Closed Bug 774084 Opened 12 years ago Closed 12 years ago

crash in nsBuiltinDecoder::GetSeekable

Categories

(Core :: Audio/Video, defect)

15 Branch
All
Windows 7
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla17
Tracking Status
firefox15 --- verified
firefox16 --- verified

People

(Reporter: scoobidiver, Assigned: padenot)

References

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

It's #45 top browser crasher in 15.0a2.
It first appeared in 15.0a1/20120519. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e794cef56df6&tochange=642d1a36702f
It might be a regression from bug 754643.

Signature 	nsBuiltinDecoder::GetSeekable(nsTimeRanges*) More Reports Search
UUID	846f71b2-3652-4bfd-85cc-212992120714
Date Processed	2012-07-14 19:51:06
Uptime	13749
Last Crash	3.1 weeks before submission
Install Age	5.6 hours since version was first installed.
Install Time	2012-07-14 14:15:08
Product	Firefox
Version	16.0a1
Build ID	20120714030554
Release Channel	nightly
OS	Windows NT
OS Version	6.2.8400
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 050e1028, AdapterDriverVersion: 9.17.10.2736
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0df4, AdapterSubsysID2: 050e1028, AdapterDriverVersion2: 9.18.13.280D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0126
Total Virtual Memory	4294836224
Available Virtual Memory	3264307200
System Memory Use Percentage	43
Available Page File	11563372544
Available Physical Memory	4212248576

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsBuiltinDecoder::GetSeekable 	content/media/nsBuiltinDecoder.cpp:959
1 	xul.dll 	nsBuiltinDecoder::Seek 	content/media/nsBuiltinDecoder.cpp:311
2 	xul.dll 	nsHTMLMediaElement::SetCurrentTime 	content/html/content/src/nsHTMLMediaElement.cpp:1273
3 	xul.dll 	nsHTMLAudioElement::SetCurrentTime 	obj-firefox/dist/include/nsHTMLVideoElement.h:40
4 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
5 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2382
6 	xul.dll 	XPCWrappedNative::SetAttribute 	js/xpconnect/src/xpcprivate.h:2815
7 	xul.dll 	XPC_WN_GetterSetter 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1514
8 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:344
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsBuiltinDecoder%3A%3AGetSeekable%28nsTimeRanges*%29
Nearly every other use of mDecoderStateMachine in this file is guarded by a null check. It is missing in GetSeekable.
Blocks: 756372
Assignee: nobody → paul
Indeed we need to check if we still have a state machine, thanks.

Here is a patch.
Attachment #642399 - Flags: review?(kinetik)
Attachment #642399 - Flags: review?(kinetik) → review+
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a1325b95bd4

Given that this is a top crash and a regression in 15, we should try to get this on the branches as well.
Status: NEW → ASSIGNED
Crash Signature: [@ nsBuiltinDecoder::GetSeekable(nsTimeRanges*)] → [@ nsBuiltinDecoder::GetSeekable(nsTimeRanges*)] [@ nsBuiltinDecoder::GetSeekable]
Keywords: checkin-needed
Target Milestone: --- → mozilla17
Comment on attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 756372
User impact if declined: crashes when using HTML5 media
Testing completed (on m-c, etc.): tested locally
Risk to taking this patch (and alternatives if risky): extremely low, patch adds a simple null check
String or UUID changes made by this patch: none
Attachment #642399 - Flags: approval-mozilla-beta?
Attachment #642399 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/0a1325b95bd4
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Comment on attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

low risk, null check - approving for branches.
Attachment #642399 - Flags: approval-mozilla-beta?
Attachment #642399 - Flags: approval-mozilla-beta+
Attachment #642399 - Flags: approval-mozilla-aurora?
Attachment #642399 - Flags: approval-mozilla-aurora+
There are no crash reports with this signature on builds after August 12 in Socorro.
Hence, marking VERIFIED for Firefox 15 and 16.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.