crash in mp4_demuxer::Moof::~Moof()

RESOLVED WORKSFORME

Status

()

Core
Audio/Video
P1
critical
RESOLVED WORKSFORME
4 years ago
3 years ago

People

(Reporter: marcia, Unassigned)

Tracking

(Blocks: 1 bug, {crash, regression})

37 Branch
x86
Windows NT
crash, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

This bug was filed from the Socorro interface and is 
report bp-e955bfd7-8309-48b3-9724-481d92141223.
=============================================================

Seen while reviewing crash stats. More reports are here: https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::Moof::~Moof%28%29

Crashes started showing up using 2014121700. Seems to affect Windows 6.x users - could something have regressed here? Almost all URLs are youtube.com.

Frame 	Module 	Signature 	Source
0 	xul.dll 	mp4_demuxer::Moof::~Moof() 	
1 	xul.dll 	nsTArray_Impl<mp4_demuxer::Moof, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned int, unsigned int) 	xpcom/glue/nsTArray.h
2 	xul.dll 	mp4_demuxer::MoofParser::~MoofParser() 	
3 	xul.dll 	mp4_demuxer::MoofParser::`scalar deleting destructor'(unsigned int) 	
4 	xul.dll 	mp4_demuxer::Index::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	mp4_demuxer::Index::Release() 	media/libstagefright/binding/include/mp4_demuxer/Index.h
6 	xul.dll 	mp4_demuxer::SampleIterator::`scalar deleting destructor'(unsigned int) 	
7 	xul.dll 	mp4_demuxer::StageFrightPrivate::~StageFrightPrivate() 	
8 	xul.dll 	mp4_demuxer::MP4Demuxer::~MP4Demuxer() 	media/libstagefright/binding/mp4_demuxer.cpp
9 	xul.dll 	mp4_demuxer::MP4Demuxer::`scalar deleting destructor'(unsigned int) 	
10 	xul.dll 	mozilla::MP4Reader::~MP4Reader() 	dom/media/fmp4/MP4Reader.cpp
11 	xul.dll 	mozilla::MP4Reader::`scalar deleting destructor'(unsigned int) 	
12 	xul.dll 	mozilla::MediaDecoderReader::Release() 	dom/media/MediaDecoderReader.h
13 	xul.dll 	mozilla::SourceBufferDecoder::BreakCycles() 	dom/media/mediasource/SourceBufferDecoder.h
14 	xul.dll 	mozilla::MediaSourceReader::BreakCycles() 	dom/media/mediasource/MediaSourceReader.cpp
15 	xul.dll 	mozilla::nsDecoderDisposeEvent::Run() 	dom/media/MediaDecoderStateMachine.cpp
16 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
17 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
18 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
19 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
20 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
21 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
22 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
23 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
24 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
25 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
26 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
27 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp
28 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
29 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
30 	kernel32.dll 	BaseThreadInitThunk 	
31 	ntdll.dll 	__RtlUserThreadStart 	
32 	ntdll.dll 	_RtlUserThreadStart
While reviewing crash stats I also see two other signatures which include the mp4_demuxer:

[@ mp4_demuxer::Index::GetEndCompositionIfBuffered(nsTArray<mozilla::MediaByteRange> const&) ]

[@ mp4_demuxer::SampleIterator::Get() ]

The signatures also seem to be Windows NT and youtube.com URLs.

Comment 2

4 years ago
(In reply to Marcia Knous [:marcia - use needinfo] from comment #1)
> While reviewing crash stats I also see two other signatures which include
> the mp4_demuxer

As mentioned in bug 1102612 comment #13, I saw multiple mp4/MSE-related signatures in the bold (significantly rising) first few entries of https://crash-analysis.mozilla.com/rkaiser/2014-12-21/2014-12-21.firefox.36.explosiveness.html - it's probably a good idea to make sure bugs are filed on all of that bunch.
ni on Bobby and Anthony to see if they have some insight into whether all of the crash stacks in Comment 1 are related. Anthony it looks like you touched some code in this stack as well - http://hg.mozilla.org/mozilla-central/annotate/b915a50bc6be/media/libstagefright/binding/include/mp4_demuxer/Index.h#l37
Flags: needinfo?(bobbyholley)
Flags: needinfo?(ajones)
Keywords: regression, regressionwindow-wanted
I'd like to get bug 1115749 landed and see if these persist.
Flags: needinfo?(bobbyholley)
Flags: needinfo?(ajones)
Priority: -- → P1
2014122600 was the last time I see in a crash in this stack, so I think maybe we can close this one out for now.
Keywords: regressionwindow-wanted
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.