1275393 - createMediaElementSource crashes FireFox in some cases.

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: MediaStreamGraph, defect, P1)

Description

[Ying]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36

Steps to reproduce:

Use a Windows (I tired 10 and 8.1) machine, open any YouTube video (e.g. https://www.youtube.com/watch?v=jI-kpVh6e1U )

context = new window.AudioContext();
source = context.createMediaElementSource($('video'));
source.connect(context.destination);

If FF doesn't automatically crash, click any link on the page, and it'll crash. 


Actual results:

crash report here:
https://crash-stats.mozilla.com/report/index/140a76df-3868-4f2d-bdf9-b040d2160524

Video element will be paused, and upon next interaction with FireFox (e.g. click a link), FireFox crashes. 

This is for Windows only. Things works fine on Ubuntu. I tested 4 different Windows PCs, and all of them behaves similarly.  Chrome and Edge behaves normally. 

In addition, this seems to affect YouTube, but not some other video elements. So it is probably video/audio format or MSE related. 


Expected results:

No crash, audio plays like nothing ever happened.

Comment 1

[Andreas Pehrson [:pehrsons]]

Capturing MSE to a stream sounds like a possible cause here.

Also I don't think clicking a link is what is triggering it. It's probably garbage collection. Try forcing GC and/or CC from about:memory and see.

Comment 2

[Paul Adenot (:padenot)]

P1: Crasher on a high profile site, although the code path that trigger the crash is not yet in production it seems. Waiting for a regression range if possible and then we'll fix this shortly.

This might be caused by MSE writing weird things to an AudioChunk.

Comment 3

[Loic]

The crash has been fixed in 47+ by bug 1181981:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=772dbb329a151adf98805a3b0cd5c713f5733e08&tochange=be37af7fca760487e789c13d21c748586e495db6

Comment 4

[Ying]

Tried it in FF Beta, and it works great :)
Thanks!