1339930 - Crash in mozilla::dom::AudioChannelService::GetOrCreateWindowData

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-fa77d7ba-bc84-4da8-9273-16e0a2170212.
=============================================================

Seen while looking at nightly crash stats - crashes started with 20170211030205: http://bit.ly/2lMefM4 

Possible regression range: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=25a94c1047e793ef096d8556fa3c26dd72bd37d7&tochange=855e6b2f6199189f37cea093cbdd1735e297e8aa

Bug 1336484 I think touched code in this area. ni on ehsan.

Comment 1

[(no longer active)]

Yeah certainly my fault.

[Tracking Requested - why for this release]: crash

Comment 2

[(no longer active)]

0xc8 is almost the offset of mWindowID in nsPIDOMWindowOuter, so our window pointer is somehow null here.

Comment 3

[(no longer active)]

Attachment: Don't crash in nsPIDOMWindowInner::IsPlayingAudio() if we've been unlinked

Comment 4

[Marcia Knous [:marcia]]

Tracking 54+ for this new crash.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/30a1b3847bf4
Don't crash in nsPIDOMWindowInner::IsPlayingAudio() if we've been unlinked; r=baku

Comment 6

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Testcase found by fuzzing.

Comment 7

[(no longer active)]

Thanks, the test case was really helpful.  Unfortunately the patch doesn't fix the crash.  What's happening is that our mOuterWindow is non-null in this case, but GetScriptableTop() returns null because the iframe has been removed from the tree.

Comment 8

[(no longer active)]

(I still think the patch that I landed is necessary since it's hard to know for sure that we'll always have an outer window here.

Comment 9

[(no longer active)]

It seems that AudioChannelService has this bug all over the place.

Comment 10

[(no longer active)]

Attachment: Don't crash in AudioChannelService when dealing with Windows without a parent

Comment 11

[Andrea Marchesini [:baku]]

Comment on attachment 8838100 [details] [diff] [review]
Don't crash in AudioChannelService when dealing with Windows without a parent

Review of attachment 8838100 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/audiochannel/AudioChannelService.cpp
@@ +827,5 @@
>  {
>    MOZ_ASSERT(NS_IsMainThread());
>  
>    auto* window = nsPIDOMWindowOuter::From(aWindow)->GetScriptableTop();
> +  if (!window) {

*aVolume = 0;

@@ +887,5 @@
>  {
>    MOZ_ASSERT(NS_IsMainThread());
>  
>    auto* window = nsPIDOMWindowOuter::From(aWindow)->GetScriptableTop();
> +  if (!window) {

*aMuted = 0;

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b03953d2cca
Don't crash in AudioChannelService when dealing with Windows without a parent; r=baku

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/30a1b3847bf4
https://hg.mozilla.org/mozilla-central/rev/1b03953d2cca

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Please request Aurora approval on this when you get a chance.

Comment 15

[(no longer active)]

Comment on attachment 8838100 [details] [diff] [review]
Don't crash in AudioChannelService when dealing with Windows without a parent

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1336484.
[User impact if declined]: Crash.
[Is this code covered by automated tests?]: Yes.
[Has the fix been verified in Nightly?]: Yes.
[Needs manual test from QE? If yes, steps to reproduce]: No.
[List of other uplifts needed for the feature/fix]: None.
[Is the change risky?]: No.
[Why is the change risky/not risky?]: Because it's adding some null checks.
[String changes made/needed]: None.

Comment 16

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8838100 [details] [diff] [review]
Don't crash in AudioChannelService when dealing with Windows without a parent

Add some null checks to prevent crashes. Regression from 53.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/4dce664e6046
https://hg.mozilla.org/releases/mozilla-aurora/rev/391c8637750f