Closed Bug 1570684 Opened 3 years ago Closed 3 years ago

Crash in [@ mozilla::dom::MediaStreamTrack::Graph]

Categories

(Core :: Audio/Video: MediaStreamGraph, defect, P2)

70 Branch
Unspecified
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed

People

(Reporter: calixte, Assigned: pehrsons)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-82284bac-607d-4d7b-be78-fc9900190801.

Top 10 frames of crashing thread:

0 libxul.so mozilla::dom::MediaStreamTrack::Graph const dom/media/MediaStreamTrack.cpp:372
1 libxul.so mozilla::dom::MediaStreamAudioSourceNode::AttachToTrack dom/media/webaudio/MediaStreamAudioSourceNode.cpp:104
2 libxul.so mozilla::dom::MediaStreamAudioSourceNode::AttachToRightTrack dom/media/webaudio/MediaStreamAudioSourceNode.cpp:165
3 libxul.so mozilla::dom::MediaStreamAudioSourceNode::Init dom/media/webaudio/MediaStreamAudioSourceNode.cpp:82
4 libxul.so mozilla::dom::MediaStreamAudioSourceNode::Create dom/media/webaudio/MediaStreamAudioSourceNode.cpp:58
5 libxul.so mozilla::dom::AudioContext::CreateMediaStreamSource dom/media/webaudio/AudioContext.cpp:424
6 libxul.so mozilla::dom::AudioContext_Binding::createMediaStreamSource dom/bindings/AudioContextBinding.cpp:687
7 libxul.so bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3181
8 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:540
9 libxul.so Interpret js/src/vm/Interpreter.cpp:595

There are 3 crashes (from 1 installation) in nightly 70 with buildid 20190731215544. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1493613.

[1] https://hg.mozilla.org/mozilla-central/rev?node=c54cb3c10992

Flags: needinfo?(apehrson)
Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)
Priority: -- → P2

This could happen if the track has ended (mStream get reset to nullptr), and there's a path where we could call this on an ended track if mBehavior is not FollowChanges.

That this can crash after a track has ended is new behavior in bug 1493613, so the regression is correct.

I'm adding some asserts and an extra guard for this use case.

Pushed by pehrsons@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/09f4a86bd1e7
Don't access MediaStreamTrack::mStream after the track has ended. r=padenot
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.