Closed Bug 1533909 Opened 6 years ago Closed 6 years ago

crash near null in [@ mozilla::dom::CompareSimpleTextTrackEvents::LessThan]

Categories

(Core :: Audio/Video: Playback, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox-esr60 --- unaffected
firefox65 --- unaffected
firefox66 --- unaffected
firefox67 --- fixed

People

(Reporter: tsmith, Assigned: alwu)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(4 files)

Attached file testcase.html

Found with m-c 20190308-54ed5eac2abc

==2345==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000038 (pc 0x7f3855a76902 bp 0x7ffc020cb9b0 sp 0x7ffc020cb970 T0)
==2345==The signal is caused by a READ memory access.
==2345==Hint: address points to the zero page.
    #0 0x7f3855a76901 in Hdr src/obj-firefox/dist/include/nsTArray.h:490:32
    #1 0x7f3855a76901 in Elements src/obj-firefox/dist/include/nsTArray.h:1021
    #2 0x7f3855a76901 in IndexOf<mozilla::dom::TextTrackCue *, nsDefaultComparator<RefPtr<mozilla::dom::TextTrackCue>, mozilla::dom::TextTrackCue *> > src/obj-firefox/dist/include/nsTArray.h:1167
    #3 0x7f3855a76901 in IndexOf<mozilla::dom::TextTrackCue *> src/obj-firefox/dist/include/nsTArray.h:1185
    #4 0x7f3855a76901 in mozilla::dom::CompareSimpleTextTrackEvents::LessThan(mozilla::dom::SimpleTextTrackEvent*, mozilla::dom::SimpleTextTrackEvent*) const src/dom/html/TextTrackManager.cpp:538
    #5 0x7f3855a67cb3 in LessThan<const RefPtr<mozilla::dom::SimpleTextTrackEvent>, mozilla::dom::SimpleTextTrackEvent *> src/obj-firefox/dist/include/nsTArray.h:820:24
    #6 0x7f3855a67cb3 in Compare<const RefPtr<mozilla::dom::SimpleTextTrackEvent>, mozilla::dom::SimpleTextTrackEvent *> src/obj-firefox/dist/include/nsTArray.h:810
    #7 0x7f3855a67cb3 in operator() src/obj-firefox/dist/include/nsTArray.h:1514
    #8 0x7f3855a67cb3 in BinarySearchIf<const RefPtr<mozilla::dom::SimpleTextTrackEvent> *, (lambda at /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h:1513:20)> src/obj-firefox/dist/include/mozilla/BinarySearch.h:79
    #9 0x7f3855a67cb3 in IndexOfFirstElementGt<mozilla::dom::SimpleTextTrackEvent *&, mozilla::dom::CompareSimpleTextTrackEvents> src/obj-firefox/dist/include/nsTArray.h:1512
    #10 0x7f3855a67cb3 in RefPtr<mozilla::dom::SimpleTextTrackEvent>* nsTArray_Impl<RefPtr<mozilla::dom::SimpleTextTrackEvent>, nsTArrayInfallibleAllocator>::InsertElementSorted<mozilla::dom::SimpleTextTrackEvent*&, mozilla::dom::CompareSimpleTextTrackEvents, nsTArrayInfallibleAllocator>(mozilla::dom::SimpleTextTrackEvent*&, mozilla::dom::CompareSimpleTextTrackEvents const&) src/obj-firefox/dist/include/nsTArray.h:1532
    #11 0x7f3855a61b30 in mozilla::dom::TextTrackManager::TimeMarchesOn() src/dom/html/TextTrackManager.cpp:788:17
    #12 0x7f3855a5e428 in mozilla::dom::TextTrackManager::AddCues(mozilla::dom::TextTrack*) src/dom/html/TextTrackManager.cpp:202:5
    #13 0x7f3855a5dc8b in mozilla::dom::TextTrackManager::AddTextTrack(mozilla::dom::TextTrackKind, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&, mozilla::dom::TextTrackMode, mozilla::dom::TextTrackReadyState, mozilla::dom::TextTrackSource) src/dom/html/TextTrackManager.cpp:159:3
    #14 0x7f385597e472 in mozilla::dom::HTMLMediaElement::AddTextTrack(mozilla::dom::TextTrackKind, nsTSubstring<char16_t> const&, nsTSubstring<char16_t> const&) src/dom/html/HTMLMediaElement.cpp:6706:41
    #15 0x7f3854969304 in mozilla::dom::HTMLMediaElement_Binding::addTextTrack(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLMediaElement*, JSJitMethodCallArgs const&) src/obj-firefox/dom/bindings/HTMLMediaElementBinding.cpp:1761:61
    #16 0x7f3854d28171 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3144:13
    #17 0x7f385c395687 in CallJSNative src/js/src/vm/Interpreter.cpp:440:13
    #18 0x7f385c395687 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:532
    #19 0x7f385c37cd80 in CallFromStack src/js/src/vm/Interpreter.cpp:591:10
    #20 0x7f385c37cd80 in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3056
    #21 0x7f385c35f6a8 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:420:10
    #22 0x7f385c395ff6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:13
    #23 0x7f385c397c42 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:603:8
    #24 0x7f385cf9ac49 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2623:10
    #25 0x7f3854334a39 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventListenerBinding.cpp:52:8
    #26 0x7f385558a742 in HandleEvent<mozilla::dom::EventTarget *> src/obj-firefox/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #27 0x7f385558a742 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1038
    #28 0x7f385558cd73 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1237:17
    #29 0x7f385556cef0 in HandleEvent src/obj-firefox/dist/include/mozilla/EventListenerManager.h:350:5
    #30 0x7f385556cef0 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:351
    #31 0x7f385556b5f5 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:589:14
    #32 0x7f3855571d63 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1048:11
    #33 0x7f38515a035e in nsContentUtils::MaybeFireNodeRemoved(nsINode*, nsINode*) src/dom/base/nsContentUtils.cpp:4478:5
    #34 0x7f3851c80a47 in nsINode::RemoveChild(nsINode&, mozilla::ErrorResult&) src/dom/base/nsINode.cpp:492:5
    #35 0x7f3855a13ad1 in mozilla::dom::HTMLTableElement::DeleteTFoot() src/dom/html/HTMLTableElement.cpp:621:14
    #36 0x7f3854aaca91 in SetTFoot src/obj-firefox/dist/include/mozilla/dom/HTMLTableElement.h:83:5
    #37 0x7f3854aaca91 in mozilla::dom::HTMLTableElement_Binding::set_tFoot(JSContext*, JS::Handle<JSObject*>, mozilla::dom::HTMLTableElement*, JSJitSetterCallArgs) src/obj-firefox/dom/bindings/HTMLTableElementBinding.cpp:429
    #38 0x7f3854d24587 in bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*) src/dom/bindings/BindingUtils.cpp:3097:8
    #39 0x7f385c395687 in CallJSNative src/js/src/vm/Interpreter.cpp:440:13
    #40 0x7f385c395687 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:532
    #41 0x7f385c39a6a5 in InternalCall src/js/src/vm/Interpreter.cpp:587:10
    #42 0x7f385c39a6a5 in Call src/js/src/vm/Interpreter.cpp:603
    #43 0x7f385c39a6a5 in js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) src/js/src/vm/Interpreter.cpp:741
    #44 0x7f385c9d6386 in SetExistingProperty(JSContext*, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyResult>, JS::ObjectOpResult&) src/js/src/vm/NativeObject.cpp:2939:8
    #45 0x7f385c9ce1b2 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) src/js/src/vm/NativeObject.cpp:2968:14
    #46 0x7f385c373a9d in SetProperty src/js/src/vm/ObjectOperations-inl.h:283:10
    #47 0x7f385c373a9d in SetPropertyOperation src/js/src/vm/Interpreter.cpp:267
    #48 0x7f385c373a9d in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:2834
    #49 0x7f385c35f6a8 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:420:10
    #50 0x7f385c395ff6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) src/js/src/vm/Interpreter.cpp:560:13
    #51 0x7f385c397c42 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:603:8
    #52 0x7f385cf9ac49 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2623:10
    #53 0x7f385432e989 in mozilla::dom::EventHandlerNonNull::Call(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) src/obj-firefox/dom/bindings/EventHandlerBinding.cpp:266:37
    #54 0x7f38555daf49 in void mozilla::dom::EventHandlerNonNull::Call<nsISupports*>(nsISupports* const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/obj-firefox/dist/include/mozilla/dom/EventHandlerBinding.h:363:12
    #55 0x7f38555d81d9 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) src/dom/events/JSEventHandler.cpp:205:12
    #56 0x7f385558a79a in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) src/dom/events/EventListenerManager.cpp:1042:51
    #57 0x7f385558cd73 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) src/dom/events/EventListenerManager.cpp:1237:17
    #58 0x7f385556cef0 in HandleEvent src/obj-firefox/dist/include/mozilla/EventListenerManager.h:350:5
    #59 0x7f385556cef0 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:351
    #60 0x7f385556b118 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) src/dom/events/EventDispatcher.cpp:553:16
    #61 0x7f3855571d63 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) src/dom/events/EventDispatcher.cpp:1048:11
    #62 0x7f385840f6e7 in nsDocumentViewer::LoadComplete(nsresult) src/layout/base/nsDocumentViewer.cpp:1102:7
    #63 0x7f385b252d0c in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) src/docshell/base/nsDocShell.cpp:6560:21
    #64 0x7f385b251e38 in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp:6361:7
    #65 0x7f385b2579a7 in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) src/docshell/base/nsDocShell.cpp
    #66 0x7f38500c6735 in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) src/uriloader/base/nsDocLoader.cpp:1313:3
    #67 0x7f38500c531c in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:872:14
    #68 0x7f38500bf951 in nsDocLoader::DocLoaderIsEmpty(bool) src/uriloader/base/nsDocLoader.cpp:710:9
    #69 0x7f38500c3570 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp:598:5
    #70 0x7f38500c4e44 in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) src/uriloader/base/nsDocLoader.cpp
    #71 0x7f384d89b9e7 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) src/netwerk/base/nsLoadGroup.cpp:568:22
    #72 0x7f38513e73bd in imgRequestProxy::RemoveFromLoadGroup() src/image/imgRequestProxy.cpp:404:15
    #73 0x7f38513f0d5a in imgRequestProxy::OnLoadComplete(bool) src/image/imgRequestProxy.cpp:1010:7
    #74 0x7f38513cea1c in operator() src/image/ProgressTracker.cpp:330:13
    #75 0x7f38513cea1c in void mozilla::image::ImageObserverNotifier<mozilla::image::ObserverTable const*>::operator()<void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&)::'lambda5'(mozilla::image::IProgressObserver*)>(mozilla::image::ObserverTable const*) src/image/ProgressTracker.cpp:260
    #76 0x7f38513cc1c6 in void mozilla::image::SyncNotifyInternal<mozilla::image::ObserverTable const*>(mozilla::image::ObserverTable const* const&, bool, unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:329:5
    #77 0x7f38513276f0 in operator() src/image/ProgressTracker.cpp:348:5
    #78 0x7f38513276f0 in Read<(lambda at /builds/worker/workspace/build/src/image/ProgressTracker.cpp:347:19)> src/image/CopyOnWrite.h:155
    #79 0x7f38513276f0 in mozilla::image::ProgressTracker::SyncNotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) src/image/ProgressTracker.cpp:347
    #80 0x7f3851334d4d in mozilla::image::RasterImage::NotifyProgress(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::Maybe<unsigned int> const&, mozilla::image::DecoderFlags, mozilla::image::SurfaceFlags) src/image/RasterImage.cpp:1617:28
    #81 0x7f38513460bf in NotifyForLoadEvent src/image/RasterImage.cpp:949:3
    #82 0x7f38513460bf in mozilla::image::RasterImage::OnImageDataComplete(nsIRequest*, nsISupports*, nsresult, bool) src/image/RasterImage.cpp:932
    #83 0x7f38513df886 in imgRequest::OnStopRequest(nsIRequest*, nsresult) src/image/imgRequest.cpp:782:26
    #84 0x7f384e22f182 in mozilla::net::HttpChannelChild::DoOnStopRequest(nsIRequest*, nsresult, nsISupports*) src/netwerk/protocol/http/HttpChannelChild.cpp:1238:16
    #85 0x7f384e23db96 in mozilla::net::HttpChannelChild::OnStopRequest(nsresult const&, mozilla::net::ResourceTimingStruct const&, mozilla::net::nsHttpHeaderArray const&) src/netwerk/protocol/http/HttpChannelChild.cpp:1117:5
    #86 0x7f384e512761 in mozilla::net::ChannelEventQueue::FlushQueue() src/netwerk/ipc/ChannelEventQueue.cpp:90:12
    #87 0x7f384e52d27e in CompleteResume src/obj-firefox/dist/include/mozilla/net/ChannelEventQueue.h:293:5
    #88 0x7f384e52d27e in mozilla::net::ChannelEventQueue::ResumeInternal()::CompleteResumeRunnable::Run() src/netwerk/ipc/ChannelEventQueue.cpp:148
    #89 0x7f384d5ddac5 in mozilla::SchedulerGroup::Runnable::Run() src/xpcom/threads/SchedulerGroup.cpp:295:32
    #90 0x7f384d61d351 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1179:14
    #91 0x7f384d62575d in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:482:10
    #92 0x7f384e8bf5af in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:88:21
    #93 0x7f384e79727e in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
    #94 0x7f384e79727e in RunHandler src/ipc/chromium/src/base/message_loop.cc:308
    #95 0x7f384e79727e in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #96 0x7f3857b7a883 in nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:137:27
    #97 0x7f385c0b64be in XRE_RunAppShell() src/toolkit/xre/nsEmbedFunctions.cpp:911:20
    #98 0x7f384e79727e in RunInternal src/ipc/chromium/src/base/message_loop.cc:315:10
    #99 0x7f384e79727e in RunHandler src/ipc/chromium/src/base/message_loop.cc:308
    #100 0x7f384e79727e in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:290
    #101 0x7f385c0b5613 in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:749:34
    #102 0x5591ab841874 in content_process_main src/browser/app/../../ipc/contentproc/plugin-container.cpp:49:28
    #103 0x5591ab841874 in main src/browser/app/nsBrowserApp.cpp:265
    #104 0x7f387137082f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #105 0x5591ab766efc in _start (/home/ubuntu/firefox/firefox+0x2defc)
Flags: in-testsuite?

Added the crash signature

Crash Signature: [@ mozilla::dom::CompareSimpleTextTrackEvents::LessThan ]

Alastor, I note you've touched this code recently, would you be comfortable taking a look at this?

Rank: 15
Flags: needinfo?(alwu)
Priority: -- → P2

Sure, will take a look.

Assignee: nobody → alwu
Flags: needinfo?(alwu)

According to the spec [1] step1, current cues should only contain cues which are in hidden or showing track.

[1] https://html.spec.whatwg.org/multipage/media.html#time-marches-on

In this comparison, we only process hidden or showing track which should not return null TextTrackCueList.

Pushed by alwu@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/440f5cace4fb part1 : 'current cues' should not contain cues which are in the disable track. r=jya https://hg.mozilla.org/integration/autoland/rev/c83f5ecdd6d6 part2 : add assertion to ensure we should always get a valid TextTrackCueList. r=jya https://hg.mozilla.org/integration/autoland/rev/af0f103d341d part3 : add a crash test. r=jya
Crash Signature: [@ mozilla::dom::CompareSimpleTextTrackEvents::LessThan ] → [@ mozilla::dom::CompareSimpleTextTrackEvents::LessThan ] [@ nsTArray_Impl<T>::IndexOf<T> | nsTArray_Impl<T>::IndexOf<T> | nsTArray_Impl<T>::InsertElementSorted<T> | mozilla::dom::TextTrackManager::TimeMarchesOn]
Flags: in-testsuite? → in-testsuite+
See Also: → 1537554
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: