1121661 - Firefox crash in mp4_demuxer::MP4Demuxer::SeekVideo(__int64)

Status: VERIFIED FIXED

(Core :: Audio/Video, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-a18bb9d8-a450-418d-b627-f32662150113.
=============================================================

Seen while looking at nightly crash stats. This low volume crash occurs on Win 7, 8 and 10. Link to most recent crashes: https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::MP4Demuxer::SeekVideo%28__int64%29. Majority of URLs are all youtube.com


Frame 	Module 	Signature 	Source
0 	xul.dll 	mp4_demuxer::MP4Demuxer::SeekVideo(__int64) 	media/libstagefright/binding/mp4_demuxer.cpp
1 	xul.dll 	mozilla::MP4Reader::ResetDecode() 	dom/media/fmp4/MP4Reader.cpp
2 	xul.dll 	nsRunnableMethodImpl<tag_nsresult ( mozilla::net::CacheFileContextEvictor::*)(void), void, 1>::Run() 	xpcom/glue/nsThreadUtils.h
3 	xul.dll 	mozilla::MediaTaskQueue::Runner::Run() 	dom/media/MediaTaskQueue.cpp
4 	xul.dll 	nsThreadPool::Run() 	xpcom/threads/nsThreadPool.cpp
5 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
6 	xul.dll 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/glue/nsThreadUtils.cpp
7 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
8 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
9 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
10 	xul.dll 	nsThread::ThreadFunc(void*) 	xpcom/threads/nsThread.cpp
11 	nss3.dll 	PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
12 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
13 	msvcr120.dll 	_callthreadstartex 	f:\dd\vctools\crt\crtw32\startup\threadex.c:376
14 	msvcr120.dll 	_threadstartex 	f:\dd\vctools\crt\crtw32\startup\threadex.c:354
15 	kernel32.dll 	BaseThreadInitThunk 	
16 	ntdll.dll 	RtlUserThreadStart 	
17 	kernel32.dll 	BasepReportFault 	
18 	kernel32.dll 	BasepReportFault

Comment 1

[Matt Woodrow (:mattwoodrow)]

Attachment: Null check mDemuxer

mDemuxer must be nullptr for this to happen.

Looks like this could be the case if we get a call to ResetDecode before we've run ReadMetadata and created the demuxer.

Comment 2

[Bobby Holley (:bholley)]

Comment on attachment 8549151 [details] [diff] [review]
Null check mDemuxer

Review of attachment 8549151 [details] [diff] [review]:
-----------------------------------------------------------------

Yep, my patch in bug 1119456 made us lazily initialize mDemuxer.

Comment 3

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/674ba4e9ed25

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/674ba4e9ed25

Comment 5

[Ralph Giles (:rillian)]

Comment on attachment 8549151 [details] [diff] [review]
Null check mDemuxer

Approval Request Comment
[Feature/regressing bug #]: MSE
[User impact if declined]: Crashes playing video.
[Describe test coverage new/current, TBPL]: Laned on m-c.
[Risks and why]: Low. Straightforward null check unlikely to have side-effects.
[String/UUID change made/needed]: None.

Comment 6

[Marcia Knous [:marcia]]

It appears there were some Mac crashes as well in this signature - https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::MP4Demuxer::SeekVideo%28long%20long%29

Adding that signature to the crash field.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e2ca4b9c3d70
https://hg.mozilla.org/releases/mozilla-beta/rev/28900712c87f

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/e2ca4b9c3d70

Comment 9

[Petruta Horea [:phorea]]

No crash reports in Socorro after 2015-01-15 builds. Marking as verified.