1148286 - [EME] Crash when replaying EME content after EME disabled

Status: VERIFIED FIXED

(Core :: Audio/Video, defect, P1)

Description

[Chris Pearce [:cpearce (Not reading bugmail)]]

STR:

1. Open http://drmtest2.adobe.com/HTML5AAXSPlayer/2/mse-access/
2. Press "Play"
3. Disable EME in options menu
4. Press "Play" again.

Crash!

Main thread:

 	xul.dll!mozilla::BlockingResourceBase::CheckAcquire() Line 271	C++
 	xul.dll!mozilla::OffTheBooksMutex::Lock() Line 382	C++
 	xul.dll!mozilla::CDMCaps::AutoLock::AutoLock(mozilla::CDMCaps & aInstance) Line 47	C++
 	xul.dll!mozilla::MediaSourceDecoder::SetCDMProxy(mozilla::CDMProxy * aProxy) Line 314	C++
>	xul.dll!mozilla::dom::HTMLMediaElement::FinishDecoderSetup(mozilla::MediaDecoder * aDecoder, mozilla::MediaResource * aStream, nsIStreamListener * * aListener, mozilla::MediaDecoder * aCloneDonor) Line 2793	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::LoadResource() Line 1225	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::SelectResource() Line 878	C++
 	xul.dll!mozilla::dom::HTMLMediaElement::SelectResourceWrapper() Line 830	C++
 	xul.dll!mozilla::dom::nsSyncSection::Run() Line 752	C++
 	xul.dll!nsBaseAppShell::RunSyncSectionsInternal(bool aStable, unsigned int aThreadRecursionLevel) Line 372	C++
 	xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr, bool mayWait, unsigned int recursionDepth) Line 312	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 830	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 140	C++
 	xul.dll!MessageLoop::RunInternal() Line 233	C++
 	xul.dll!MessageLoop::RunHandler() Line 227	C++
 	xul.dll!MessageLoop::Run() Line 201	C++
 	xul.dll!nsBaseAppShell::Run() Line 166	C++
 	xul.dll!nsAppShell::Run() Line 180	C++
 	xul.dll!nsAppStartup::Run() Line 282	C++
 	xul.dll!XREMain::XRE_mainRun() Line 4202	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 4278	C++
 	xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags) Line 4498	C++
 	firefox.exe!do_main(int argc, char * * argv, nsIFile * xreDirectory) Line 294	C++
 	firefox.exe!NS_internal_main(int argc, char * * argv) Line 667	C++
 	firefox.exe!wmain(int argc, wchar_t * * argv) Line 124	C++
 	[External Code]	


Looks like we're referencing release memory.

Comment 1

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch: Nullpointer checks

We terminate the CDM when we disable EME, and the testcase is unaware of this and tried to re-use the same MediaKeys object. This patch just adds null checks and rejects promises returned by MediaKeys after the CDM dies.

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d51574a87ed4

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

Must remember to uplift.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/d51574a87ed4

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

Approval Request Comment
[Feature/regressing bug #]: EME
[User impact if declined]: Potential to crash; if user disables EME, and then attempt so play EME content, they could crash. This is an unlikely situation, but it could happen nonetheless.
[Describe test coverage new/current, TreeHerder]: We have lots of EME mochitests, we don't cover this case specifically however.
[Risks and why]: Low, this patch basically just adds nullchecks.
[String/UUID change made/needed]: None.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8586489 [details] [diff] [review]
Patch: Nullpointer checks

EME is new, we want to polish this feature. Taking it. Should be in beta 4.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/998229d7022c

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/999636e73165

Comment 9

[Ada [:adalucinet]]

I couldn't reproduce this issue on Nightly from 2015-03-26 nor Fx 38 beta 3 under Windows 7 64 bit, Windows 8.1 32 bit and 64 bit with str provided in comment 0. Any ideas on how to reproduce this in order to properly verify the fix? Or could you please verify the fix using latest builds? Thanks in advance!

Comment 10

[Chris Pearce [:cpearce (Not reading bugmail)]]

Verified fixed in nightly.