1832354 - Crash in [@ mozilla::detail::nsTStringLengthStorage<T>::operator unsigned long long]

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect, P3)

Description

[Andrew Osmond [:aosmond] (he/him)]

Crash report: https://crash-stats.mozilla.org/report/index/e90faf20-0257-4c87-a6ce-f52a30230509

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  mozilla::detail::nsTStringLengthStorage<char>::operator unsigned long long const  xpcom/string/nsTStringRepr.h:93
0  xul.dll  mozilla::detail::nsTStringRepr<char>::EqualsASCII const  xpcom/string/nsTStringRepr.cpp:83
1  xul.dll  mozilla::detail::nsTStringRepr<char>::EqualsLiteral const  xpcom/string/nsTStringRepr.h:278
1  xul.dll  mozilla::GMPVideoDecoder::Decode  dom/media/platforms/agnostic/gmp/GMPVideoDecoder.cpp:375
2  xul.dll  mozilla::MediaDataDecoderProxy::Decode::<lambda_19>::operator const  dom/media/platforms/wrappers/MediaDataDecoderProxy.cpp:31
2  xul.dll  mozilla::detail::ProxyFunctionRunnable<`lambda at /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaDataDecoderProxy.cpp:30:46', mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, 1> >::Run  xpcom/threads/MozPromise.h:1696
3  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1233
4  xul.dll  NS_ProcessNextEvent  xpcom/threads/nsThreadUtils.cpp:479
4  xul.dll  mozilla::ipc::MessagePumpForNonMainThreads::Run  ipc/glue/MessagePump.cpp:300
5  xul.dll  MessageLoop::RunInternal  ipc/chromium/src/base/message_loop.cc:369

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1832354 - Fix null pointer deref after GMP process crash.

When the GMP process crashes, we may still attempt to deref a null
pointer for the underlying IPDL object in the content process before we
finish shutting down the decoder.

This patch fixes the crash by checking for the null pointer, but also
now caches the plugin type as an enum for use elsewhere in the code.
This minimizes checking the display name of the plugin everywhere to
guess the plugin properties.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8a097cbf07cd
Fix null pointer deref after GMP process crash. r=media-playback-reviewers,alwu

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Marking 114 as affected because I will be requesting uplift. In theory users are unaffected because we disable the plugin decoder by default, but popular Linux distros enable it and will potentially hit this crash if/when the GMP process crashes.

Comment 4

[Sandor Molnar[:smolnar]]

Backed out on devs request

Backout link: https://hg.mozilla.org/integration/autoland/rev/30e32f80088d8bcdea4c59047bd437d72aa81b47

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f7f68725a323
Fix null pointer deref after GMP process crash. r=media-playback-reviewers,alwu

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/f7f68725a323

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:aosmond, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox114 to wontfix.

For more information, please visit BugBot documentation.