448673 - [video] crash upon page reload

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

I was reloading a test page often that had a video playing (test4.html from doublec's test dir).  I hit this crash:

#0  0x11282e79 in nsNodeInfoManager::GetDocument (this=0xd8d8d8d8) at nsNodeInfoManager.h:117
#1  0x1152cd00 in nsINodeInfo::GetDocument (this=0xcd9730) at nsINodeInfo.h:291
#2  0x11285cc6 in nsINode::GetOwnerDoc (this=0x1d7cb450) at nsINode.h:265
#3  0x116adedd in nsHTMLMediaElement::DispatchProgressEvent (this=0x1d7cb450, aName=@0xbfffd884) at ../../../../../mozilla/content/html/content/src/nsHTMLMediaElement.cpp:736
#4  0x118aed23 in nsVideoDecoder::Progress (this=0x17423db0) at ../../../../../mozilla/content/media/video/src/nsVideoDecoder.cpp:157
#5  0x118aecd8 in ProgressCallback (aTimer=0x17422f30, aClosure=0x17423db0) at ../../../../../mozilla/content/media/video/src/nsVideoDecoder.cpp:149
#6  0x00342074 in nsTimerImpl::Fire (this=0x17422f30) at ../../../mozilla/xpcom/threads/nsTimerImpl.cpp:420
#7  0x003422a2 in nsTimerEvent::Run (this=0x1c828120) at ../../../mozilla/xpcom/threads/nsTimerImpl.cpp:510
#8  0x0033bc62 in nsThread::ProcessNextEvent (this=0x615eb0, mayWait=0, result=0xbfffda54) at ../../../mozilla/xpcom/threads/nsThread.cpp:510
#9  0x002c6466 in NS_ProcessPendingEvents_P (thread=0x615eb0, timeout=20) at nsThreadUtils.cpp:180
#10 0x12e819b3 in nsBaseAppShell::NativeEventCallback (this=0x639fe0) at ../../../../mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:121
#11 0x12e3d1d6 in nsAppShell::ProcessGeckoEvents (aInfo=0x639fe0) at ../../../../mozilla/widget/src/cocoa/nsAppShell.mm:302
#12 0x95f0e615 in CFRunLoopRunSpecific ()
#13 0x95f0ecf8 in CFRunLoopRunInMode ()
#14 0x96f75da4 in RunCurrentEventLoopInMode ()
#15 0x96f75bbd in ReceiveNextEventCommon ()
#16 0x96f75a31 in BlockUntilNextEventMatchingListInMode ()
#17 0x96769505 in _DPSNextEvent ()
#18 0x96768db8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#19 0x96761df3 in -[NSApplication run] ()
#20 0x12e3bc90 in nsAppShell::Run (this=0x639fe0) at ../../../../mozilla/widget/src/cocoa/nsAppShell.mm:591
#21 0x13912762 in nsAppStartup::Run (this=0x6551b0) at ../../../../../mozilla/toolkit/components/startup/src/nsAppStartup.cpp:181
#22 0x000b7841 in XRE_main (argc=4, argv=0xbfffefd8, aAppData=0x60da80) at ../../../mozilla/toolkit/xre/nsAppRunner.cpp:3186
#23 0x000027bb in main (argc=4, argv=0xbfffefd8) at ../../../mozilla/browser/app/nsBrowserApp.cpp:158


Looks like a race condition between the progress timer and document destruction?

Comment 1

[cajbir (:cajbir)]

Attachment: Fixes crash by removing a return statement introduced during debugging

The problem was indeed an issue with the progress timer. The timer was never being cancelled due to a return statement originally put in during development not being removed.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Pushed e91f143df8d6.