Closed Bug 1315521 Opened 4 years ago Closed 4 years ago

Crash in mozilla::dom::HTMLMediaElement::NotifyAudioPlaybackChanged

Categories

(Core :: Audio/Video: Playback, defect, P1)

52 Branch
x86_64
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla52
Tracking Status
firefox50 --- unaffected
firefox51 --- unaffected
firefox52 --- fixed

People

(Reporter: martin, Assigned: alwu)

References

Details

(Keywords: crash, crashreportid, regression, Whiteboard: [fixed by bug 1315551])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is 
report bp-9687fb6f-e289-4f4b-99ad-1660c2161106.
=============================================================

Crash happens about a minute after Firefox 52 Nightly starts, regardless of whether there is user action or not.

No audio playing in the tab that loads.
Here is the link to the crashes on nightly: http://bit.ly/2fsByoE. Not sure if this belongs in the Core|Audio component but will leave it here for now.

Crashes started with 20161105030211 build.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Component: General → Audio/Video: Playback
Product: Firefox → Core
Based on the top frame of the stack, this looks like it could be a regression from bug 1302350, though it looks like that might have been in the 11-04 build first. Can you look into this, Alastor? Thanks.
Flags: needinfo?(alwu)
See Also: → 1315564
See Also: → 1315565
See Also: → 1315566
Assignee: nobody → alwu
Flags: needinfo?(alwu)
Duplicate of this bug: 1315593
Duplicate of this bug: 1315241
Duplicate of this bug: 1315565
Duplicate of this bug: 1315566
Crash Signature: [@ mozilla::dom::HTMLMediaElement::NotifyAudioPlaybackChanged] → [@ mozilla::dom::HTMLMediaElement::NotifyAudioPlaybackChanged] [@ mozilla::dom::AudioChannelAgent::IsPlayingStarted] [@ mozilla::dom::HTMLMediaElement::IsAllowedToPlay] [@ mozilla::dom::HTMLMediaElement::AudioCaptureStreamChangeIfNeeded]
Already found the possible root cause, testing now...
Priority: -- → P1
Comment on attachment 8808450 [details]
Bug 1315521 - remove CC for audio channel agent.

https://reviewboard.mozilla.org/r/91256/#review91094
Attachment #8808450 - Flags: review?(jwwang) → review+
Pushed by alwu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/87b698764664
remove CC for audio channel agent. r=jwwang
The audio agent has a strong reference to the outer window, which has a strong reference to the inner window, which can hold alive the media element, which has a strong reference to the audio agent. That's probably the cycle that is causing the leak.
Crash Signature: [@ mozilla::dom::HTMLMediaElement::NotifyAudioPlaybackChanged] [@ mozilla::dom::AudioChannelAgent::IsPlayingStarted] [@ mozilla::dom::HTMLMediaElement::IsAllowedToPlay] [@ mozilla::dom::HTMLMediaElement::AudioCaptureStreamChangeIfNeeded] → [@ mozilla::dom::HTMLMediaElement::NotifyAudioPlaybackChanged] [@ mozilla::dom::AudioChannelAgent::IsPlayingStarted] [@ mozilla::dom::HTMLMediaElement::IsAllowedToPlay] [@ mozilla::dom::HTMLMediaElement::AudioCaptureStreamChangeIfNeeded] [@ mozilla:…
Duplicate of this bug: 1315995
The possible root cause is UAF, and we have two different solutions. One is "remove CC for audio channel agent", and another is "check whether the agent exist before calling agent's method".

I tried to use the first one to solve this bug, but it got the leaking problem. However, in the bug1315551, I have another patch which is similar with the second solution and it was landed into m-c now.

Therefore, we can wait and see whether the bug1315551 can also fix this crash. If so, we might not need to remove the CC for audio channel agent and close this bug. If not, I would try to figure out the way to avoid the leaking.
This issue appears fixed on my end. I ran the latest Nightly build for an hour and it did not crash. Previously, it would crash after about a minute or so each time it was opened.
[@ mozilla::dom::AudioChannelAgent::IsPlayingStarted const ] looks like it might be an OS X specific variant of this crash. For instance: bp-e497e1b8-07a1-4dc0-9eb9-c2a972161108
Crash Signature: mozilla::dom::HTMLMediaElement::IsTabActivated] → mozilla::dom::HTMLMediaElement::IsTabActivated] [@ mozilla::dom::AudioChannelAgent::IsPlayingStarted const ]
Duplicate of this bug: 1315564
Crash Signature: mozilla::dom::HTMLMediaElement::IsTabActivated] [@ mozilla::dom::AudioChannelAgent::IsPlayingStarted const ] → mozilla::dom::HTMLMediaElement::IsTabActivated] [@ mozilla::dom::AudioChannelAgent::IsPlayingStarted const ] [@ mozilla::dom::HTMLMediaElement::NotifyAudioChannelAgent]
(In reply to martin from comment #16)
I can confirm this... since yesterday nightly is no crashing anymore
According to comment16 & comment 19, close this bug.
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
FYI, this crash was fixed by bug1315551.
(In reply to Alastor Wu [:alwu] from comment #21)
> FYI, this crash was fixed by bug1315551.

In that case we should mark the bug status appropriately, which is fixed.
Depends on: 1315551
Resolution: WORKSFORME → FIXED
Whiteboard: [fixed by bug 1315551]
Target Milestone: --- → mozilla52
You need to log in before you can comment on or make changes to this bug.