Firefox crash in mp4_demuxer::MP4Demuxer::SeekVideo(__int64)

VERIFIED FIXED in Firefox 36

Status

()

defect
P1
critical
VERIFIED FIXED
5 years ago
4 years ago

People

(Reporter: marcia, Assigned: mattwoodrow)

Tracking

(Blocks 1 bug, {crash})

37 Branch
mozilla38
All
Windows 7
Points:
---
Dependency tree / graph
Bug Flags:
qe-verify +

Firefox Tracking Flags

(firefox36 verified, firefox37 verified, firefox38 verified, b2g-v2.2 fixed, b2g-master fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-a18bb9d8-a450-418d-b627-f32662150113.
=============================================================

Seen while looking at nightly crash stats. This low volume crash occurs on Win 7, 8 and 10. Link to most recent crashes: https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::MP4Demuxer::SeekVideo%28__int64%29. Majority of URLs are all youtube.com


Frame 	Module 	Signature 	Source
0 	xul.dll 	mp4_demuxer::MP4Demuxer::SeekVideo(__int64) 	media/libstagefright/binding/mp4_demuxer.cpp
1 	xul.dll 	mozilla::MP4Reader::ResetDecode() 	dom/media/fmp4/MP4Reader.cpp
2 	xul.dll 	nsRunnableMethodImpl<tag_nsresult ( mozilla::net::CacheFileContextEvictor::*)(void), void, 1>::Run() 	xpcom/glue/nsThreadUtils.h
3 	xul.dll 	mozilla::MediaTaskQueue::Runner::Run() 	dom/media/MediaTaskQueue.cpp
4 	xul.dll 	nsThreadPool::Run() 	xpcom/threads/nsThreadPool.cpp
5 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
6 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
7 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
8 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
9 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
10 	xul.dll 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp
11 	nss3.dll 	PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
12 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
13 	msvcr120.dll 	_callthreadstartex 	f:\dd\vctools\crt\crtw32\startup\threadex.c:376
14 	msvcr120.dll 	_threadstartex 	f:\dd\vctools\crt\crtw32\startup\threadex.c:354
15 	kernel32.dll 	BaseThreadInitThunk 	
16 	ntdll.dll 	RtlUserThreadStart 	
17 	kernel32.dll 	BasepReportFault 	
18 	kernel32.dll 	BasepReportFault
Assignee

Comment 1

5 years ago
mDemuxer must be nullptr for this to happen.

Looks like this could be the case if we get a call to ResetDecode before we've run ReadMetadata and created the demuxer.
Assignee: nobody → matt.woodrow
Attachment #8549151 - Flags: review?(ajones)
Comment on attachment 8549151 [details] [diff] [review]
Null check mDemuxer

Review of attachment 8549151 [details] [diff] [review]:
-----------------------------------------------------------------

Yep, my patch in bug 1119456 made us lazily initialize mDemuxer.
Attachment #8549151 - Flags: review?(ajones) → review+
https://hg.mozilla.org/mozilla-central/rev/674ba4e9ed25
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Comment on attachment 8549151 [details] [diff] [review]
Null check mDemuxer

Approval Request Comment
[Feature/regressing bug #]: MSE
[User impact if declined]: Crashes playing video.
[Describe test coverage new/current, TBPL]: Laned on m-c.
[Risks and why]: Low. Straightforward null check unlikely to have side-effects.
[String/UUID change made/needed]: None.
Attachment #8549151 - Flags: approval-mozilla-beta?
Attachment #8549151 - Flags: approval-mozilla-aurora?
Attachment #8549151 - Flags: approval-mozilla-beta?
Attachment #8549151 - Flags: approval-mozilla-beta+
Attachment #8549151 - Flags: approval-mozilla-aurora?
Attachment #8549151 - Flags: approval-mozilla-aurora+
It appears there were some Mac crashes as well in this signature - https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::MP4Demuxer::SeekVideo%28long%20long%29

Adding that signature to the crash field.
Crash Signature: [@ mp4_demuxer::MP4Demuxer::SeekVideo(__int64)] → [@ mp4_demuxer::MP4Demuxer::SeekVideo(__int64)] [@ mp4_demuxer::MP4Demuxer::SeekVideo(long long)]
Flags: qe-verify+
No crash reports in Socorro after 2015-01-15 builds. Marking as verified.
You need to log in before you can comment on or make changes to this bug.