1005366 - crash with MSE in mozilla::dom::SourceBuffer::AppendData(unsigned char const*, unsigned int, mozilla::ErrorResult&)

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Nickolay_Ponomarev]

1. set media.mediasource.enabled=true
2. go to http://dash-mse-test.appspot.com/dash-player.html
3. select feelings_vp9
4. play
5. click on the video's slider to fast forward

crashes https://crash-stats.mozilla.com/report/index/343ddd64-d8eb-4325-8e4e-e4dc02140502 @  mozilla::dom::SourceBuffer::AppendData(unsigned char const*, unsigned int, mozilla::ErrorResult&) 

appears to be a simple typo, attempting to call a method on a NULL mDecoder:
http://mxr.mozilla.org/mozilla-central/source/content/media/mediasource/SourceBuffer.cpp
428     if (!mDecoder || mDecoderInit) {
429       MSE_DEBUG("%p AppendBuffer: New initialization segment, creating decoder.", this);
430       mDecoder->GetResource()->Ended();

Comment 1

[Jesse Ruderman]

Looks like bug 1002404 changed the if from (mDecoder) to (!mDecoder || ...). Was the negation intended?

https://hg.mozilla.org/mozilla-central/rev/b7be54db9ede#l1.40

Comment 2

[Jesse Ruderman]

Attachment: jesse's fuzz testcase

Comment 3

[Jesse Ruderman]

Attachment: jesse's stack

Comment 4

[Matthew Gregan [:kinetik]]

Attachment: p1: Minor tidy up of string use in content/media/mediasource.

Comment 5

[Matthew Gregan [:kinetik]]

Attachment: p2: Tighten up handling of SourceBuffer decoder resets.

Comment 6

[Matthew Gregan [:kinetik]]

p2 also adds Jesse's fuzz test, and moves the one existing MSE crash test into the (new) mediasource crashtest dir.

Comment 7

[Matthew Gregan [:kinetik]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/82ad7813f515
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/3c695f32262b

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/82ad7813f515
https://hg.mozilla.org/mozilla-central/rev/3c695f32262b

Comment 9

[Paul Silaghi, QA [:pauly]]

Reproduced in Nightly 2014-05-05.
Verified fixed FF 32.0a1 (2014-05-26), Win 7 x64