Firefox crash in mp4_demuxer::MP4Demuxer::SeekVideo(__int64)

VERIFIED FIXED in Firefox 36

Status

()

defect
P1
critical
VERIFIED FIXED
4 years ago
4 years ago

People

(Reporter: marcia, Assigned: mattwoodrow)

Tracking

(Blocks 1 bug, {crash})

37 Branch
mozilla38
All
Windows 7
Points:
---
Bug Flags:
qe-verify +

Firefox Tracking Flags

(firefox36 verified, firefox37 verified, firefox38 verified, b2g-v2.2 fixed, b2g-master fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug was filed from the Socorro interface and is 
report bp-a18bb9d8-a450-418d-b627-f32662150113.
=============================================================

Seen while looking at nightly crash stats. This low volume crash occurs on Win 7, 8 and 10. Link to most recent crashes: https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::MP4Demuxer::SeekVideo%28__int64%29. Majority of URLs are all youtube.com


Frame 	Module 	Signature 	Source
0 	xul.dll 	mp4_demuxer::MP4Demuxer::SeekVideo(__int64) 	media/libstagefright/binding/mp4_demuxer.cpp
1 	xul.dll 	mozilla::MP4Reader::ResetDecode() 	dom/media/fmp4/MP4Reader.cpp
2 	xul.dll 	nsRunnableMethodImpl<tag_nsresult ( mozilla::net::CacheFileContextEvictor::*)(void), void, 1>::Run() 	xpcom/glue/nsThreadUtils.h
3 	xul.dll 	mozilla::MediaTaskQueue::Runner::Run() 	dom/media/MediaTaskQueue.cpp
4 	xul.dll 	nsThreadPool::Run() 	xpcom/threads/nsThreadPool.cpp
5 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
6 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
7 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
8 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
9 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
10 	xul.dll 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp
11 	nss3.dll 	PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
12 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
13 	msvcr120.dll 	_callthreadstartex 	f:\dd\vctools\crt\crtw32\startup\threadex.c:376
14 	msvcr120.dll 	_threadstartex 	f:\dd\vctools\crt\crtw32\startup\threadex.c:354
15 	kernel32.dll 	BaseThreadInitThunk 	
16 	ntdll.dll 	RtlUserThreadStart 	
17 	kernel32.dll 	BasepReportFault 	
18 	kernel32.dll 	BasepReportFault
mDemuxer must be nullptr for this to happen.

Looks like this could be the case if we get a call to ResetDecode before we've run ReadMetadata and created the demuxer.
Assignee: nobody → matt.woodrow
Attachment #8549151 - Flags: review?(ajones)
Comment on attachment 8549151 [details] [diff] [review]
Null check mDemuxer

Review of attachment 8549151 [details] [diff] [review]:
-----------------------------------------------------------------

Yep, my patch in bug 1119456 made us lazily initialize mDemuxer.
Attachment #8549151 - Flags: review?(ajones) → review+
https://hg.mozilla.org/mozilla-central/rev/674ba4e9ed25
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla38
Comment on attachment 8549151 [details] [diff] [review]
Null check mDemuxer

Approval Request Comment
[Feature/regressing bug #]: MSE
[User impact if declined]: Crashes playing video.
[Describe test coverage new/current, TBPL]: Laned on m-c.
[Risks and why]: Low. Straightforward null check unlikely to have side-effects.
[String/UUID change made/needed]: None.
Attachment #8549151 - Flags: approval-mozilla-beta?
Attachment #8549151 - Flags: approval-mozilla-aurora?
Attachment #8549151 - Flags: approval-mozilla-beta?
Attachment #8549151 - Flags: approval-mozilla-beta+
Attachment #8549151 - Flags: approval-mozilla-aurora?
Attachment #8549151 - Flags: approval-mozilla-aurora+
It appears there were some Mac crashes as well in this signature - https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::MP4Demuxer::SeekVideo%28long%20long%29

Adding that signature to the crash field.
Crash Signature: [@ mp4_demuxer::MP4Demuxer::SeekVideo(__int64)] → [@ mp4_demuxer::MP4Demuxer::SeekVideo(__int64)] [@ mp4_demuxer::MP4Demuxer::SeekVideo(long long)]
Flags: qe-verify+
No crash reports in Socorro after 2015-01-15 builds. Marking as verified.
You need to log in before you can comment on or make changes to this bug.