Closed Bug 1225003 Opened 4 years ago Closed 4 years ago

Crash [@ mozilla::WebAudioDecodeJob::SizeOfExcludingThis]

Categories

(Core :: Web Audio, defect, P1, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla45
Tracking Status
firefox42 --- unaffected
firefox43 --- fixed
firefox44 --- fixed
firefox45 --- fixed
b2g-v2.5 --- fixed

People

(Reporter: jruderman, Assigned: karlt)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase)

Crash Data

Attachments

(5 files)

The testcase crashes [@ mozilla::WebAudioDecodeJob::SizeOfExcludingThis].

(It might trip bug 1222202 first, but that's probably unrelated).

The testcase calls fuzzPriv.getMemoryReports, which does pretty much the same calls as clicking "Measure" in about:memory, but lets the testcase control the timing. Run with https://github.com/MozillaSecurity/funfuzz/tree/master/dom/extension installed in a temporary profile. (Or modify the testcase so the timing doesn't need to be so precise?)
Attached file stack
Thanks.  Similar to bug 1221855.

I should fix this too:
https://hg.mozilla.org/mozilla-central/annotate/a8ed7dd831d1/dom/media/webaudio/AudioDestinationNode.cpp#l181
Assignee: nobody → karlt
Blocks: 1199559
Status: NEW → ASSIGNED
Keywords: regression
Priority: -- → P1
The testing of the offline context is limited due to bug 1225282, but does
catch the crash fixed here.
Attachment #8688193 - Flags: review?(erahm)
Comment on attachment 8688193 [details] [diff] [review]
test no crashes in decodeAudioData() and offline context memory reporting

Review of attachment 8688193 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/media/webaudio/test/test_WebAudioMemoryReporting.html
@@ +46,5 @@
>  SpecialPowers.Cc["@mozilla.org/memory-reporter-manager;1"].
>    getService(SpecialPowers.Ci.nsIMemoryReporterManager).
>    getReports(handleReport, null, finished, null, /* anonymized = */ false);
>  
> +ac.decodeAudioData(new ArrayBuffer(4), function(){}, function(){});

min: maybe add a note here about what we're trying to do. Is the goal to run |decodeAudioData| while reporting memory?
Attachment #8688193 - Flags: review?(erahm) → review+
Attachment #8688194 - Flags: review?(padenot) → review+
(In reply to Eric Rahm [:erahm] from comment #5)
> min: maybe add a note here about what we're trying to do. Is the goal to run
> |decodeAudioData| while reporting memory?

Yes.  Added a note.
Flags: in-testsuite+
https://hg.mozilla.org/mozilla-central/rev/3c4b0d791c5d
https://hg.mozilla.org/mozilla-central/rev/4c1b0d416870
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla45
Comment on attachment 8688194 [details] [diff] [review]
null-check mBuffer in SizeOfExcludingThis()

Approval Request Comment
[Feature/regressing bug #]: bug 1199559
[User impact if declined]: potential null-deref crash after running about:memory while OfflineAudioContext or decodeAudioData() is in use.
[Describe test coverage new/current, TreeHerder]: new test.
[Risks and why]: very low.  simple null check.
This is the same fix as was uplifted for bug 1221855 in different code.
[String/UUID change made/needed]: none.
Attachment #8688194 - Flags: approval-mozilla-beta?
Attachment #8688194 - Flags: approval-mozilla-aurora?
Comment on attachment 8688194 [details] [diff] [review]
null-check mBuffer in SizeOfExcludingThis()

Please uplift to aurora and beta, crash fix, includes a test.
Attachment #8688194 - Flags: approval-mozilla-beta?
Attachment #8688194 - Flags: approval-mozilla-beta+
Attachment #8688194 - Flags: approval-mozilla-aurora?
Attachment #8688194 - Flags: approval-mozilla-aurora+
Comment on attachment 8689325 [details] [diff] [review]
43 branch: test no crashes in decodeAudioData() and offline context memory reporting

[Triage Comment]

Test for crash fix. Please uplift this to beta (instead of attachment 8688193 [details] [diff] [review])
Attachment #8689325 - Flags: approval-mozilla-beta+
Comment on attachment 8688193 [details] [diff] [review]
test no crashes in decodeAudioData() and offline context memory reporting

[Triage Comment]

Test for crash fix, ok to uplift to aurora.
Attachment #8688193 - Flags: approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.