1400155 - Crash in mozilla::MediaCacheStream::NotifyDataReceived

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[[:philipp]]

This bug was filed from the Socorro interface and is 
report bp-0b3bfffe-7878-490e-90a7-82fd20170909.
=============================================================
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	XUL 	mozilla::MediaCacheStream::NotifyDataReceived(long long, char const*, nsIPrincipal*) 	dom/media/MediaCache.cpp:1883
1 	XUL 	mozilla::ChannelMediaResource::CopySegmentToCache(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*) 	dom/media/MediaResource.cpp:459
2 	XUL 	nsStringInputStream::ReadSegments(nsresult (*)(nsIInputStream*, void*, char const*, unsigned int, unsigned int, unsigned int*), void*, unsigned int, unsigned int*) 	xpcom/io/nsStringStream.cpp:256
3 	XUL 	mozilla::ChannelMediaResource::OnDataAvailable(nsIRequest*, nsIInputStream*, unsigned int) 	dom/media/MediaResource.cpp:507
4 	XUL 	mozilla::net::HttpChannelChild::OnTransportAndData(nsresult const&, nsresult const&, unsigned long long const&, unsigned int const&, nsTString<char> const&) 	netwerk/protocol/http/HttpChannelChild.cpp:957
5 	XUL 	mozilla::net::ChannelEventQueue::FlushQueue() 	netwerk/ipc/ChannelEventQueue.cpp:93
6 	XUL 	mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() 	netwerk/ipc/ChannelEventQueue.h:324
7 	XUL 	mozilla::SchedulerGroup::Runnable::Run() 	xpcom/threads/SchedulerGroup.cpp:396
8 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1039
9 	XUL 	NS_ProcessNextEvent(nsIThread*, bool) 	xpcom/threads/nsThreadUtils.cpp:521
10 	XUL 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp:97
11 	XUL 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:326
12 	XUL 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp:158
13 	XUL 	nsAppShell::Run() 	widget/cocoa/nsAppShell.mm:717
14 	XUL 	XRE_RunAppShell() 	toolkit/xre/nsEmbedFunctions.cpp:866
15 	XUL 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc:326
16 	XUL 	XRE_InitChildProcess(int, char**, XREChildData const*) 	toolkit/xre/nsEmbedFunctions.cpp:691
17 	plugin-container 	main 	ipc/contentproc/plugin-container.cpp:63
18 	plugin-container 	start

crash reports with this signature started showing up since 57.0a1 build 20170831220208 with MOZ_RELEASE_ASSERT(!mClosed) that got added in bug 1394724.

Comment 1

[JW Wang [:jwwang] [:jw_wang]]

Is there any way to tell if the page crashed in private browsing mode? It appears to me most crash URLs are porn sites.

https://crash-stats.mozilla.com/signature/?version=57.0a1&signature=mozilla%3A%3AMediaCacheStream%3A%3ANotifyDataReceived&date=%3E%3D2017-08-15T07%3A20%3A06.000Z&date=%3C2017-09-15T07%3A20%3A06.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports

Comment 2

[[:philipp]]

hm, i don't know of any way of gathering that from a crash report

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

Below is my theory about the crash:

1. The user was browsing the site in private browsing mode.
2. The user closed the private window.
3. CloseStreamsForPrivateBrowsing() [a] was called when the last PB window exited.
4. MediaCacheStream::Close() was called to set mClosed to true.
5. Somehow, a new nsIChannel was created to download data and MediaCacheStream::NotifyDataReceived() was called.
6. The assertion MOZ_DIAGNOSTIC_ASSERT(!mClosed) failed for mClosed was true.

[a] http://searchfox.org/mozilla-central/rev/1c13d5cf85f904afb8976c02a80daa252b893fca/dom/media/MediaCache.cpp#676-684

Comment 4

[JW Wang [:jwwang] [:jw_wang]]

Attachment: Bug 1400155 - early return from NotifyDataReceived() when the stream is already closed.

See comment 3 for the detail. We can't assert !mClosed since NotifyDataReceived()
could be called after the stream is closed.

Review commit: https://reviewboard.mozilla.org/r/181170/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/181170/

Comment 5

[Benjamin Chen [:bechen]]

Comment on attachment 8909657 [details]
Bug 1400155 - early return from NotifyDataReceived() when the stream is already closed.

https://reviewboard.mozilla.org/r/181170/#review186372

::: commit-message-a93be:1
(Diff revision 1)
> +Bug 1400155 - early return from NotifyDataReceived() is the stream is already closed.

typo

Comment 6

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 8909657 [details]
Bug 1400155 - early return from NotifyDataReceived() when the stream is already closed.

https://reviewboard.mozilla.org/r/181170/#review186430

Comment 7

[JW Wang [:jwwang] [:jw_wang]]

Comment on attachment 8909657 [details]
Bug 1400155 - early return from NotifyDataReceived() when the stream is already closed.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/181170/diff/1-2/

Comment 8

[JW Wang [:jwwang] [:jw_wang]]

Thanks!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/84c535b614d5
early return from NotifyDataReceived() when the stream is already closed. r=gerald

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/84c535b614d5