[EME] Crash when replaying EME content after EME disabled

VERIFIED FIXED in Firefox 38

Status

()

Core
Audio/Video
P1
normal
VERIFIED FIXED
3 years ago
3 years ago

People

(Reporter: cpearce, Assigned: cpearce)

Tracking

(Blocks: 3 bugs)

unspecified
mozilla40
x86_64
Windows 8.1
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox38 fixed, firefox39 fixed, firefox40 fixed)

Details

Attachments

(1 attachment)

(Assignee)

Description

3 years ago
STR:

1. Open http://drmtest2.adobe.com/HTML5AAXSPlayer/2/mse-access/
2. Press "Play"
3. Disable EME in options menu
4. Press "Play" again.

Crash!

Main thread:

 	xul.dll!mozilla::BlockingResourceBase::CheckAcquire() Line 271	C++
 	xul.dll!mozilla::OffTheBooksMutex::Lock() Line 382	C++
 	xul.dll!mozilla::CDMCaps::AutoLock::AutoLock(mozilla::CDMCaps & aInstance) Line 47	C++
 	xul.dll!mozilla::MediaSourceDecoder::SetCDMProxy(mozilla::CDMProxy * aProxy) Line 314	C++
>	xul.dll!mozilla::dom::HTMLMediaElement::FinishDecoderSetup(mozilla::MediaDecoder * aDecoder, mozilla::MediaResource * aStream, nsIStreamListener * * aListener, mozilla::MediaDecoder * aCloneDonor) Line 2793	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::LoadResource() Line 1225	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::SelectResource() Line 878	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::SelectResourceWrapper() Line 830	C++
 	xul.dll!mozilla::dom::nsSyncSection::Run() Line 752	C++
 	xul.dll!nsBaseAppShell::RunSyncSectionsInternal(bool aStable, unsigned int aThreadRecursionLevel) Line 372	C++
 	xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr, bool mayWait, unsigned int recursionDepth) Line 312	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 830	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 140	C++
 	xul.dll!MessageLoop::RunInternal() Line 233	C++
 	xul.dll!MessageLoop::RunHandler() Line 227	C++
 	xul.dll!MessageLoop::Run() Line 201	C++
 	xul.dll!nsBaseAppShell::Run() Line 166	C++
 	xul.dll!nsAppShell::Run() Line 180	C++
 	xul.dll!nsAppStartup::Run() Line 282	C++
 	xul.dll!XREMain::XRE_mainRun() Line 4202	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 4278	C++
 	xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags) Line 4498	C++
 	firefox.exe!do_main(int argc, char * * argv, nsIFile * xreDirectory) Line 294	C++
 	firefox.exe!NS_internal_main(int argc, char * * argv) Line 667	C++
 	firefox.exe!wmain(int argc, wchar_t * * argv) Line 124	C++
 	[External Code]	


Looks like we're referencing release memory.
Priority: -- → P1
(Assignee)

Comment 1

3 years ago
Created attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

We terminate the CDM when we disable EME, and the testcase is unaware of this and tried to re-use the same MediaKeys object. This patch just adds null checks and rejects promises returned by MediaKeys after the CDM dies.
Attachment #8586489 - Flags: review?(edwin)
(Assignee)

Comment 3

3 years ago
Must remember to uplift.
Flags: needinfo?(cpearce)
https://hg.mozilla.org/mozilla-central/rev/d51574a87ed4
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox40: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla40
(Assignee)

Comment 5

3 years ago
Comment on attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

Approval Request Comment
[Feature/regressing bug #]: EME
[User impact if declined]: Potential to crash; if user disables EME, and then attempt so play EME content, they could crash. This is an unlikely situation, but it could happen nonetheless.
[Describe test coverage new/current, TreeHerder]: We have lots of EME mochitests, we don't cover this case specifically however.
[Risks and why]: Low, this patch basically just adds nullchecks.
[String/UUID change made/needed]: None.
Attachment #8586489 - Flags: approval-mozilla-beta?
Attachment #8586489 - Flags: approval-mozilla-aurora?
status-firefox38: --- → affected
status-firefox39: --- → affected
Comment on attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

EME is new, we want to polish this feature. Taking it. Should be in beta 4.
Attachment #8586489 - Flags: approval-mozilla-beta?
Attachment #8586489 - Flags: approval-mozilla-beta+
Attachment #8586489 - Flags: approval-mozilla-aurora?
Attachment #8586489 - Flags: approval-mozilla-aurora+
(Assignee)

Updated

3 years ago
Flags: needinfo?(cpearce)

Comment 9

3 years ago
I couldn't reproduce this issue on Nightly from 2015-03-26 nor Fx 38 beta 3 under Windows 7 64 bit, Windows 8.1 32 bit and 64 bit with str provided in comment 0. Any ideas on how to reproduce this in order to properly verify the fix? Or could you please verify the fix using latest builds? Thanks in advance!
Flags: needinfo?(cpearce)
(Assignee)

Comment 10

3 years ago
Verified fixed in nightly.
Status: RESOLVED → VERIFIED
Flags: needinfo?(cpearce)
You need to log in before you can comment on or make changes to this bug.