1655175 - Crash in [@ mozilla::dom::HTMLMediaElement::MediaControlKeyListener::InitMediaAgent]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Description

[u608768]

This bug is for crash report bp-0b2ae810-1625-47cb-a93a-31df80200724.

Top 10 frames of crashing thread:

0 xul.dll mozilla::dom::HTMLMediaElement::MediaControlKeyListener::InitMediaAgent dom/html/HTMLMediaElement.cpp:555
1 xul.dll mozilla::dom::HTMLMediaElement::MediaControlKeyListener::Start dom/html/HTMLMediaElement.cpp:414
2 xul.dll mozilla::dom::HTMLMediaElement::StartListeningMediaControlKeyIfNeeded dom/html/HTMLMediaElement.cpp:7878
3 xul.dll mozilla::dom::HTMLMediaElement::MetadataLoaded dom/html/HTMLMediaElement.cpp:5529
4 xul.dll mozilla::MediaDecoder::MetadataLoaded dom/media/MediaDecoder.cpp:692
5 xul.dll mozilla::ChannelMediaDecoder::MetadataLoaded dom/media/ChannelMediaDecoder.cpp:543
6 xul.dll mozilla::detail::ListenerImpl<mozilla::AbstractThread, `lambda at /builds/worker/checkouts/gecko/dom/media/MediaEventSource.h:340:37', mozilla::UniquePtr<mozilla::MediaInfo, mozilla::DefaultDelete<mozilla::MediaInfo> >, mozilla::UniquePtr<nsDataHashtable<nsCStringHashKey, nsTString<char> >, mozilla::DefaultDelete<nsDataHashtable<nsCStringHashKey, nsTString<char> > > >, mozilla::MediaDecoderEventVisibility>::ApplyWithArgs dom/media/MediaEventSource.h:207
7 xul.dll mozilla::detail::RunnableMethodImpl<mozilla::detail::Listener<mozilla::UniquePtr<mozilla::MediaInfo, mozilla::DefaultDelete<mozilla::MediaInfo> >, mozilla::UniquePtr<nsDataHashtable<nsCStringHashKey, nsTString<char> >, mozilla::DefaultDelete<nsDataHashtable<nsCStringHashKey, nsTString<char> > > >, mozilla::MediaDecoderEventVisibility>*, void  xpcom/threads/nsThreadUtils.h:1240
8 xul.dll mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run xpcom/threads/TaskDispatcher.h:228
9 xul.dll mozilla::XPCOMThreadWrapper::Runner::Run xpcom/threads/AbstractThread.cpp:194

Started in build 20200723212842. Regression window: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=08c29f9d87799463cdf99ab81f08f62339b49328&tochange=1415430432706ec6b8c7590cda9b8ca87397e7a7.

alwu, could this have been bug 1654959?

Comment 1

[Alastor Wu [:alwu]]

Attachment: Bug 1655175 - avoid to access owner media element after unlink.

mOwner would be reset during CC unlink [1], so we should avoid to access it after unlink happens.

[1] https://searchfox.org/mozilla-central/rev/828f2319c0195d7f561ed35533aef6fe183e68e3/dom/html/HTMLMediaElement.cpp#2027

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7255ff741205
avoid to access owner media element after unlink. r=bryce

Comment 3

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/7255ff741205

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1653390

Comment 5

[Alastor Wu [:alwu]]

Comment on attachment 9166042 [details]
Bug 1655175 - avoid to access owner media element after unlink.

Beta/Release Uplift Approval Request

• User impact if declined: Crash in some contain situations.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: No
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This change prevents from accessing a null weak pointer, and it didn't introduce any new behavior or logic.
• String changes made/needed: No

Comment 6

[Julien Cristau [:jcristau] (back August 18)]

Is this bound to some nightly-only pref? Do we know why this spiked on July 23 but has hardly been seen since?

Comment 7

[Alastor Wu [:alwu]]

Not sure why it spiked only on July 23th. It's related to the media control which is only on by default on Nightly, however, AFAIK some users have already also enabled that on other version Firefox, so I think it's better to uplift this change on beta.

Comment 8

[Julien Cristau [:jcristau] (back August 18)]

Comment on attachment 9166042 [details]
Bug 1655175 - avoid to access owner media element after unlink.

We don't seem to be seeing this crash outside of nightly, so I'd rather let this ride the trains.