1212164 - Crash in MP3Demuxer: Assertion failure: mRawPtr != 0 (You can't dereference a NULL nsRefPtr with operator->().), at ../../dist/include/mozilla/nsRefPtr.h:286

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Jean-Yves Avenard [:jya]]

STR:
1- Navigate to a page with a mp3 link.
2- Click on link and play file
3- Press back.

Often crashes with:
#01: nsRefPtr<mozilla::mp3::MP3TrackDemuxer>::operator->() const[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32c43a1]
#02: mozilla::mp3::MP3Demuxer::NotifyDataArrived(unsigned int, long long)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x326cb95]
#03: mozilla::MediaFormatReader::NotifyDemuxer(unsigned int, long long)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32a3a2c]
#04: mozilla::MediaFormatReader::NotifyDataArrivedInternal(unsigned int, long long)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32a3b94]
#05: mozilla::MediaDecoderReader::NotifyDataArrived(mozilla::media::Interval<long long> const&)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32c9e69]
#06: mozilla::MediaDecoderReader::DoThrottledNotify()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3285184]
#07: mozilla::MediaDecoderReader::ThrottledNotifyDataArrived(mozilla::media::Interval<long long> const&)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x3284f2d]
#08: void nsRunnableMethodArguments<mozilla::media::Interval<long long> >::apply<mozilla::MediaDecoderReader, void (mozilla::MediaDecoderReader::*)(mozilla::media::Interval<long long> const&)>(mozilla::MediaDecoderReader*, void (mozilla::MediaDecoderReader::*)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32e0f44]
#09: nsRunnableMethodImpl<void (mozilla::MediaDecoderReader::*)(mozilla::media::Interval<long long> const&), true, mozilla::media::Interval<long long> >::Run()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x32e0c06]
#10: mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1a7259]
#11: mozilla::TaskQueue::Runner::Run()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x190eef]
#12: nsThreadPool::Run()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x19cd4f]
#13: non-virtual thunk to nsThreadPool::Run()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x19ce4c]
#14: nsThread::ProcessNextEvent(bool, bool*)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1996b1]
#15: NS_ProcessNextEvent(nsIThread*, bool)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x21e717]
#16: mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x88eefe]
#17: MessageLoop::RunInternal()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7bdb45]
#18: MessageLoop::RunHandler()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7bda55]
#19: MessageLoop::Run()[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x7bd9fd]
#20: nsThread::ThreadFunc(void*)[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/XUL +0x1975fd]
#21: _pt_root[/Users/jyavenard/Work/Mozilla/mozilla-central/obj-ff-dbg/dist/NightlyDebug.app/Contents/MacOS/libnss3.dylib +0x3747e1]
#22: _pthread_body[/usr/lib/system/introspection/libsystem_pthread.dylib +0x3815]
#23: _pthread_body[/usr/lib/system/introspection/libsystem_pthread.dylib +0x3792]
(lldb)

Comment 1

[Jean-Yves Avenard [:jya]]

Attachment: Prevent use of demuxer before initialization completes.

This wasn't a problem with MP4Demuxer or WebMDemuxer, but for MP3Demuxer it is.

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 8670562 [details] [diff] [review]
Prevent use of demuxer before initialization completes.

Review of attachment 8670562 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/media/MediaFormatReader.cpp
@@ +1595,5 @@
>  {
>    MOZ_ASSERT(OnTaskQueue());
>  
>    LOGV("aLength=%u, aOffset=%lld", aLength, aOffset);
> +  if (mShutdown || !mDemuxer || !mDemuxerInitDone) {

What if all data arrives before the demuxer init is done? Will this result in NotifyDataArrived() not being called on the demuxer, resulting in some other (intermittent) failures?

Comment 3

[Jean-Yves Avenard [:jya]]

It won't (In reply to Chris Pearce (:cpearce) from comment #2)
> What if all data arrives before the demuxer init is done? Will this result
> in NotifyDataArrived() not being called on the demuxer, resulting in some
> other (intermittent) failures?

This is what will happen yes (the demuxer not told it has data).

However, it doesn't matter with our current demuxers.
NotifyDataArrived is only used a signal that the buffered range is to be refreshed and the current demuxers use the MediaResource::GetCachedRanges or GetNextCachedData/GetCachedDataEnd see what is actually cached.

I think we should modify the MediaDataDemuxer API to even remove the arguments passed to NotifyDataArrived as really it's useless and may lead to future incorrect implementation of some demuxers.

Comment 4

[Jean-Yves Avenard [:jya]]

Actually, this breaks the MediaSourceDemuxer as it may await on NotifyDataArrived to tell it that new data was appended.
so we can't wait for the demuxer to be initialized, but also that an init request is pending

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/67b7e1825a7f

Comment 6

[Pulsebot]

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9a1c797fcce1

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/aa355229d6b5

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/aa355229d6b5