1764753 - Crash in [@ RtlpFreeHeapInternal | RtlFreeHeap | free_base | CPoolableObject::`vector deleting destructor'] and [@ CPlatform::PutWorkItem_NoPlatformLock]

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

20 crashes from 20 installations, all on Windows 10 or 11. Oldest build ID reported is Firefox 101.0a1 20220407212910. 4/4 crashes checked had modules of Intel drivers loaded.

Is this related to bug 1763280?

Crash report: https://crash-stats.mozilla.org/report/index/ae518c14-60b1-448f-a7ea-064810220414

Reason: STATUS_HEAP_CORRUPTION

Top 10 frames of crashing thread:

0 ntdll.dll RtlReportFatalFailure 
1 ntdll.dll RtlReportCriticalFailure 
2 ntdll.dll RtlpHeapHandleError 
3 ntdll.dll RtlpHpHeapHandleError 
4 ntdll.dll RtlpLogHeapFailure 
5 ntdll.dll RtlpFreeHeapInternal 
6 ntdll.dll RtlFreeHeap 
7 ucrtbase.dll free_base 
8 msvp9dec_store.dll virtual void* CPoolableObject::`vector deleting destructor' 
9 msvp9dec_store.dll virtual void CPoolableObject::_FinalRelease 

Comment 1

[Sotaro Ikeda [:sotaro]]

(In reply to Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout) from comment #0)

20 crashes from 20 installations, all on Windows 10 or 11. Oldest build ID reported is Firefox 101.0a1 20220407212910. 4/4 crashes checked had modules of Intel drivers loaded.

Is this related to bug 1763280?

Yes, it seems to be related to bug 1763280.

Comment 2

[Sotaro Ikeda [:sotaro]]

Majority of crashes happened under the following function calls. Then the crash might be related to hw decoder shutdown.

• RemoteDecoderManagerParent::~RemoteDecoderManagerParent()
• WMFVideoMFTManager::Shutdown()

Comment 3

[Sotaro Ikeda [:sotaro]]

I wonder if all IMFSamples need to be released before destroying video MFTDecoder. And created Bug 1766203 for it.

Comment 4

[Sotaro Ikeda [:sotaro]]

The crash seemed to be addressed by Bug 1766203.