1544150 - Crash in MediaDecoderStateMachine::UpdatePlaybackPositionPeriodically

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P3)

Description

[Nils Ohlmeier [:drno]]

I had https://www.noisli.com/ playing in the background for quite some time when suddenly the sound ended and I had a crash report in the tab instead.

https://crash-stats.mozilla.org/report/index/1c888f70-286a-4dff-94a5-aa8ee0190412#tab-details

Comment 1

[Jean-Yves Avenard [:jya]]

It's likely a dupe for bug 153377. This is the site that was reported in a few crashes.

Comment 2

[Alastor Wu [:alwu]]

Yep, it's also crashing in TimeUnit. I would mark this bug duplicated to bug1534993, which ensures that AudioSink would only return valid position.

Comment 3

[Alastor Wu [:alwu]]

Attachment: Crash bt

I'm able to reproduce this crash on OSX without having a fix from bug1534993. And it seems to me that we should not get overflow in this situation because I only ran this site for around 40 mins, the time didn't larger enough for integer overflow.

Now I'm checking this log to see if I can find something helpful for those similar TimeUnits crashes.

Comment 4

[Alastor Wu [:alwu]]

I think I found the real root cause, here we use int32 to process the input [1], but we should use int64...

[1] https://searchfox.org/mozilla-central/rev/0376cbf447efa16922c550da3bfd783b916e35d3/dom/media/TimeUnits.h#159-164

Comment 5

[Alastor Wu [:alwu]]

Attachment: Bug 1544150 - add new operator'%' to handle modular by TimeUnit.

The time value in TimeUnit is 64 bits so we should use int64 for operator "%" and "/", because most operations we do for TimeUnit is operated with int64.

In addition, using CheckedInt can also ensure we're not using the invalid input.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2b5c64a994b3
add new operator'%' to handle modular by TimeUnit. r=jya

Comment 7

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/2b5c64a994b3