1141241 - crash in mozilla::MFTDecoder::SendMFTMessage(_MFT_MESSAGE_TYPE, unsigned long)

Status: VERIFIED FIXED

(Core :: Audio/Video, defect, P1)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-dfe4cc80-eceb-437e-bae9-66a9f2150309.
=============================================================

Top frames:
0 	xul.dll 	mozilla::MFTDecoder::SendMFTMessage(_MFT_MESSAGE_TYPE, unsigned long) 	dom/media/fmp4/wmf/MFTDecoder.cpp
1 	xul.dll 	mozilla::WMFMediaDataDecoder::ProcessDrain() 	dom/media/fmp4/wmf/WMFMediaDataDecoder.cpp
2 	xul.dll 	nsRunnableMethodImpl<void ( mozilla::crashreporter::LSPAnnotationGatherer::*)(void), void, 1>::Run() 	xpcom/glue/nsThreadUtils.h
3 	xul.dll 	mozilla::MediaTaskQueue::Runner::Run() 	dom/media/MediaTaskQueue.cpp
[...]

This is the #9 crash in 37.0b3 when only looking at crashes with URLs containing "yahoo.com".

All of those seem to be EXCEPTION_ACCESS_VIOLATION_READ at address	0x2c and happening (probably as expected) on Win7 and higher only.

Comment 1

[Marcia Knous [:marcia]]

Almost all the URLs I see in the URL field are youtube.com.

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

Kairo: Can you extract some URLs where this repros?

Comment 3

[Sheila Mooney]

There were a couple of comments in crash stats about YouTube as well.

Comment 4

[Marcia Knous [:marcia]]

Total Count 	URL
11 	https://www.facebook.com/
7 	https://www.youtube.com/watch?v=09R8_2nJtjg
5 	https://www.youtube.com/watch?v=zX8nZI8U9XY
4 	https://www.youtube.com/watch?v=7vlYJpBQDk0
4 	http://www.roblox.com/Mad-Paintball-streams-place?id=186976759
4 	https://www.youtube.com/watch?v=kFan8qpqZn0
3 	https://www.youtube.com/watch?v=uJUy7FfKjC8
3 	https://www.youtube.com/watch?v=vSEU1Fqt1E4
3 	https://www.youtube.com/watch?v=8FlQYl42uPg
3 	https://www.youtube.com/watch?v=P4WkUBvDWls
3 	https://www.youtube.com/watch?v=QHH_f8AxjH8
3 	https://www.youtube.com/watch?v=Fc0QmDnNy3U
3 	http://www.tycsports.com/noticias/La-insolita-simulacion-de-Oleksandr-Noyok-20150304-0012.html
3 	https://www.youtube.com/watch?v=TQN1Lsmp7Us
2 	http://www.e-earphone.jp/shopdetail/000000056114/036/P/page1/recommend/
2 	https://www.youtube.com/watch?v=89eghfyIA7M
2 	https://www.youtube.com/watch?v=RDxQPRnIMdA
2 	http://www.youtube.com/watch?v=PmGGZcbKCDU
2 	https://www.youtube.com/watch?v=a7LHo3-ufAk
2 	http://vk.com/videos186900992?z=video186900992_166688630%2Falbum186900992
2 	https://www.youtube.com/watch?v=uILpic9Gxcs
2 	https://www.youtube.com/watch?v=EbxpsraPDws
2 	https://www.youtube.com/watch?v=vSEU1Fqt1E4&feature=related
2 	https://www.youtube.com/watch?v=jMf08TXWRNs
2 	https://www.youtube.com/watch?v=Se1y2R5QRKU
2 	https://video.search.yahoo.com/video/play;_ylt=A0LEVigbKv5U8bcAUg0lnIlQ;_ylu=X3oDMTBsa3ZzMnBvBHNlYwNzYwRjb2xvA2JmMQR2dGlkAw--?p=youtube&tnr=21&vid=D4913D8265B4C87E7F74D4913D8265B4C87E7F74&l=297&turl=http%3A%2F%2Fts2.mm.bing.net%2Fth%3Fid%3DUN.607999578128
2 	https://www.youtube.com/watch?v=xxg8NRpohrY
2 	https://www.youtube.com/watch?v=WxPl3vhA9so
2 	https://www.youtube.com/watch?v=Ibwpc5AuOpU

Comment 5

[Marcia Knous [:marcia]]

https://crash-stats.mozilla.com/report/list?signature=mozilla::MFTDecoder::SendMFTMessage%28_MFT_MESSAGE_TYPE,%20unsigned%20long%29 links to all crashes. Volume in B3 so far is 141 crashes.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Null pointer deref looks like.

Comment 7

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch: Simple nullcheck

Simple null check...

Comment 8

[Chris Pearce [:cpearce (Not reading bugmail)]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3f483283a086

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3f483283a086

Comment 10

[Chris Pearce [:cpearce (Not reading bugmail)]]

Ralph, this needs uplift for MSE, can you take care of that?

Comment 11

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 8575773 [details] [diff] [review]
Patch: Simple nullcheck

Approval Request Comment
[Feature/regressing bug #]: MSE
[User impact if declined]: This is the #9 top crash in 37b3. So user impact is crashes.
[Describe test coverage new/current, TreeHerder]: We don't know how to repro, so can't really write a test.
[Risks and why]: Low risk, just adds a nullcheck
[String/UUID change made/needed]: None.

Comment 12

[Ralph Giles (:rillian)]

You beat me to it.

Comment 13

[Lawrence Mandel [:lmandel] (use needinfo)]

Comment on attachment 8575773 [details] [diff] [review]
Patch: Simple nullcheck

Given that we can't repro and have very few reports on Aurora and none on Nightly, I think we're going to have to prove this one on Beta. Given that it is a simple null check, I think we should test in Beta 5. Beta+ Aurora+

Comment 14

[Chris Pearce [:cpearce (Not reading bugmail)]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9f3f281f26d2

Comment 15

[Chris Pearce [:cpearce (Not reading bugmail)]]

https://hg.mozilla.org/releases/mozilla-beta/rev/18ecbc81b0e4

Comment 16

[Petruta Horea [:phorea], Desktop Test Engineering]

There are no crashes in Socorro after the fix landed.