1534993 - Crash in [@ mozilla::media::TimeUnit::operator>=]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Marcia Knous [:marcia]]

This bug is for crash report bp-4e82cd8d-a3ae-4a58-a334-b82350190313.

Seen while looking at nightly crash stats: https://bit.ly/2F49BQO. Small volume Windows crash which started in Build 20190312214352.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=52b03bc3489944b2f695b79754615edf7d38bd27&tochange=add98afa5f0ca1ca17aa87eaa045442a3e1fa07a

Top 10 frames of crashing thread:

0 xul.dll mozilla::media::TimeUnit::operator>= dom/media/TimeUnits.h
1 xul.dll void mozilla::MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically dom/media/MediaDecoderStateMachine.cpp:3404
2 xul.dll void mozilla::MediaDecoderStateMachine::DecodingState::Step dom/media/MediaDecoderStateMachine.cpp:2325
3 xul.dll void mozilla::MozPromise<bool, bool, 1>::ThenValue<`lambda at z:/task_1552427320/build/src/dom/media/MediaDecoderStateMachine.cpp:3468:28', `lambda at z:/task_1552427320/build/src/dom/media/MediaDecoderStateMachine.cpp:3472:28'>::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:716
4 xul.dll mozilla::MozPromise<bool, bool, 1>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:392
5 xul.dll nsresult mozilla::TaskQueue::Runner::Run xpcom/threads/TaskQueue.cpp:199
6 xul.dll nsresult nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:241
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1179
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:482
9 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:333

Comment 1

[Pascal Chevrel:pascalc (PTO until April 26)]

No crash since 20190312214352, Marking as fix-optional until bug 1533777 is fixed so as to remove it from our regression triage review queue

Comment 2

[Jean-Yves Avenard [:jya]]

Can someone look into this one?

thanks

Comment 3

[Jean-Yves Avenard [:jya]]

Alistair maybe?

Comment 4

[Alastor Wu [:alwu]]

Keep NI, will check it later.

Comment 5

[Alastor Wu [:alwu]]

Hi, Pascal,
Could you add me into the cc list of bug 1533777?
Thank you.

Comment 6

[Alastor Wu [:alwu]]

It seems to me that the crash is caused by the integer overflow when we're comparing a overflow clock time with a current media time.

Comment 7

[Alastor Wu [:alwu]]

Attachment: Bug 1534993 - ensure AudioSink always returning valid position.

It's possible to overflow when we do the position calculation, we should only store the position which won't cause the integer overflow when adding it to start time.

Comment 8

[Alastor Wu [:alwu]]

After checking bug1540740 and bug1540746, it seems that the overflow were both caused by super large start time.
If start time is possible to contain some super large value, why we should not have a check after do the calulation?

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c5b4608a5987
ensure AudioSink always returning valid position. r=jya

Comment 10

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/c5b4608a5987