2.2.2 - crash using Sliding Time Scale

[bigevilcorporation]

Version: Latest from source (17th December 2017, debug build) - also reproduced with 2.2.1 and 2.2.2
OS: Windows 10 Home (December Creator's Update)
Description: Crashes applying Sliding Time Scale so a short, mono, single track sample

To reproduce:
- Start with a fresh instance
- Generate a mono noise 0.3s in length
- Set project rate to 11025Hz
- Select all audio
- Effect -> Sliding Time/Pitch Shift
- Set Final Pitch Shift to 10%, click OK
- Crash

May take more than one attempt, possibly depends on uninitialised memory being in a particular state for the heap allocator to pick up on the problem.

Callstack:

Code: Select all

 	Audacity.exe!_sbsms_::SubBand::write(float[2] * inBuf, long n, float stretch, float pitch) Line 835	C++
 	Audacity.exe!_sbsms_::SBSMSImp::write(_sbsms_::SBSMSInterface * iface) Line 694	C++
 	Audacity.exe!_sbsms_::SBSMSImp::read(_sbsms_::SBSMSInterface * iface, float[2] * buf, long n) Line 733	C++
 	Audacity.exe!_sbsms_::SBSMS::read(_sbsms_::SBSMSInterface * iface, float[2] * buf, long n) Line 698	C++
 	Audacity.exe!postResampleCB(void * cb_data, _sbsms_::SBSMSFrame * data) Line 148	C++
 	Audacity.exe!_sbsms_::ResamplerImp::read(float[2] * audioOut, long samples) Line 109	C++
 	Audacity.exe!_sbsms_::Resampler::read(float[2] * audioOut, long samples) Line 103	C++
 	Audacity.exe!EffectSBSMS::Process() Line 402	C++
 	Audacity.exe!EffectTimeScale::Process() Line 192	C++
 	Audacity.exe!Effect::DoEffect(wxWindow * parent, double projectRate, TrackList * list, TrackFactory * factory, SelectedRegion * selectedRegion, bool shouldPrompt) Line 1226	C++
 	Audacity.exe!EffectManager::DoEffect(const wxString & ID, wxWindow * parent, double projectRate, TrackList * list, TrackFactory * factory, SelectedRegion * selectedRegion, bool shouldPrompt) Line 110	C++
 	Audacity.exe!AudacityProject::OnEffect(const wxString & ID, int flags) Line 4349	C++
 	Audacity.exe!PluginFunctor<AudacityProject>::operator()(int __formal, const wxEvent * __formal) Line 112	C++
 	Audacity.exe!CommandManager::HandleCommandEntry(const CommandListEntry * entry, CommandFlag flags, CommandFlag mask, const wxEvent * evt) Line 1473	C++
 	Audacity.exe!CommandManager::HandleMenuID(int id, CommandFlag flags, CommandFlag mask) Line 1487	C++
 	Audacity.exe!AudacityProject::OnMenu(wxCommandEvent & event) Line 2341	C++

The cause seems to be a memory trash from the memmove() in ArrayRingBuffer<T>::advance() (in a debug build, observe log output for allocator warning, compute address offset from 'rb.buf' and set a hardware breakpoint next run), since:

Code: Select all

endPos = writePos+N;

extends beyond the allocated buffer. I don't know what N is supposed to represent in this context (advancing a ringbuffer ptr), it's modified outside of the ringbuffer interface in a sea of single-character variables and no comments.

The new ringbuffer approach was introduced in commit e45c780 (16th April 2012).

[waxcylinder]

To reproduce:
- Start with a fresh instance
- Generate a mono noise 0.3s in length
- Set project rate to 11025Hz
- Select all audio
- Effect -> Sliding Time/Pitch Shift
- Set Final Pitch Shift to 10%, click OK
- Crash

May take more than one attempt, possibly depends on uninitialised memory being in a particular state for the heap allocator to pick up on the problem.

Hmmm so it does ... (good catch)

My first run - on 2.2.2 on Windows 10 Home (December Creator's Update) ran through just fine. As second attempt immediately after cause a crash.

I'll hang on a bit before logging this bug to see what the other Forum elves think.

And thankyou for your analysis (above my head I'm afraid butI'm sure it may help one of the devs).

WC

[steve]

I'm able to reproduce the issue if I add an extra step:

- Start with a fresh instance
- Generate a mono noise 0.3s in length
- Set project rate to 11025Hz
Tracks > Resample -> 11025
- Select all audio
- Effect -> Sliding Time/Pitch Shift
- Set Final Pitch Shift to 10%, click OK
- Crash

Backtrace attached:

[waxcylinder]

I can reproduce this on my Macbook Pro under macOS 10.13.2 High Sierra

a) it needs Steve's extra step to get the failure

b) as with my Windows test it ran OK on first pass - and crashed on second use

WC

[waxcylinder]

Looged as P1 (due to crash) Bug #1808: http://bugzilla.audacityteam.org/show_bug.cgi?id=1808

Peter

[Paul L]

Good news -- we have found a fix. Next release will have it.

Meantime I recommend that you use pitch shift with this effect, only if the track has 44100 sample rate. You may want to resample up, apply the effet, and resample down again.

[steve]

No need to resample down again. The exported file will be at the sample rate of the "project rate" (bottom left corner of the main Audacity window)

[Paul L]

2.2.2 Beta is available and includes the fix for this.