1485362 - Crash in free | libavcodec.so.58.23.100@0x66a826

Status: RESOLVED DUPLICATE of bug 1486080

(Core :: Audio/Video: Playback, defect, P2)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-e72420d0-2269-4d56-98ec-981450180822.
=============================================================

Top 10 frames of crashing thread:

0 firefox free memory/build/mozjemalloc.cpp:3438
1 libavcodec.so.58.23.100 libavcodec.so.58.23.100@0x66a826 
2 libavcodec.so.58.23.100 libavcodec.so.58.23.100@0xc7c33f 
3 libavcodec.so.58.23.100 libavcodec.so.58.23.100@0x20a299 
4 libavcodec.so.58.23.100 libavcodec.so.58.23.100@0x9993a3 
5 libavutil.so.56.19.100 libavutil.so.56.19.100@0x6a95f 
6 libavcodec.so.58.23.100 libavcodec.so.58.23.100@0xcab0df 
7 libavcodec.so.58.23.100 libavcodec.so.58.23.100@0x6699d0 
8 libc-2.28.so libc-2.28.so@0x70905 
9 libnspr4.so PR_GetNumberOfProcessors nsprpub/pr/src/misc/prsystem.c:242

=============================================================

There are 2 crashes (from 1 installation) in nightly 63 with buildid 20180821220101. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1484242.

[1] https://hg.mozilla.org/mozilla-central/rev?node=80e04deb3282

Comment 1

[Jean-Yves Avenard [:jya]]

I don't see how.

bug 1484242 only moved the code to a different file and made no functional change when used from the MediaFormatReader. That would have caused the new code to appear in the backtrace however.

The code is otherwise 100% equivalent (when used from the MFR).
From the crash report looks like memory corruption

Comment 2

[Jean-Yves Avenard [:jya]]

Fairly certain this is the same as bug 1486080

Comment 3

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

Fixed in bug 1486080.