Closed Bug 1148286 Opened 8 years ago Closed 8 years ago

[EME] Crash when replaying EME content after EME disabled


(Core :: Audio/Video, defect, P1)

Windows 8.1



Tracking Status
firefox38 --- fixed
firefox39 --- fixed
firefox40 --- fixed


(Reporter: cpearce, Assigned: cpearce)


(Blocks 2 open bugs)



(1 file)


1. Open
2. Press "Play"
3. Disable EME in options menu
4. Press "Play" again.


Main thread:

 	xul.dll!mozilla::BlockingResourceBase::CheckAcquire() Line 271	C++
 	xul.dll!mozilla::OffTheBooksMutex::Lock() Line 382	C++
 	xul.dll!mozilla::CDMCaps::AutoLock::AutoLock(mozilla::CDMCaps & aInstance) Line 47	C++
 	xul.dll!mozilla::MediaSourceDecoder::SetCDMProxy(mozilla::CDMProxy * aProxy) Line 314	C++
>	xul.dll!mozilla::dom::HTMLMediaElement::FinishDecoderSetup(mozilla::MediaDecoder * aDecoder, mozilla::MediaResource * aStream, nsIStreamListener * * aListener, mozilla::MediaDecoder * aCloneDonor) Line 2793	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::LoadResource() Line 1225	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::SelectResource() Line 878	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::SelectResourceWrapper() Line 830	C++
 	xul.dll!mozilla::dom::nsSyncSection::Run() Line 752	C++
 	xul.dll!nsBaseAppShell::RunSyncSectionsInternal(bool aStable, unsigned int aThreadRecursionLevel) Line 372	C++
 	xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr, bool mayWait, unsigned int recursionDepth) Line 312	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 830	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 140	C++
 	xul.dll!MessageLoop::RunInternal() Line 233	C++
 	xul.dll!MessageLoop::RunHandler() Line 227	C++
 	xul.dll!MessageLoop::Run() Line 201	C++
 	xul.dll!nsBaseAppShell::Run() Line 166	C++
 	xul.dll!nsAppShell::Run() Line 180	C++
 	xul.dll!nsAppStartup::Run() Line 282	C++
 	xul.dll!XREMain::XRE_mainRun() Line 4202	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 4278	C++
 	xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags) Line 4498	C++
 	firefox.exe!do_main(int argc, char * * argv, nsIFile * xreDirectory) Line 294	C++
 	firefox.exe!NS_internal_main(int argc, char * * argv) Line 667	C++
 	firefox.exe!wmain(int argc, wchar_t * * argv) Line 124	C++
 	[External Code]	

Looks like we're referencing release memory.
Priority: -- → P1
We terminate the CDM when we disable EME, and the testcase is unaware of this and tried to re-use the same MediaKeys object. This patch just adds null checks and rejects promises returned by MediaKeys after the CDM dies.
Attachment #8586489 - Flags: review?(edwin)
Must remember to uplift.
Flags: needinfo?(cpearce)
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
Comment on attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

Approval Request Comment
[Feature/regressing bug #]: EME
[User impact if declined]: Potential to crash; if user disables EME, and then attempt so play EME content, they could crash. This is an unlikely situation, but it could happen nonetheless.
[Describe test coverage new/current, TreeHerder]: We have lots of EME mochitests, we don't cover this case specifically however.
[Risks and why]: Low, this patch basically just adds nullchecks.
[String/UUID change made/needed]: None.
Attachment #8586489 - Flags: approval-mozilla-beta?
Attachment #8586489 - Flags: approval-mozilla-aurora?
Comment on attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

EME is new, we want to polish this feature. Taking it. Should be in beta 4.
Attachment #8586489 - Flags: approval-mozilla-beta?
Attachment #8586489 - Flags: approval-mozilla-beta+
Attachment #8586489 - Flags: approval-mozilla-aurora?
Attachment #8586489 - Flags: approval-mozilla-aurora+
Flags: needinfo?(cpearce)
I couldn't reproduce this issue on Nightly from 2015-03-26 nor Fx 38 beta 3 under Windows 7 64 bit, Windows 8.1 32 bit and 64 bit with str provided in comment 0. Any ideas on how to reproduce this in order to properly verify the fix? Or could you please verify the fix using latest builds? Thanks in advance!
Flags: needinfo?(cpearce)
Verified fixed in nightly.
Flags: needinfo?(cpearce)
You need to log in before you can comment on or make changes to this bug.