll engine

I haven't quite got it figured out yet but if I disable scrolling or
in the informativebeauty.wps file disable the last line

Code: [Select]

#%s%al%?It<%Sx(Next:) %It|%?Fn<%Sx(Next:) %Fn|%Sx(End of Song List)>>the crashes cease, so its a clue as to whats happening but I've not got it totally figured out yet

[Frankenpod]

Is it definitely the scrolling or could it be the %Sx() translation function?
That used to cause themes to fall over if there was no translation for the given string.
Though it only made the theme fallback to default, not a crash, so perhaps this is something else?#
Does the phrase "End of Song List" definitely have a translated string available?

I wonder if changing the line to

#%s%al%?It<Next %It|%?Fn<Next %Fn|End of Song List>>

...so that it doesn't look for translations, would work?

[Carlo]

I can confirm that after commenting out the last line of \wps\informativebeauty.wps and reloading the theme the crash isn't reproducible anymore.

Edit: spoke too soon, as Bilgus said I'm getting freezes now instead of data aborts.

[Bilgus]

@Frankenpod

I had pushed a patch that made %Sx() fail gracefully a while back
the lang strings do exist

it won't outright dataabort without %Sx() but it will still hang
so might not be the scroll engine but IDK yet

[Bilgus]

IM still working on this...

So far i have it narrowed down to pulling data for the next_track
Its either a bad offset or a buffer overrun or something

Memsetting the whole chunk to 0 stops the crash so something's up
I just DONT know if the playlist chunking is the cause or just bringing exposing an existing bug

[Carlo]

No worries, take all the time you need. Thank you for your efforts.

Would it make sense to temporarily push playlist.c/.h from 5147 to master until you manage to pinpoint the exact issue? I've been running that build without any issue since you provided it.

[Bilgus]

Carlo could you try this build?
https://gerrit.rockbox.org/r/c/rockbox/+/5154

[Carlo]

Sure, I'm compiling it right now, will give you some feedback ASAP. Thanks.

[Carlo]

Zero crashes in more than three hours of usage, and it seems the bug isn't reproducible at all anymore.

[Bilgus]

I still don't know why this works I guess it might become apparent at some point given some more investigation

if you still haven't seen any crashes after a few days can you let me know and I'll push the patch
regardless

so far I've spent a bunch of time on this and clearing the allocated memory is the only thing that works
besides not freeing the buffer which isn't so great after several directories with lots of songs

I'm guessing something is asking for a string way out in the weeds but I've yet to find it...

[Carlo]

I can confirm build 5154 solved the issue, even if I'm aware that the real cause of the crashes still hasn't been identified. No crashes after almost ten hours of usage and countless attempts at reproducing the bug on different players.