1919423 - Crash in [@ mozilla::dom::MediaStreamTrack::GetSource]

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[BugBot [:suhaib / :marco/ :calixte]]

Crash report: https://crash-stats.mozilla.org/report/index/abf57857-938c-43e0-897e-477d60240917

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 10 frames of crashing thread:

0  xul.dll  RefPtr<mozilla::dom::MediaStreamTrackSource>::operator! const  mfbt/RefPtr.h:339
0  xul.dll  mozilla::dom::MediaStreamTrack::GetSource const  dom/media/MediaStreamTrack.h:483
0  xul.dll  mozilla::dom::MediaStreamTrack::GetTimestampMaker const  dom/media/MediaStreamTrack.h:475
0  xul.dll  mozilla::dom::HTMLVideoElement::TakeVideoFrameRequestCallbacks  dom/html/HTMLVideoElement.cpp:802
1  xul.dll  nsRefreshDriver::RunVideoFrameCallbacks  layout/base/nsRefreshDriver.cpp:2415
1  xul.dll  nsRefreshDriver::RunVideoAndFrameRequestCallbacks  layout/base/nsRefreshDriver.cpp:2537
1  xul.dll  nsRefreshDriver::Tick  layout/base/nsRefreshDriver.cpp:2772
2  xul.dll  mozilla::RefreshDriverTimer::TickDriver  layout/base/nsRefreshDriver.cpp:368
2  xul.dll  mozilla::RefreshDriverTimer::TickRefreshDrivers  layout/base/nsRefreshDriver.cpp:346
3  xul.dll  mozilla::RefreshDriverTimer::Tick  layout/base/nsRefreshDriver.cpp:362

By querying Nightly crashes reported within the last 2 months, here are some insights about the signature:

• First crash report: 2024-09-17
• Process type: Content
• Is startup crash: No
• Has user comments: No
• Is null crash: Yes - all crashes happened on null or near null memory address

By analyzing the backtrace, the regression may have been introduced by a patch to fix Bug 1908245.

:aosmond, since you are the author of the potential regressor, could you please take a look?

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1908245

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1919423 - Check for null selected track when fulfilling rVFC.

HTMLVideoElement's mSelectedVideoStreamTrack may be null when fulfilling
requestVideoFrameCallback requests. This can occur when we race tearing
down the current stream, while there are still frames in the
ImageContainer that reference it.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e88d5d13ebef
Check for null selected track when fulfilling rVFC. r=media-playback-reviewers,padenot

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/e88d5d13ebef