1153915 - crash in mozilla::dom::AudioChannelService::WindowDestroyedEnumerator(mozilla::dom::AudioChannelAgent*, nsAutoPtr<mozilla::dom::AudioChannelService::AudioChannelAgentData>&, void*)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Joshua Mitchell (Inactive)]

This bug was filed from the Socorro interface and is 
report bp-e525c0c4-7d77-4eee-ac2f-cd3242150413.
=======================================================

Dialer > Contact > Contact Info > Call number > Crash on 2nd ring

Steps when encountered

1) Update a Flame to 20150413010203
2) Launch Dialer App
3) Select Contacts Tab
4) Select a Contact
5) Select phone number / Dial icon


Actual:
On 2nd ring, phone crashed


Expected:
Phone will not crash


Environmental Variables:
Device: Flame 3.0 (KK - Nightly - Full Flash - 319mem)
Build ID: 20150413010203
Gaia: 3c68964cb9fdba7cf0f6829b7f44562acaf1f1d7
Gecko: 0a46652bd992
Gonk: b83fc73de7b64594cd74b33e498bf08332b5d87b
Version: 40.0a1 (3.0)
Firmware Version: v18D-1
User Agent: Mozilla/5.0 (Mobile; rv:40.0) Gecko/40.0 Firefox/40.0



Repro frequency: Once  1/20
See attached:

Comment 1

[Peter Bylenga [:PBylenga]]

Adding Steps-wanted to try to reproduce.

Comment 2

[Johan Lorenzo [:jlorenzo]]

The segmentation fault has been triggered by this line[1], which has been added in bug 1147819, a week ago. Andrea, Ehsan, do you have an idea on how window->IsInnerWindow() could trigger this crash?

Clearing steps-wanted while we get some hints on how to get to that state.

[Blocking Requested - why for this release]: New crash on the dialer, which has been introduced on master.

[1] http://hg.mozilla.org/mozilla-central/annotate/0a46652bd992/dom/audiochannel/AudioChannelService.cpp#l795

Comment 3

[(no longer active)]

This is a simple null pointer crash.

Comment 4

[(no longer active)]

Attachment: Null check the window in AudioChannelService::WindowDestroyedEnumerator()

Comment 5

[(no longer active)]

Does this need to be backported to any branches?  (I don't think it does.)

Comment 6

[Johan Lorenzo [:jlorenzo]]

This issue has only been encountered once on master. The line where it failed only exists on mozilla-central[1] not on b2g37_2_2[2]. I don't think there's any uplift to do for this fix.

[1] http://mxr.mozilla.org/mozilla-central/source/dom/audiochannel/AudioChannelService.cpp#795
[2] http://mxr.mozilla.org/mozilla-b2g37_v2_2/source/dom/audiochannel/AudioChannelService.cpp#761

Comment 7

[Joshua Mitchell (Inactive)]

We only ever saw this on 3.0 but to be fair it was treated as a once-crash and we never had any reliable steps to reproduce it for branch check purposes. 
But according to the crash-stats this was only seen in 3.0

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7a784c19ebd4