1249540 - Setting (a lot) currentTime after using createMediaElementSource makes Firefox crash.

Status: RESOLVED DUPLICATE of bug 1256520

(Core :: Audio/Video: Playback, defect, P1)

Description

[Thomas Tortorini]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36

Steps to reproduce:

I have summarize the bug with this code:
https://gist.github.com/Mr21/e276cf583fa78b50acdf

I have made a minimal online demo here:
http://thomastortorini.free.fr/bug-currenttime/

Firefox crash when we are calling a lot video.currentTime = x; IF we are also using the WebAudio API by creating a MediaElementAudioSourceNode by calling createMediaElementSource().

The value passing to currentTime is correctly in the range of the duration.


Actual results:

A crash


Expected results:

With my script, there is nothing to listen, but the cursor of the default controls should go madly everywhere.

Comment 1

[YF (Yang)]

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=a457d76662460d490175758c316fd163cb4bc8e9&tochange=ce19ea0695c2f5ea38fb3ecd7f2701bcaa993172

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

Can you try it on Nightly (FF 48)?  https://nightly.mozilla.org/

It crashes for me in 45 on windows, but not in 48 on windows or linux.

I did manage to crash it on an (old) Aurora 46 (which is not in beta) on linux (stack attached).

May be Audio/Video : mediaStreamGraph, not webaudio

A fix may need to be uplifted...

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

From frame 1: 
(gdb) p CycleCollectedJSRuntime::Get()
$6 = (mozilla::CycleCollectedJSRuntime *) 0x0

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

Attachment: stack

Note: in MediaPlayback thread

Comment 5

[YF (Yang)]

I still see the crashes in Fx46~48.0a1 (2016-03-10): bp-98e7fbc2-00cc-410a-9be2-7526f2160312.

But sometimes I can't reproduce it with the same version and clean profile.

Comment 6

[Karl Tomlinson (:karlt)]

MediaStream::Destroy() is called from ~DecodedStreamData() on the wrong thread.
There is another similar report somewhere.

Comment 7

[JW Wang [:jwwang] [:jw_wang]]

(In reply to Randell Jesup [:jesup] from comment #4)
> Created attachment 8729705 [details]
> stack
> 
> Note: in MediaPlayback thread

Is it reproducible on Linux?

Comment 8

[JW Wang [:jwwang] [:jw_wang]]

I can reproduce the crash on Linux, but the stack trace looks different.

Comment 9

[Maire Reavy [:mreavy]]

JW -- This is flagged as a carryover regression (starting in Fx44).  Can you take this one?

Comment 10

[JW Wang [:jwwang] [:jw_wang]]

(In reply to JW Wang [:jwwang] from comment #8)
> I can reproduce the crash on Linux, but the stack trace looks different.

Open bug 1256520 to deal with the crash first.

Comment 11

[JW Wang [:jwwang] [:jw_wang]]

Hi  Thomas,
Since bug 1256520 is fixed, can you try again to see if the crash is still present? Thanks!

Comment 12

[Thomas Tortorini]

Hi :)

I've updated my classique Firefox to 45.0.1 and my small crash-page makes him still crash like before (instantly).

But on the 47.0a2(2016-03-28) version of Firefox Developer Edition it's work fine!
But at the begining, I discover this bug by coding this app: http://fileplayer.github.io/
In my code, I update the currentTime at each mousemove when you are clicking the position slider.
And it's still possible to make him crash by moving a lot the slider.

the default player of firefox updates the currentTime only on the mouseup event, it's why no bug appears on it (I suppose).

Anyway, thanks you for making Firefox great, do you want me to test another version?

Comment 13

[Paul Adenot (:padenot)]

Thomas, I believe you'd have to test with a Nightly build. They are available for all platforms at https://nightly.mozilla.org, and has all the most recent patches that have landed in Firefox.

Comment 14

[Thomas Tortorini]

Hi Paul :)

On Firefox Nightly 48.0a1(2016-03-29) I can not reproduce the bug, the crash-page doesn't crash anymore, and there is no more problem with my application.

So, it's seem to be okay!
Well done!!

Comment 15

[JW Wang [:jwwang] [:jw_wang]]

Since there isn't much we can do about 45 which is already released, the best we can do is uplift bug 1256520 to beta(46) so you can have the fix in next release as soon as possible.

Comment 16

[Maire Reavy [:mreavy]]

Given JW's comment above (Comment15), I'm marking this bug as a dup of Bug 1256520 since 1256520 is where the fix landed and where the uplift conversations are happening.

Comment 17

[Maire Reavy [:mreavy]]

Updating the flags to match the bug that this is a dup of.