1403426 - Crash in mozilla::net::UINT64Wrapper::Release in mozilla::TrackBuffersManager::RemoveFrames

Status: RESOLVED DUPLICATE of bug 1402681

(Core :: Audio/Video: Playback, defect)

Description

[Kan-Ru Chen [:kanru] (UTC+9)]

This bug was filed from the Socorro interface and is 
report bp-ad4b9494-4a97-4a1c-897b-9297d0170923.
=============================================================

The crash started from 20170922100051 build.
Regression range: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ca7d18dbacbf103d74a3213d8d08a7c3e4def9a2&tochange=2cd3752963fc8f24f7c202687eab55e83222f608

Crashing Thread (32), Name: MediaPlayback #2
mozilla::net::UINT64Wrapper::Release()
RefPtr<mozilla::MediaDataDecoder>::~RefPtr<mozilla::MediaDataDecoder>()
RefPtr<mozilla::MediaRawData>::`scalar deleting destructor'(unsigned int)
nsTArray_Impl<RefPtr<mozilla::MediaRawData>, nsTArrayInfallibleAllocator>::DestructRange(unsigned __int64, unsigned __int64)
nsTArray_Impl<RefPtr<mozilla::MediaRawData>, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned __int64, unsigned __int64)
mozilla::TrackBuffersManager::RemoveFrames(mozilla::media::TimeIntervals const&, mozilla::TrackBuffersManager::TrackData&, unsigned int)
mozilla::TrackBuffersManager::CodedFrameRemoval(mozilla::media::Interval<mozilla::media::TimeUnit>)
mozilla::TrackBuffersManager::DoEvictData(mozilla::media::TimeUnit const&, __int64)
mozilla::TrackBuffersManager::ProcessTasks()
mozilla::detail::RunnableMethodImpl<mozilla::dom::HTMLMediaElement::StreamSizeListener* const, void ( mozilla::dom::HTMLMediaElement::StreamSizeListener::*)(mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>), 1, 0, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> >::Run()
mozilla::TaskQueue::Runner::Run()

:jya, :jw, the regression range contains several media related changes, could you take a look?

Comment 1

[Jean-Yves Avenard [:jya]]

This backtrace is nonsensical. There's no relationship between MediaRawData and MediaDataDecoder inheritance (which is shown between #1 and #2)

However, in other crash report https://crash-stats.mozilla.com/report/index/a8b3d953-ec7e-4469-b055-65c290170927 we can see the crash being related to the Source Buffer cycle collection, so I'm guessing it iCoold be a dupe of bug 1402681

Comment 2

[Jean-Yves Avenard [:jya]]

The crash is no longer seen since buildid 20170925100307

Comment 3

[Blake Wu [:bwu][:blakewu]]

Set 57 and 58 fixed per bug 1402681.