Closed Bug 1594794 Opened 8 months ago Closed 8 months ago

NULL Crash in MediaKeySystemAccessManager::CheckDoesWindowSupportProtectedMedia

Categories

(Core :: Audio/Video: GMP, defect, P3)

72 Branch
defect

Tracking

()

RESOLVED FIXED
mozilla72
Tracking Status
firefox72 --- fixed

People

(Reporter: thomasmo, Assigned: thomasmo)

References

(Regression)

Details

Crash Data

Attachments

(1 file)

Repro steps:

  • On Windows build, disable e10s
  • Navigate to https://permission.site/
  • click 'Encrypted Media'
    Expected: button turns green
    Actual: crash
	xul.dll!RefPtr<mozilla::dom::BrowserChild>::operator->() Line 306	C++
 	xul.dll!mozilla::dom::MediaKeySystemAccessManager::CheckDoesWindowSupportProtectedMedia(mozilla::UniquePtr<mozilla::dom::MediaKeySystemAccessManager::PendingRequest,mozilla::DefaultDelete<mozilla::dom::MediaKeySystemAccessManager::PendingRequest> > aRequest) Line 135	C++
 	xul.dll!mozilla::dom::MediaKeySystemAccessManager::Request(mozilla::dom::DetailedPromise * aPromise, const nsTSubstring<char16_t> & aKeySystem, const mozilla::dom::Sequence<mozilla::dom::MediaKeySystemConfiguration> & aConfigs) Line 119	C++
 	xul.dll!mozilla::dom::Navigator::RequestMediaKeySystemAccess(const nsTSubstring<char16_t> & aKeySystem, const mozilla::dom::Sequence<mozilla::dom::MediaKeySystemConfiguration> & aConfigs, mozilla::ErrorResult & aRv) Line 1962	C++
 	xul.dll!mozilla::dom::Navigator_Binding::requestMediaKeySystemAccess(JSContext * cx, JS::Handle<JSObject *> obj, mozilla::dom::Navigator * self, const JSJitMethodCallArgs & args) Line 2049	C++
 	xul.dll!mozilla::dom::Navigator_Binding::requestMediaKeySystemAccess_promiseWrapper(JSContext * cx, JS::Handle<JSObject *> obj, mozilla::dom::Navigator * self, const JSJitMethodCallArgs & args) Line 2065	C++
 	xul.dll!mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ConvertExceptionsToPromises>(JSContext * cx, unsigned int argc, JS::Value * vp) Line 3218	C++
 	xul.dll!CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, js::CallReason reason, const JS::CallArgs & args) Line 456	C++
 	xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct, js::CallReason reason) Line 548	C++
 	xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args, js::CallReason reason) Line 617	C++
 	xul.dll!js::CallFromStack(JSContext * cx, const JS::CallArgs & args) Line 621	C++
 	xul.dll!Interpret(JSContext * cx, js::RunState & state) Line 3110	C++
 	xul.dll!js::RunScript(JSContext * cx, js::RunState & state) Line 423	C++
 	xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct, js::CallReason reason) Line 589	C++
 	xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args, js::CallReason reason) Line 617	C++
 	xul.dll!js::Call(JSContext * cx, JS::Handle<JS::Value> fval, JS::Handle<JS::Value> thisv, const js::AnyInvokeArgs & args, JS::MutableHandle<JS::Value> rval, js::CallReason reason) Line 634	C++
 	xul.dll!JS::Call(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> fval, const JS::HandleValueArray & args, JS::MutableHandle<JS::Value> rval) Line 2718	C++
 	xul.dll!mozilla::dom::EventListener::HandleEvent(JSContext * cx, JS::Handle<JS::Value> aThisVal, mozilla::dom::Event & event, mozilla::ErrorResult & aRv) Line 52	C++
 	xul.dll!mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget *>(mozilla::dom::EventTarget * const & thisVal, mozilla::dom::Event & event, mozilla::ErrorResult & aRv, const char * aExecutionReason, mozilla::dom::CallbackObject::ExceptionHandling aExceptionHandling, JS::Realm * aRealm) Line 66	C++
 	xul.dll!mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener * aListener, mozilla::dom::Event * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget) Line 1035	C++
 	xul.dll!mozilla::EventListenerManager::HandleEventInternal(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus, bool aItemInShadowTree) Line 1230	C++
 	xul.dll!mozilla::EventListenerManager::HandleEvent(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * * aDOMEvent, mozilla::dom::EventTarget * aCurrentTarget, nsEventStatus * aEventStatus, bool aItemInShadowTree) Line 355	C++
 	xul.dll!mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor & aVisitor, mozilla::ELMCreationDetector & aCd) Line 352	C++
 	xul.dll!mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem> & aChain, mozilla::EventChainPostVisitor & aVisitor, mozilla::EventDispatchingCallback * aCallback, mozilla::ELMCreationDetector & aCd) Line 553	C++
 	xul.dll!mozilla::EventDispatcher::Dispatch(nsISupports * aTarget, nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, mozilla::dom::Event * aDOMEvent, nsEventStatus * aEventStatus, mozilla::EventDispatchingCallback * aCallback, nsTArray<mozilla::dom::EventTarget *> * aTargets) Line 1052	C++
 	xul.dll!mozilla::PresShell::EventHandler::DispatchEventToDOM(mozilla::WidgetEvent * aEvent, nsEventStatus * aEventStatus, nsPresShellEventCB * aEventCB) Line 8233	C++
 	xul.dll!mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager * aEventStateManager, mozilla::WidgetEvent * aEvent, bool aTouchIsNew, nsEventStatus * aEventStatus, nsIContent * aOverrideClickTarget) Line 7797	C++
 	xul.dll!mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent * aEvent, nsEventStatus * aEventStatus, bool aIsHandlingNativeEvent, nsIContent * aOverrideClickTarget) Line 7727	C++
 	xul.dll!mozilla::PresShell::EventHandler::HandleEventWithTarget(mozilla::WidgetEvent * aEvent, nsIFrame * aNewEventFrame, nsIContent * aNewEventContent, nsEventStatus * aEventStatus, bool aIsHandlingNativeEvent, nsIContent * * aTargetContent, nsIContent * aOverrideClickTarget) Line 7614	C++
 	xul.dll!mozilla::PresShell::HandleEventWithTarget(mozilla::WidgetEvent * aEvent, nsIFrame * aFrame, nsIContent * aContent, nsEventStatus * aEventStatus, bool aIsHandlingNativeEvent, nsIContent * * aTargetContent, nsIContent * aOverrideClickTarget) Line 653	C++
 	xul.dll!mozilla::EventStateManager::InitAndDispatchClickEvent(mozilla::WidgetMouseEvent * aMouseUpEvent, nsEventStatus * aStatus, mozilla::EventMessage aMessage, mozilla::PresShell * aPresShell, nsIContent * aMouseUpContent, AutoWeakFrame aCurrentTarget, bool aNoContentDispatch, nsIContent * aOverrideClickTarget) Line 5000	C++
 	xul.dll!mozilla::EventStateManager::DispatchClickEvents(mozilla::PresShell * aPresShell, mozilla::WidgetMouseEvent * aMouseUpEvent, nsEventStatus * aStatus, nsIContent * aClickTarget, nsIContent * aOverrideClickTarget) Line 5101	C++
 	xul.dll!mozilla::EventStateManager::PostHandleMouseUp(mozilla::WidgetMouseEvent * aMouseUpEvent, nsEventStatus * aStatus, nsIContent * aOverrideClickTarget) Line 5044	C++
 	xul.dll!mozilla::EventStateManager::PostHandleEvent(nsPresContext * aPresContext, mozilla::WidgetEvent * aEvent, nsIFrame * aTargetFrame, nsEventStatus * aStatus, nsIContent * aOverrideClickTarget) Line 3379	C++
 	xul.dll!mozilla::PresShell::EventHandler::DispatchEvent(mozilla::EventStateManager * aEventStateManager, mozilla::WidgetEvent * aEvent, bool aTouchIsNew, nsEventStatus * aEventStatus, nsIContent * aOverrideClickTarget) Line 7819	C++
 	xul.dll!mozilla::PresShell::EventHandler::HandleEventWithCurrentEventInfo(mozilla::WidgetEvent * aEvent, nsEventStatus * aEventStatus, bool aIsHandlingNativeEvent, nsIContent * aOverrideClickTarget) Line 7727	C++
 	xul.dll!mozilla::PresShell::EventHandler::HandleEventUsingCoordinates(nsIFrame * aFrameForPresShell, mozilla::WidgetGUIEvent * aGUIEvent, nsEventStatus * aEventStatus, bool aDontRetargetEvents) Line 6686	C++
 	xul.dll!mozilla::PresShell::EventHandler::HandleEvent(nsIFrame * aFrameForPresShell, mozilla::WidgetGUIEvent * aGUIEvent, bool aDontRetargetEvents, nsEventStatus * aEventStatus) Line 6491	C++
 	xul.dll!mozilla::PresShell::HandleEvent(nsIFrame * aFrameForPresShell, mozilla::WidgetGUIEvent * aGUIEvent, bool aDontRetargetEvents, nsEventStatus * aEventStatus) Line 6419	C++
 	xul.dll!nsViewManager::DispatchEvent(mozilla::WidgetGUIEvent * aEvent, nsView * aView, nsEventStatus * aStatus) Line 751	C++
 	xul.dll!nsView::HandleEvent(mozilla::WidgetGUIEvent * aEvent, bool aUseAttachedEvents) Line 1065	C++
 	xul.dll!nsWindow::DispatchEvent(mozilla::WidgetGUIEvent * event, nsEventStatus & aStatus) Line 3990	C++
 	xul.dll!nsBaseWidget::DispatchInputEvent(mozilla::WidgetInputEvent * aEvent) Line 1151	C++
 	xul.dll!nsWindow::DispatchMouseEvent(mozilla::EventMessage aEventMessage, unsigned __int64 wParam, __int64 lParam, bool aIsContextMenuKey, short aButton, unsigned short aInputSource, WinPointerInfo * aPointerInfo) Line 4469	C++
 	xul.dll!nsWindow::ProcessMessage(unsigned int msg, unsigned __int64 & wParam, __int64 & lParam, __int64 * aRetValue) Line 5447	C++
 	xul.dll!nsWindow::WindowProcInternal(HWND__ * hWnd, unsigned int msg, unsigned __int64 wParam, __int64 lParam) Line 4803	C++
 	xul.dll!CallWindowProcCrashProtected(__int64(*)(HWND__ *, unsigned int, unsigned __int64, __int64) aWndProc, HWND__ * aHWnd, unsigned int aMsg, unsigned __int64 aWParam, __int64 aLParam) Line 27	C++
 	xul.dll!nsWindow::WindowProc(HWND__ * hWnd, unsigned int msg, unsigned __int64 wParam, __int64 lParam) Line 4756	C++
 	[External Code]	
 	xul.dll!nsAppShell::ProcessNextNativeEvent(bool mayWait) Line 541	C++
 	xul.dll!nsBaseAppShell::DoProcessNextNativeEvent(bool mayWait) Line 120	C++
 	xul.dll!nsBaseAppShell::OnProcessNextEvent(nsIThreadInternal * thr, bool mayWait) Line 242	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 1121	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 486	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 88	C++
 	xul.dll!MessageLoop::RunInternal() Line 315	C++
 	xul.dll!MessageLoop::RunHandler() Line 309	C++
 	xul.dll!MessageLoop::Run() Line 291	C++
 	xul.dll!nsBaseAppShell::Run() Line 139	C++
 	xul.dll!nsAppShell::Run() Line 406	C++
 	xul.dll!nsAppStartup::Run() Line 276	C++
 	xul.dll!XREMain::XRE_mainRun() Line 4586	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const mozilla::BootstrapConfig & aConfig) Line 4721	C++
 	xul.dll!XRE_main(int argc, char * * argv, const mozilla::BootstrapConfig & aConfig) Line 4802	C++
 	xul.dll!mozilla::BootstrapImpl::XRE_main(int argc, char * * argv, const mozilla::BootstrapConfig & aConfig) Line 45	C++
 	firefox.exe!do_main(int argc, char * * argv, char * * envp) Line 218	C++
 	firefox.exe!NS_internal_main(int argc, char * * argv, char * * envp) Line 300	C++
 	firefox.exe!wmain(int argc, wchar_t * * argv) Line 131	C++
 	[External Code]	
Regressed by: 1581855

This change fixes a crash when there is no BrowserChild available (i.e., e10s is is turned off in Windows). In this case, the window is assumed to support protected media and will proceed without making the IPC call to check.

Priority: -- → P3
Pushed by tmoore@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/6fb4aa1b817d
NULL Crash in MediaKeySystemAccessManager::CheckDoesWindowSupportProtectedMedia r=bryce,bzbarsky
Status: NEW → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla72
Duplicate of this bug: 1601988
Crash Signature: [@ mozilla::dom::BrowserChild::DoesWindowSupportProtectedMedia]
Flags: qe-verify+
Regressions: 1608286
You need to log in before you can comment on or make changes to this bug.