Bugzilla

We evict data when we're trying to append but that append would put us over a [threshold](https://searchfox.org/mozilla-central/rev/9bb55ae4d808fc48afcf93f99da6a685265b86c6/dom/media/mediasource/TrackBuffersManager.cpp#109-112). In these cases the eviction task is queued and processed as in the stack track in comment 1.

This is proving hard to catch in a debugger again, but noted that when the issue took place that the buffered ranges were empty, but the track buffer had several thousand frames in it. All of the frames that I inspecred had `mTime` and `mDuration` 0 -- which looks like the result of something going wrong, though I'm not sure what.

I suspect there is a race somewhere between eviction and other removal of frames, combined with something odd this site is doing to trigger a bug where we remove frames and clear buffered ranges, but fail to clear our buffers.

I think I can mitigate the immediate crash, and I can add some asserts to try and track the bug where we're removing the buffered ranges while retaining data in buffers.

Note on how we appear to be arriving at the crash: we evict data when we're trying to append but that append would put us over a [threshold](https://searchfox.org/mozilla-central/rev/9bb55ae4d808fc48afcf93f99da6a685265b86c6/dom/media/mediasource/TrackBuffersManager.cpp#109-112). In these cases the eviction task is queued and processed as in the stack track in comment 1.

This is proving hard to catch in a debugger again, but noted that when the issue took place that the buffered ranges were empty, but the track buffer had several thousand frames in it. All of the frames that I inspecred had `mTime` and `mDuration` 0 -- which looks like the result of something going wrong, though I'm not sure what.

I suspect there is a race somewhere between eviction and other removal of frames, combined with something odd this site is doing to trigger a bug where we remove frames and clear buffered ranges, but fail to clear our buffers.

I think I can mitigate the immediate crash, and I can add some asserts to try and track the bug where we're removing the buffered ranges while retaining data in buffers.