1315521 - Crash in mozilla::dom::HTMLMediaElement::NotifyAudioPlaybackChanged

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Description

[martin]

This bug was filed from the Socorro interface and is 
report bp-9687fb6f-e289-4f4b-99ad-1660c2161106.
=============================================================

Crash happens about a minute after Firefox 52 Nightly starts, regardless of whether there is user action or not.

No audio playing in the tab that loads.

Comment 1

[Marcia Knous [:marcia]]

Here is the link to the crashes on nightly: http://bit.ly/2fsByoE. Not sure if this belongs in the Core|Audio component but will leave it here for now.

Crashes started with 20161105030211 build.

Comment 2

[Andrew McCreight [:mccr8]]

Based on the top frame of the stack, this looks like it could be a regression from bug 1302350, though it looks like that might have been in the 11-04 build first. Can you look into this, Alastor? Thanks.

Comment 7

[Alastor Wu [:alwu]]

Already found the possible root cause, testing now...

Comment 8

[Alastor Wu [:alwu]]

Attachment: Bug 1315521 - remove CC for audio channel agent.

Because audio channel agent uses weak ref to HTMLMediaElement, so we don't need to add it into the CC list.

Review commit: https://reviewboard.mozilla.org/r/91256/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/91256/

Comment 9

[JW Wang [:jwwang] [:jw_wang]]

Comment on attachment 8808450 [details]
Bug 1315521 - remove CC for audio channel agent.

https://reviewboard.mozilla.org/r/91256/#review91094

Comment 10

[Alastor Wu [:alwu]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1d08bdd2e29b7fbbd9f73adebaf9229fe6227e0d&selectedJob=30543527

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/87b698764664
remove CC for audio channel agent. r=jwwang

Comment 12

[Phil Ringnalda (:philor)]

Backed out in https://hg.mozilla.org/integration/autoland/rev/ab0995a0dc10 - apparently Jetpack depends on that, so you wound up causing https://treeherder.mozilla.org/logviewer.html#?job_id=6286030&repo=autoland

Comment 13

[Andrew McCreight [:mccr8]]

The audio agent has a strong reference to the outer window, which has a strong reference to the inner window, which can hold alive the media element, which has a strong reference to the audio agent. That's probably the cycle that is causing the leak.

Comment 15

[Alastor Wu [:alwu]]

The possible root cause is UAF, and we have two different solutions. One is "remove CC for audio channel agent", and another is "check whether the agent exist before calling agent's method".

I tried to use the first one to solve this bug, but it got the leaking problem. However, in the bug1315551, I have another patch which is similar with the second solution and it was landed into m-c now.

Therefore, we can wait and see whether the bug1315551 can also fix this crash. If so, we might not need to remove the CC for audio channel agent and close this bug. If not, I would try to figure out the way to avoid the leaking.

Comment 16

[martin]

This issue appears fixed on my end. I ran the latest Nightly build for an hour and it did not crash. Previously, it would crash after about a minute or so each time it was opened.

Comment 17

[Andrew McCreight [:mccr8]]

[@ mozilla::dom::AudioChannelAgent::IsPlayingStarted const ] looks like it might be an OS X specific variant of this crash. For instance: bp-e497e1b8-07a1-4dc0-9eb9-c2a972161108

Comment 19

[Boersenfeger]

(In reply to martin from comment #16)
I can confirm this... since yesterday nightly is no crashing anymore

Comment 20

[Alastor Wu [:alwu]]

According to comment16 & comment 19, close this bug.

Comment 21

[Alastor Wu [:alwu]]

FYI, this crash was fixed by bug1315551.

Comment 22

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to Alastor Wu [:alwu] from comment #21)
> FYI, this crash was fixed by bug1315551.

In that case we should mark the bug status appropriately, which is fixed.