crash in MediaStream::AddConsumer with SetVelocity()/Doppler after source node finishes

RESOLVED FIXED in Firefox 41

Status

()

defect
RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: karlt, Assigned: karlt)

Tracking

({crash, regression})

Trunk
mozilla42
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox40 unaffected, firefox41+ fixed, firefox42 fixed)

Details

Attachments

(7 attachments)

Assignee

Description

4 years ago
#0  0x00007fe011e1e186 in nsTArray_base<nsTArrayInfallibleAllocator, nsTArray_CopyWithMemutils>::Length (this=0x128) at ../../dist/include/nsTArray.h:361
#1  0x00007fe0146023b3 in nsTArray_Impl<mozilla::MediaInputPort*, nsTArrayInfallibleAllocator>::AppendElement<mozilla::MediaInputPort*&, nsTArrayInfallibleAllocator> (this=0x128, aItem=@0x7fdf568fe8c0: 0x7fdfaa9c2a30)
    at ../../dist/include/nsTArray.h:1515
#2  0x00007fe0145ff734 in mozilla::MediaStream::AddConsumer (this=0x0, 
    aPort=0x7fdfaa9c2a30)
    at /mnt/ssd1/karl/moz/dev/dom/media/MediaStreamGraph.h:503
#3  0x00007fe0145ef209 in mozilla::MediaInputPort::Init (this=0x7fdfaa9c2a30)
    at /mnt/ssd1/karl/moz/dev/dom/media/MediaStreamGraph.cpp:2769
#4  0x00007fe0145ef648 in mozilla::ProcessedMediaStream::Message::Run (
    this=0x7fdf51daee80)
    at /mnt/ssd1/karl/moz/dev/dom/media/MediaStreamGraph.cpp:2868
#5  0x00007fe0145ea9f2 in mozilla::MediaStreamGraphImpl::UpdateGraph (
    this=0x7fdfaabb15c0, aEndBlockingDecision=39424)
    at /mnt/ssd1/karl/moz/dev/dom/media/MediaStreamGraph.cpp:1359
#6  0x00007fe0145eb18e in mozilla::MediaStreamGraphImpl::OneIteration (
    this=0x7fdfaabb15c0, aFrom=38426, aTo=38917, aStateFrom=39040, 
    aStateEnd=39424)
    at /mnt/ssd1/karl/moz/dev/dom/media/MediaStreamGraph.cpp:1507
#7  0x00007fe014519c8d in mozilla::AudioCallbackDriver::DataCallback (
    this=0x7fdfed4e0000, aBuffer=0x7fdf49eae040, aFrames=448)
    at /mnt/ssd1/karl/moz/dev/dom/media/GraphDriver.cpp:902
#8  0x00007fe014519821 in mozilla::AudioCallbackDriver::DataCallback_s (
    aStream=0x7fdf51c97510, aUser=0x7fdfed4e0000, aBuffer=0x7fdf49eae040, 
    aFrames=448) at /mnt/ssd1/karl/moz/dev/dom/media/GraphDriver.cpp:743
#9  0x00007fe015d1bc23 in stream_request_callback (s=0x7fdf51ca7000, 
    nbytes=3584, u=0x7fdf51c97510)
    at /mnt/ssd1/karl/moz/dev/media/libcubeb/src/cubeb_pulse.c:198
Assignee

Updated

4 years ago
Assignee: nobody → karlt
Status: NEW → ASSIGNED
Assignee

Comment 1

4 years ago
Posted patch crashtestSplinter Review
Assignee

Comment 5

4 years ago
Attachment #8628666 - Flags: review?(padenot)
Assignee

Comment 6

4 years ago
Because these nodes are only registered on PannerNodes if they have a
stream, they need only be unregistered once after the stream is destroyed.

Previously unregistration happened on finish, unlink, and destructor.
Attachment #8628667 - Flags: review?(padenot)
Assignee

Updated

4 years ago
Attachment #8628663 - Flags: review?(padenot)
Assignee

Updated

4 years ago
Attachment #8628664 - Flags: review?(padenot)
Assignee

Updated

4 years ago
Keywords: regression
Attachment #8628663 - Flags: review?(padenot) → review+
Attachment #8628664 - Flags: review?(padenot) → review+
Attachment #8628665 - Flags: review?(padenot) → review+
Attachment #8628666 - Flags: review?(padenot) → review+
Attachment #8628667 - Flags: review?(padenot) → review+
Attachment #8628668 - Flags: review?(padenot) → review+
Comment on attachment 8628661 [details] [diff] [review]
crashtest

Review of attachment 8628661 [details] [diff] [review]:
-----------------------------------------------------------------

You're landing this, right?
Assignee

Comment 11

4 years ago
(In reply to Paul Adenot (:padenot) from comment #8)
> You're landing this, right?

Yes.  https://hg.mozilla.org/integration/mozilla-inbound/rev/925c04c394e7
Assignee

Comment 12

4 years ago
[Tracking Requested - why for this release]:
Recently introduced crash.
Keywords: crash
Assignee

Comment 14

4 years ago
Comment on attachment 8628666 [details] [diff] [review]
handle null AudioNodeStream stream

Approval Request Comment

Please consider this an approval request for all patches on the bug.
The patches apply on top of changes in bug 1175510.

[Feature/regressing bug #]: bug 974089
[User impact if declined]:
Potential crash.  The is probably not likely in typical Web Audio usage, but some slightly out of ordinary usage could trip this.
[Describe test coverage new/current, TreeHerder]: new crashtest.
[Risks and why]: 
There is perhaps a small risk of ownership issues but the changes are not complex, so I don't think we've missed anything.  There are many existing tests.
[String/UUID change made/needed]: none.
Attachment #8628666 - Flags: approval-mozilla-aurora?
Comment on attachment 8628666 [details] [diff] [review]
handle null AudioNodeStream stream

Approving uplift as there is a crash test.
Attachment #8628666 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.