Closed Bug 1208656 Opened 9 years ago Closed 9 years ago

Crash in [@ _purecall | mozilla::MediaStreamGraphImpl::RunInStableState(bool) ]

Categories

(Core :: Audio/Video, defect)

Product:
Core
Component:
Audio/Video
Version:
40 Branch
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla44
Tracking Flags:
Tracking Status
firefox41 --- affected
firefox42 + fixed
firefox43 + fixed
firefox44 + fixed

People

(Reporter: chromium.khalil, Assigned: bholley)

References

Details

(Keywords: crash, regression, reproducible)

Crash Data

Attachments

(2 files)

index.htm
98 bytes, text/html
Details
Grab the tail dispatch each time in case the runnable spins the event loop. v1
4.33 KB, patch
khuey
: review+
lizzard
: approval-mozilla-aurora+
lizzard
: approval-mozilla-beta+
Details | Diff | Splinter Review
Attached file index.htm — 
Crash ID:

bp-986ac476-49c3-4798-a9b2-9421f2150925

PoC:

<script>
navigator.mozGetUserMedia({video: true}, function (){alert()}, function(){});
</script>
Regression range:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a1b728c86053b96beda2181be04968d6dbb9f680&tochange=7ec784680bdd1ea4760783413aaae4dee12607e2
Assignee: benjamin → nobody
Blocks: 1144486
Severity: normal → critical
Status: UNCONFIRMED → NEW
Crash Signature: [@ _purecall | mozilla::MediaStreamGraphImpl::RunInStableState(bool) ]
status-firefox41: --- → affected
tracking-firefox42: --- → ?
tracking-firefox43: --- → ?
tracking-firefox44: --- → ?
Component: Plugin Click-To-Activate Whitelist → Audio/Video
Ever confirmed: true
Flags: needinfo?(bobbyholley)
Keywords: crash, regression, reproducible
Product: Firefox → Core
Summary: Crash Report [@ _purecall | mozilla::MediaStreamGraphImpl::RunInStableState(bool) ] → Crash in [@ _purecall | mozilla::MediaStreamGraphImpl::RunInStableState(bool) ]
Version: 42 Branch → 40 Branch
Tracking for 43 since this looks like a fairly recent regression. 
I don't see any crash signatures for 44 so far but it is likely affected.
status-firefox42: --- → affected
status-firefox43: --- → affected
tracking-firefox43: ? → +
If the runnable spins the event loop, we may end up firing the tail dispatcher,
which causes the AutoTaskDispatcher to be destroyed, after which point invoking
methods on it will crash. We need to grab it each time so that it will be lazily
instantiated as-needed.
Attachment #8669199 - Flags: review?(khuey)
Assignee: nobody → bobbyholley
Flags: needinfo?(bobbyholley)
Tracking for 42 as it is a reproducible crash.

Bobby, could you fill the uplift request to aurora & beta? 
Thanks
tracking-firefox42: ? → +
tracking-firefox44: ? → +
Flags: needinfo?(bobbyholley)
Comment on attachment 8669199 [details] [diff] [review]
Grab the tail dispatch each time in case the runnable spins the event loop. v1

Approval Request Comment
[Feature/regressing bug #]: bug 1144486
[User impact if declined]: crashes
[Describe test coverage new/current, TreeHerder]: CI test
[Risks and why]: Low risk.
[String/UUID change made/needed]: none.
Flags: needinfo?(bobbyholley)
Attachment #8669199 - Flags: approval-mozilla-beta?
Attachment #8669199 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/d977aeac7611
Status: NEW → RESOLVED
Closed: 9 years ago
status-firefox44: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla44
Comment on attachment 8669199 [details] [diff] [review]
Grab the tail dispatch each time in case the runnable spins the event loop. v1

Fixes a reproducible crash, includes new test. Approved for uplift to aurora and beta.
Attachment #8669199 - Flags: approval-mozilla-beta?
Attachment #8669199 - Flags: approval-mozilla-beta+
Attachment #8669199 - Flags: approval-mozilla-aurora?
Attachment #8669199 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: