createMediaElementSource crashes FireFox in some cases.

RESOLVED WORKSFORME

Status

()

P1
normal
Rank:
15
RESOLVED WORKSFORME
2 years ago
2 years ago

People

(Reporter: yingyuyao, Unassigned)

Tracking

({crash})

46 Branch
crash
Points:
---

Firefox Tracking Flags

(platform-rel ?)

Details

(Whiteboard: [platform-rel-Youtube], crash signature)

(Reporter)

Description

2 years ago
User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36

Steps to reproduce:

Use a Windows (I tired 10 and 8.1) machine, open any YouTube video (e.g. https://www.youtube.com/watch?v=jI-kpVh6e1U )

context = new window.AudioContext();
source = context.createMediaElementSource($('video'));
source.connect(context.destination);

If FF doesn't automatically crash, click any link on the page, and it'll crash. 


Actual results:

crash report here:
https://crash-stats.mozilla.com/report/index/140a76df-3868-4f2d-bdf9-b040d2160524

Video element will be paused, and upon next interaction with FireFox (e.g. click a link), FireFox crashes. 

This is for Windows only. Things works fine on Ubuntu. I tested 4 different Windows PCs, and all of them behaves similarly.  Chrome and Edge behaves normally. 

In addition, this seems to affect YouTube, but not some other video elements. So it is probably video/audio format or MSE related. 


Expected results:

No crash, audio plays like nothing ever happened.
Flags: needinfo?(padenot)

Updated

2 years ago
Flags: needinfo?(padenot)
Keywords: regressionwindow-wanted
Capturing MSE to a stream sounds like a possible cause here.

Also I don't think clicking a link is what is triggering it. It's probably garbage collection. Try forcing GC and/or CC from about:memory and see.
P1: Crasher on a high profile site, although the code path that trigger the crash is not yet in production it seems. Waiting for a regression range if possible and then we'll fix this shortly.

This might be caused by MSE writing weird things to an AudioChunk.
Rank: 15
Priority: -- → P1

Updated

2 years ago
Component: Web Audio → Audio/Video: MediaStreamGraph
Crash Signature: [@ nsTArray_Impl<T>::Clear | mozilla::AudioChunk::`scalar deleting destructor'']
Keywords: crash

Comment 3

2 years ago
The crash has been fixed in 47+ by bug 1181981:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=772dbb329a151adf98805a3b0cd5c713f5733e08&tochange=be37af7fca760487e789c13d21c748586e495db6
Status: UNCONFIRMED → RESOLVED
Last Resolved: 2 years ago
Depends on: 1181981
Keywords: regressionwindow-wanted
Resolution: --- → WORKSFORME
(Reporter)

Comment 4

2 years ago
Tried it in FF Beta, and it works great :)
Thanks!
platform-rel: --- → ?
Whiteboard: [platform-rel-Youtube]
You need to log in before you can comment on or make changes to this bug.