Crash in [@ mozilla::media::TimeUnit::operator>=]

RESOLVED FIXED in Firefox 68

Status

()

defect
P2
critical
Rank:
15
RESOLVED FIXED
3 months ago
2 months ago

People

(Reporter: marcia, Assigned: alwu)

Tracking

({crash, regression})

Trunk
mozilla68
Unspecified
Windows 10
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox66 unaffected, firefox67 wontfix, firefox68 fixed)

Details

(crash signature)

Attachments

(1 attachment)

This bug is for crash report bp-4e82cd8d-a3ae-4a58-a334-b82350190313.

Seen while looking at nightly crash stats: https://bit.ly/2F49BQO. Small volume Windows crash which started in Build 20190312214352.

Possible regression range based on Build ID: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=52b03bc3489944b2f695b79754615edf7d38bd27&tochange=add98afa5f0ca1ca17aa87eaa045442a3e1fa07a

Top 10 frames of crashing thread:

0 xul.dll mozilla::media::TimeUnit::operator>= dom/media/TimeUnits.h
1 xul.dll void mozilla::MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically dom/media/MediaDecoderStateMachine.cpp:3404
2 xul.dll void mozilla::MediaDecoderStateMachine::DecodingState::Step dom/media/MediaDecoderStateMachine.cpp:2325
3 xul.dll void mozilla::MozPromise<bool, bool, 1>::ThenValue<`lambda at z:/task_1552427320/build/src/dom/media/MediaDecoderStateMachine.cpp:3468:28', `lambda at z:/task_1552427320/build/src/dom/media/MediaDecoderStateMachine.cpp:3472:28'>::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:716
4 xul.dll mozilla::MozPromise<bool, bool, 1>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:392
5 xul.dll nsresult mozilla::TaskQueue::Runner::Run xpcom/threads/TaskQueue.cpp:199
6 xul.dll nsresult nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:241
7 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1179
8 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:482
9 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:333

Rank: 15
Priority: -- → P2
Blocks: 1533777

No crash since 20190312214352, Marking as fix-optional until bug 1533777 is fixed so as to remove it from our regression triage review queue

Can someone look into this one?

thanks

Flags: needinfo?(drno)

Alistair maybe?

Flags: needinfo?(alwu)
Assignee

Comment 4

3 months ago

Keep NI, will check it later.

Assignee: nobody → alwu
Flags: needinfo?(drno)
Assignee

Comment 5

3 months ago

Hi, Pascal,
Could you add me into the cc list of bug 1533777?
Thank you.

Flags: needinfo?(pascalc)
Flags: needinfo?(pascalc)
Assignee

Comment 6

3 months ago

It seems to me that the crash is caused by the integer overflow when we're comparing a overflow clock time with a current media time.

Flags: needinfo?(alwu)
Assignee

Comment 7

3 months ago

It's possible to overflow when we do the position calculation, we should only store the position which won't cause the integer overflow when adding it to start time.

Assignee

Comment 8

3 months ago

After checking bug1540740 and bug1540746, it seems that the overflow were both caused by super large start time.
If start time is possible to contain some super large value, why we should not have a check after do the calulation?

Flags: needinfo?(jyavenard)

Comment 9

2 months ago
Pushed by alwu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/c5b4608a5987
ensure AudioSink always returning valid position. r=jya
Assignee

Updated

2 months ago
Flags: needinfo?(jyavenard)

Comment 10

2 months ago
bugherder
Status: NEW → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Assignee

Updated

2 months ago
Duplicate of this bug: 1544150
Crash Signature: [@ mozilla::media::TimeUnit::operator>=] → [@ mozilla::media::TimeUnit::operator>=] [@ mozilla::MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically]
Crash Signature: [@ mozilla::media::TimeUnit::operator>=] [@ mozilla::MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically] → [@ mozilla::media::TimeUnit::operator>=] [@ mozilla::MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically]
You need to log in before you can comment on or make changes to this bug.