1031532 - Crash with DASH video and MSE enabled

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Benjamin Smedberg]

Omega reported in bug 1031121 that he was experimenting with the youtube dash videos, and when he turned on MSE, he experienced crash bp-4053477d-79b0-4acd-9d56-c063e2140627.

This is a null-pointer exception at http://hg.mozilla.org/mozilla-central/annotate/be076357691c/content/media/mediasource/SourceBufferResource.h#l112 within SourceBufferResource::ResourceQueue::GetLength.

Filing separately from that bug so we can track the crash and the frame-rate issues separately.

Comment 1

[Matthew Gregan [:kinetik]]

Just hit this on Linux while seeking on a DASH-enabled YouTube video (Titanfall video from bug 1031121): bp-e4bd8ec7-e212-4ec4-95fe-f0e3c2140715

Comment 2

[Matthew Gregan [:kinetik]]

Looks like a threading issue, GetLength() is trying to iterate over items in an nsDeque and crashing inside a for-loop bounded on the nsDeque's GetSize() with a null pointer, suggesting the size of the nsDeque changed.

Evict() removes items from the nsDeque, and is called mainly by SourceBuffer::Append* which is called on the main thread.  Both of these crash signatures are on the decoder thread while waiting for data in a SourceBuffer.

Comment 3

[Matthew Gregan [:kinetik]]

Attachment: Hold the SourceBufferResource monitor during eviction.

Comment 4

[Matthew Gregan [:kinetik]]

Attachment: p1: Tighten up public interface of SourceBufferResource::ResourceQueue.

Make a bunch of ResourceQueue functions private and remove some that are
unused.

Comment 5

[Matthew Gregan [:kinetik]]

Attachment: p2: Hold the SourceBufferResource monitor during eviction.

Comment 6

[Matthew Gregan [:kinetik]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/cc69e484c0e1
https://hg.mozilla.org/integration/mozilla-inbound/rev/73300964c510

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cc69e484c0e1
https://hg.mozilla.org/mozilla-central/rev/73300964c510