crash in std::deque<mozilla::gmp::GMPStorageChild::RecordIteratorContext, std::allocator<mozilla::gmp::GMPStorageChild::RecordIteratorContext> >::push_back(mozilla::gmp::GMPStorageChild::RecordIteratorContext&&)

RESOLVED WONTFIX

Status

()

Core
Audio/Video
P1
critical
RESOLVED WONTFIX
3 years ago
3 years ago

People

(Reporter: cpearce, Unassigned)

Tracking

({crash})

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Discussion with cpearce:
The stack doesn't really make much sense... Seems that the compositor is setting the exit handler or somesuch, which runs this code (GMPStorageChild::EnumerateRecords) which should only be in the child process.
This can't be us; this must be some other code that happens to compile to the same ABI as our code, and ends up being assigned our symbol name, so we're seeing the crash as in our code when it's not.
Looking at frame 1 of the crashing thread: it's also calling std::deque::push!

David, does this explanation seem likely to you?
Flags: needinfo?(dmajor)
Yep, happens all the time.

Taking it one step further: whatever function that actually is, is still not at fault. The code has been corrupted:

63a765ac a984ef34e5      test    eax,0E534EF84h
63a765b1 85b5ada49a8c    test    dword ptr [ebp-73655B53h],esi
63a765b7 84ef            test    bh,ch
63a765b9 85b5adadad3d    test    dword ptr [ebp+3DADADADh],esi
63a765bf a4              movs    byte ptr es:[edi],byte ptr [esi]
63a765c0 ef              out     dx,eax

That doesn't look like typical disassembly, and it doesn't match what we shipped in that build.
Flags: needinfo?(dmajor)
- Code from the wrong process (child code, parent crash)
- Probably corrupted code
-> Won't fix this particular signature.
No longer blocks: 1015800, 1032660
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → WONTFIX
Summary: [EME] crash in std::deque<mozilla::gmp::GMPStorageChild::RecordIteratorContext, std::allocator<mozilla::gmp::GMPStorageChild::RecordIteratorContext> >::push_back(mozilla::gmp::GMPStorageChild::RecordIteratorContext&&) → crash in std::deque<mozilla::gmp::GMPStorageChild::RecordIteratorContext, std::allocator<mozilla::gmp::GMPStorageChild::RecordIteratorContext> >::push_back(mozilla::gmp::GMPStorageChild::RecordIteratorContext&&)
Assignee: gsquelart → administration
Assignee: administration → nobody
You need to log in before you can comment on or make changes to this bug.