1899043 - Crash in [@ WelsDec::CWelsDecoder::FlushFrame]

Status: RESOLVED FIXED

(Core :: Audio/Video: GMP, defect)

Description

[Andrew Osmond [:aosmond] (he/him)]

Crash report: https://crash-stats.mozilla.org/report/index/00b5ee97-eba4-46ba-a3ba-a58920240520

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames:

0  gmpopenh264.dll  WelsDec::CWelsDecoder::FlushFrame(unsigned char**, TagBufferInfo*)  \\?\Z:\task_168263428371319\workspace\openh264\codec\decoder\plus\src\welsDecoderExt.cpp:925
1  gmpopenh264.dll  OpenH264VideoDecoder::Reset_w()  \\?\Z:\task_168263428371319\workspace\openh264\module\gmp-openh264.cpp:1133
2  xul.dll  mozilla::gmp::GMPRunnable::Run()  dom/media/gmp/GMPPlatform.cpp:39
3  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply<nsITargetShutdownTask, void...  xpcom/threads/nsThreadUtils.h:1085
3  xul.dll  std::invoke(mozilla::detail::RunnableMethodArguments<>::apply<nsITargetShutdo...  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/type_traits:1729
3  xul.dll  std::_Apply_impl(mozilla::detail::RunnableMethodArguments<>::apply<nsITargetS...  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/tuple:1077
3  xul.dll  std::apply(mozilla::detail::RunnableMethodArguments<>::apply<nsITargetShutdow...  /builds/worker/fetches/vs/VC/Tools/MSVC/14.39.33519/include/tuple:1088
3  xul.dll  mozilla::detail::RunnableMethodArguments<>::apply(nsITargetShutdownTask*, voi...  xpcom/threads/nsThreadUtils.h:1083
3  xul.dll  mozilla::detail::RunnableMethodImpl<nsITargetShutdownTask*, void (nsITargetSh...  xpcom/threads/nsThreadUtils.h:1134
4  xul.dll  MessageLoop::RunTask(already_AddRefed<nsIRunnable>)  ipc/chromium/src/base/message_loop.cc:493

Comment 1

[Andrew Osmond [:aosmond] (he/him)]

The Reset call can only be triggered via the GMPVideoDecoder, as the WebRTC decoder path doesn't use it:
https://searchfox.org/mozilla-central/rev/9508d23ab6de8b0734be2c95303515b08da1ce28/dom/media/platforms/agnostic/gmp/GMPVideoDecoder.cpp#455

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

My best guess is that we are calling Reset when the decoder failed to initialize in InitComplete, or we got a callback from Error/Terminate and should have prevented further use of decoder.

Comment 3

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1899043 - Ensure we consistently teardown GMP video decoder state.

This patch makes it so we are consistent in how we teardown the GMP
video decoder, in particular when we encounter an error callback from
the plugin. We may fail during a call to initialize the decoder for
example, and should not attempt to use any GMP APIs on our proxy after
it because its internal state is default initialized and it doesn't
check always for null pointers.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e468f6bfe6c8
Ensure we consistently teardown GMP video decoder state. r=media-playback-reviewers,padenot

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/e468f6bfe6c8