1102998 - Specific video file crashes ESR31

Status: RESOLVED DUPLICATE of bug 1090405

(Core :: Audio/Video, defect)

Description

[Paul Adenot (:padenot)]

http://www.krautchan.net/download/1416427206002.webm/SHUT-IT-DOWN.webm

Comment 1

[Paul Adenot (:padenot)]

Debian bug, this is on iceweasel: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770490

Comment 2

[Nils Dagsson Moskopp]

Attachment: video file that crashes firefox

Comment 3

[Nils Dagsson Moskopp]

(gdb) continue
Continuing.
[New Thread 0x932fcb40 (LWP 13657)]
[New Thread 0x92afbb40 (LWP 13658)]
[Thread 0x9cfffb40 (LWP 13610) exited]
[Thread 0x9eb9fb40 (LWP 13606) exited]
[New Thread 0x9eb9fb40 (LWP 13659)]
[New Thread 0x9cfffb40 (LWP 13660)]
[Thread 0x932fcb40 (LWP 13657) exited]
[New Thread 0x925ffb40 (LWP 13661)]
[New Thread 0x91dfeb40 (LWP 13662)]
[New Thread 0x915fdb40 (LWP 13663)]
[New Thread 0x90dfcb40 (LWP 13664)]
[New Thread 0x905fbb40 (LWP 13665)]
[New Thread 0x9a26fb40 (LWP 13666)]
[New Thread 0x9a22cb40 (LWP 13667)]
[New Thread 0x932fcb40 (LWP 13668)]
[New Thread 0x9793cb40 (LWP 13669)]
[New Thread 0x96e65b40 (LWP 13670)]
[New Thread 0x96e44b40 (LWP 13671)]
[New Thread 0x8f3ffb40 (LWP 13672)]
[New Thread 0x8ebfeb40 (LWP 13673)]
[New Thread 0x8e3fdb40 (LWP 13674)]
[Thread 0x932fcb40 (LWP 13668) exited]
[New Thread 0x96e23b40 (LWP 13675)]
[New Thread 0x8d4ffb40 (LWP 13676)]
[Thread 0x8ebfeb40 (LWP 13673) exited]
[Thread 0x9eb9fb40 (LWP 13659) exited]
[New Thread 0x932fcb40 (LWP 13677)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x96e65b40 (LWP 13670)]
mozalloc_abort (msg=0x96e64eba "out of memory: 0x00000000FFFFFFFF bytes requested")
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/memory/mozalloc/mozalloc_abort.cpp:30
30	/build/iceweasel-JlTf0H/iceweasel-31.2.0esr/memory/mozalloc/mozalloc_abort.cpp: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  mozalloc_abort (
    msg=0x96e64eba "out of memory: 0x00000000FFFFFFFF bytes requested")
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/memory/mozalloc/mozalloc_abort.cpp:30
#1  0xb77a028c in mozalloc_handle_oom (size=0)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/memory/mozalloc/mozalloc_oom.cpp:50
#2  0xb779fecd in moz_xmalloc (size=4294967295)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/memory/mozalloc/mozalloc.cpp:54
#3  0xb431af26 in operator new [] (size=<optimized out>)
    at ../../../dist/include/mozilla/mozalloc.h:213
#4  mozilla::WebMReader::DecodeAudioPacket (this=0x9e0c5000, aPacket=0x98acd7f0, 
    aOffset=68757)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/content/media/webm/WebMReader.cpp:690
#5  0xb431b3ef in mozilla::WebMReader::DecodeAudioData (this=0x9e0c5000)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/content/media/webm/WebMReader.cpp:826
#6  0xb42d1f83 in mozilla::MediaDecoderStateMachine::DecodeAudio (this=0xab69ecc0)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/content/media/MediaDecoderStateMachine.cpp:680
#7  0xb42cbc50 in nsRunnableMethodImpl<void (mozilla::MediaDecoderStateMachine::*)(), void, true>::Run (this=0x9e066820) at ../../dist/include/nsThreadUtils.h:387
#8  0xb42e1271 in mozilla::MediaTaskQueue::Runner::Run (this=0x98da0750)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/content/media/MediaTaskQueue.cpp:127
#9  0xb35ab1dd in nsThreadPool::Run (this=0x9d3b18d0)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/xpcom/threads/nsThreadPool.cpp:211
#10 0xb35a8ab0 in nsThread::ProcessNextEvent (this=0xab1f7ef0, mayWait=true, 
    result=0x96e651fb)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/xpcom/threads/nsThread.cpp:715
#11 0xb355d196 in NS_ProcessNextEvent (thread=<optimized out>, mayWait=true)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/xpcom/glue/nsThreadUtils.cpp:263
#12 0xb376f918 in mozilla::ipc::MessagePumpForNonMainThreads::Run (this=0x9a175d90, 
    aDelegate=0x9d43a860)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/ipc/glue/MessagePump.cpp:336
#13 0xb375f445 in MessageLoop::RunInternal (this=0x9d43a860)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/ipc/chromium/src/base/message_loop.cc:229
#14 0xb375f594 in RunHandler (this=0x9d43a860)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/ipc/chromium/src/base/message_loop.cc:222
#15 MessageLoop::Run (this=0x9d43a860)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/ipc/chromium/src/base/message_loop.cc:196
#16 0xb35a95e4 in nsThread::ThreadFunc (arg=0xab1f7ef0)
    at /build/iceweasel-JlTf0H/iceweasel-31.2.0esr/xpcom/threads/nsThread.cpp:316
#17 0xb2b62ba5 in _pt_root (arg=0x98ecc800) at ptthread.c:212
#18 0xb7769efb in start_thread () from /lib/i386-linux-gnu/i686/cmov/libpthread.so.0
#19 0xb7546d4e in clone () from /lib/i386-linux-gnu/i686/cmov/libc.so.6
(gdb)

Comment 4

[Nils Dagsson Moskopp]

Gentoo Patch <http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/www-client/firefox/files/firefox-31.0-webm-disallow-negative-samples.patch?view=markup>

Comment 5

[Nils Dagsson Moskopp]

Gentoo Bug Report <https://bugs.gentoo.org/show_bug.cgi?id=527010>

Comment 6

[Nils Dagsson Moskopp]

Related bug <https://bugzilla.mozilla.org/show_bug.cgi?id=1090405>

Comment 7

[Daniel Veditz [:dveditz]]

We checked in the Gentoo patch on ESR31 for bug 1090405. Hate to "dupe forward", but that's where the patching took place.