1248832 - crash in mozilla::dom::MediaSource::Duration

Status: RESOLVED DUPLICATE of bug 1245463

(Core :: Audio/Video, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-954d0b16-8a8d-4cb8-a5d8-151ec2160209.
=============================================================

Looks like a regression that started in v45:

Product	Version	Percentage	Number Of Crashes
Firefox	45.0b4	33.53%	56
Firefox	45.0b5	26.95%	45
Firefox	46.0a2	14.97%	25
Firefox	47.0a1	8.38%	14
Firefox	45.0b3	7.78%	13
Firefox	45.0b1	2.99%	5
Firefox	45.0a2	2.40%	4
Firefox	45.0b2	2.40%	4
Firefox	46.0a1	0.60%	1

All crashes are on Windows (so far), both x86/amd64.
The crash address is 0x38 or 0x70 depending on architecture, so I suspect
this is a null pointer crash in CanPlayThrough() (mMediaSource being null):
http://hg.mozilla.org/mozilla-central/annotate/76733110704b/dom/media/mediasource/MediaSourceDecoder.cpp#l274

Stack:
mozilla::dom::MediaSource::Duration()
mozilla::MediaSourceDecoder::CanPlayThrough()
mozilla::dom::HTMLMediaElement::UpdateReadyStateInternal()
mozilla::MediaDecoder::UpdateReadyState()
mozilla::WatchManager<mozilla::MediaDecoder>::PerCallbackWatcher::DoNotify()
nsRunnableMethodImpl<void ( mozilla::GetUserMediaCallbackMediaStreamListener::*)(void), 1>::Run()
mozilla::AutoTaskDispatcher::DrainDirectTasks()
mozilla::XPCOMThreadWrapper::FireTailDispatcher()
nsRunnableMethodImpl<void ( mozilla::GetUserMediaCallbackMediaStreamListener::*)(void), 1>::Run()
XPCJSRuntime::AfterProcessTask(unsigned int)
nsThread::ProcessNextEvent(bool, bool*)

More reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3Adom%3A%3AMediaSource%3A%3ADuration

Comment 1

[Jean-Yves Avenard [:jya]]

Fixed in bug 1245463, part1. available in 45 beta 5

Comment 2

[Jean-Yves Avenard [:jya]]

For the records, the fix was made in MediaSourceDecoder::NextFrameBufferedStatus(), because if the mediasource is in closed state, then NextFrameBufferedStatus will now return NEXT_FRAME_UNAVAILABLE;

https://hg.mozilla.org/mozilla-central/annotate/76733110704b/dom/html/HTMLMediaElement.cpp#l3815

if NextFrameBufferedStatus doesn't return NEXT_FRAME_AVAILABLE, then CanPlayThrough() won't be called (https://hg.mozilla.org/mozilla-central/annotate/76733110704b/dom/html/HTMLMediaElement.cpp#l3850)