1797292 - Crash in [@ RefPtr<T>::get | RefPtr<T>::operator-> | mozilla::gmp::ChromiumCDMParent::CreateVideoFrame]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Crash new in Firefox 106, Nightly 108 is still affected. There are 176 crash reports for 149 installations of Firefox 106 and 106.0.1

Brad, could you investigate this issue? (Could it be related to bug 1781122?)

Crash report: https://crash-stats.mozilla.org/report/index/5ddef371-a0c6-4e11-88e0-7adc90221025

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  RefPtr<mozilla::layers::Image>::get const  mfbt/RefPtr.h:286
0  xul.dll  RefPtr<mozilla::layers::Image>::operator-> const  mfbt/RefPtr.h:316
0  xul.dll  mozilla::gmp::ChromiumCDMParent::CreateVideoFrame  dom/media/gmp/ChromiumCDMParent.cpp:978
1  xul.dll  mozilla::gmp::ChromiumCDMParent::RecvDecodedShmem  dom/media/gmp/ChromiumCDMParent.cpp:893
2  xul.dll  mozilla::gmp::PChromiumCDMParent::OnMessageReceived  ipc/ipdl/PChromiumCDMParent.cpp:1404
3  xul.dll  mozilla::gmp::PGMPContentParent::OnMessageReceived  ipc/ipdl/PGMPContentParent.cpp:435
4  xul.dll  mozilla::ipc::MessageChannel::DispatchAsyncMessage  ipc/glue/MessageChannel.cpp:1756
4  xul.dll  mozilla::ipc::MessageChannel::DispatchMessage  ipc/glue/MessageChannel.cpp:1681
4  xul.dll  mozilla::ipc::MessageChannel::RunMessage  ipc/glue/MessageChannel.cpp:1481
4  xul.dll  mozilla::ipc::MessageChannel::MessageTask::Run  ipc/glue/MessageChannel.cpp:1579

Comment 1

[Brad Werth [:bradwerth]]

Yes, this is a regression from Bug 1781122.

Comment 2

[Brad Werth [:bradwerth]]

Attachment: Bug 1797292: Protect some pointers from null dereference.

The Image isn't guaranteed to be created in VideoData::CreateAndCopyData.

Comment 3

[Jim Mathies [:jimm]]

Might be worth considering an uplift and a ridealong if we have the chance.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/59403d4c9957
Protect some pointers from null dereference. r=media-playback-reviewers,alwu

Comment 5

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/59403d4c9957

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bradwerth, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox107 to wontfix.

For more information, please visit auto_nag documentation.

Comment 7

[Brad Werth [:bradwerth]]

Comment on attachment 9300171 [details]
Bug 1797292: Protect some pointers from null dereference.

Beta/Release Uplift Approval Request

• User impact if declined: Playback of DRM video may cause a crash in unusual circumstances, including low-memory situations.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This provides an early exit in one code path, very minimal risk.
• String changes made/needed:
• Is Android affected?: No

Comment 8

[Donal Meehan [:dmeehan]]

Comment on attachment 9300171 [details]
Bug 1797292: Protect some pointers from null dereference.

Approved for 107.0b6.

Comment 9

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/21a22ff733c8

Comment 10

[Brad Werth [:bradwerth]]

Comment on attachment 9300171 [details]
Bug 1797292: Protect some pointers from null dereference.

Beta/Release Uplift Approval Request

• User impact if declined: DRM video may not play correctly.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Code changes are minimal and easy to reason about.
• String changes made/needed:
• Is Android affected?: Unknown

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9300171 [details]
Bug 1797292: Protect some pointers from null dereference.

Approved for 106.0.4.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-release/rev/349928f1c0e7