466096 - Crash [@ nsStreamStrategy::~nsStreamStrategy()] when seeking in onseeked handler

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect)

Description

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: testcase - crashes on load on Windows

If you load testcase to follow on Windows Vista or XP, you get a crash. Crash is caused by a _DbgBreakPoint which triggers when we try to delete a lock which is held elsewhere.

Main thread stack:

ntdll.dll!_DbgBreakPoint@0() 	
nspr4.dll!PR_Assert(const char * s=0x10040ba4, const char * file=0x10040b04, int ln=216)  Line 550	C
nspr4.dll!PR_DestroyLock(PRLock * lock=0x072e7c80)  Line 216 + 0x1f bytes	C
gklayout.dll!nsStreamStrategy::~nsStreamStrategy()  Line 67 + 0xd bytes	C++
gklayout.dll!nsHttpStreamStrategy::~nsHttpStreamStrategy()  + 0x25 bytes	C++
gklayout.dll!nsHttpStreamStrategy::`scalar deleting destructor'()  + 0xf bytes	C++
gklayout.dll!nsAutoPtr<nsStreamStrategy>::~nsAutoPtr<nsStreamStrategy>()  Line 104 + 0x22 bytes	C++
gklayout.dll!nsMediaStream::~nsMediaStream()  Line 739 + 0x8 bytes	C++
gklayout.dll!nsChannelReader::~nsChannelReader()  Line 147 + 0xb bytes	C++
gklayout.dll!nsChannelReader::`scalar deleting destructor'()  + 0xf bytes	C++
gklayout.dll!nsAutoPtr<nsChannelReader>::assign(nsChannelReader * newPtr=0x00000000)  Line 71 + 0x1c bytes	C++
gklayout.dll!nsAutoPtr<nsChannelReader>::operator=(nsChannelReader * rhs=0x00000000)  Line 135	C++
gklayout.dll!nsOggDecoder::Stop()  Line 1360	C++
gklayout.dll!nsOggDecoder::PlaybackEnded()  Line 1438	C++
gklayout.dll!nsRunnableMethod<nsOggDecoder>::Run()  Line 265	C++
xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0027f578)  Line 511	C++
xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x00c83948, int mayWait=1)  Line 227 + 0x16 bytes	C++
gkwidget.dll!nsBaseAppShell::Run()  Line 170 + 0xc bytes	C++
tkitcmps.dll!nsAppStartup::Run()  Line 192 + 0x1c bytes	C++
xul.dll!XRE_main(int argc=4, char * * argv=0x00c70c00, const nsXREAppData * aAppData=0x00c76270)  Line 3264 + 0x25 bytes	C++
firefox.exe!NS_internal_main(int argc=4, char * * argv=0x00c70c00)  Line 156 + 0x12 bytes	C++
firefox.exe!wmain(int argc=4, wchar_t * * argv=0x00bed810)  Line 87 + 0xd bytes	C++
firefox.exe!__tmainCRTStartup()  Line 594 + 0x19 bytes	C
firefox.exe!wmainCRTStartup()  Line 414	C
kernel32.dll!@BaseThreadInitThunk@12()  + 0x12 bytes	
ntdll.dll!___RtlUserThreadStart@8()  + 0x27 bytes	
ntdll.dll!__RtlUserThreadStart@8()  + 0x1b bytes	

Ogg Decode thread stack:


ntdll.dll!_KiFastSystemCallRet@0() 	
ntdll.dll!_ZwWaitForSingleObject@12()  + 0xc bytes	
kernel32.dll!_WaitForSingleObjectEx@12()  + 0x84 bytes	
kernel32.dll!_WaitForSingleObject@8()  + 0x12 bytes	
nspr4.dll!_PR_MD_WAIT_CV(_MDCVar * cv=0x072e7da4, _MDLock * lock=0x072e7dfc, unsigned int timeout=4294967295)  Line 280 + 0x14 bytes	C
nspr4.dll!_PR_WaitCondVar(PRThread * thread=0x072aed18, PRCondVar * cvar=0x072e7d30, PRLock * lock=0x072e7de0, unsigned int timeout=4294967295)  Line 204 + 0x17 bytes	C
nspr4.dll!PR_Wait(PRMonitor * mon=0x047627c8, unsigned int ticks=4294967295)  Line 175 + 0x1d bytes	C
xpcom_core.dll!nsAutoMonitor::Wait(unsigned int interval=4294967295)  Line 340 + 0x11 bytes	C++
xpcom_core.dll!nsPipeInputStream::Wait()  Line 654	C++
xpcom_core.dll!nsPipeInputStream::ReadSegments(unsigned int (nsIInputStream *, void *, const char *, unsigned int, unsigned int, unsigned int *)* writer=0x6b2c3cf0, void * closure=0x0468f690, unsigned int count=8192, unsigned int * readCount=0x088bf67c)  Line 778 + 0x8 bytes	C++
xpcom_core.dll!nsPipeInputStream::Read(char * toBuf=0x0468f690, unsigned int bufLen=8192, unsigned int * readCount=0x088bf67c)  Line 828	C++
gklayout.dll!nsHttpStreamStrategy::Read(char * aBuffer=0x0468f690, unsigned int aCount=8192, unsigned int * aBytes=0x088bf67c)  Line 488 + 0x28 bytes	C++
gklayout.dll!nsMediaStream::Read(char * aBuffer=0x0468f690, unsigned int aCount=8192, unsigned int * aBytes=0x088bf67c)  Line 785 + 0x24 bytes	C++
gklayout.dll!nsChannelReader::io_read(char * aBuffer=0x0468f690, unsigned int aCount=8192)  Line 80 + 0x17 bytes	C++
gklayout.dll!oggplay_channel_reader_io_read(void * aReader=0x00c7ae38, void * aBuffer=0x0468f690, unsigned int aCount=8192)  Line 122	C++
gklayout.dll!oggz_io_read(_OGGZ * oggz=0x0476e010, void * buf=0x0468f690, unsigned int n=8192)  Line 71 + 0x16 bytes	C
gklayout.dll!oggz_read(_OGGZ * oggz=0x0476e010, long n=8192)  Line 616 + 0x11 bytes	C
gklayout.dll!oggplay_initialise(_OggPlay * me=0x0495c108, int block=0)  Line 103 + 0x11 bytes	C
gklayout.dll!oggplay_open_with_reader(_OggPlayReader * reader=0x00c7ae38)  Line 137 + 0xb bytes	C
gklayout.dll!nsOggDecodeStateMachine::LoadOggHeaders()  Line 1064 + 0x11 bytes	C++
gklayout.dll!nsOggDecodeStateMachine::Run()  Line 857	C++
xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x088bf87c)  Line 511	C++
xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x072c3a80, int mayWait=1)  Line 227 + 0x16 bytes	C++
xpcom_core.dll!nsThread::ThreadFunc(void * arg=0x072c3a80)  Line 254 + 0xb bytes	C++
nspr4.dll!_PR_NativeRunThread(void * arg=0x072aed18)  Line 436 + 0xf bytes	C
nspr4.dll!pr_root(void * arg=0x072aed18)  Line 122 + 0xf bytes	C
msvcr80d.dll!_callthreadstartex()  Line 348 + 0xf bytes	C
msvcr80d.dll!_threadstartex(void * ptd=0x02c2e418)  Line 331	C
kernel32.dll!@BaseThreadInitThunk@12()  + 0x12 bytes	
ntdll.dll!___RtlUserThreadStart@8()  + 0x27 bytes	
ntdll.dll!__RtlUserThreadStart@8()  + 0x1b bytes	

This crashes on load on Windows. If you load it on Ubuntu 7.10, it loads, but if you click play on the video controls, you get a crash. I'll file a separate bug for that. I've not tried it on MacOS.

Comment 1

[Chris Pearce [:cpearce (Not reading bugmail)]]

Matthew Gregan tells me we crash on Mac too, and pointed out the obvious, that video's src is not a valid Ogg file, but we're still firing onfirstframeloaded, and onmetadataloaded. We really shouldn't be firing events when we've not got a valid media resource. We should check the return value of DecodeFrame() in the DECODER_STATE_DECODING_FIRSTFRAME case of nsOggDecodeStateMachine::Run(), and do something sensible on failure.

Comment 2

[Matthew Gregan [:kinetik]]

For the metadataloaded case, we only fire the event if oggplay_open_with_reader returned a valid OggPlayReader, which implies that oggplay_open_with_reader thinks the data coming from the reader looks like a valid Ogg.

Comment 3

[cajbir (:cajbir)]

The error handling that was removed from bug 449159 in the last patch review needs to be added back in basically. That detected invalid oggs and raised an error.

Comment 4

[cajbir (:cajbir)]

See bug 449159, comment 47. Robert raises some questions about it.

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Setting blocked by bug 465458, because when we decide a load has failed, we should attempt to load the next resource in the candidate resource list (as per the spec). At the moment we can only fail outright, so once bug 465458 has landed, we can fix this properly.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: mozilla-central\content\media\video\test\seek.ogg

Ogg file, about 4 seconds long. Uploading so I don't have to keep linking to videos on my own server in test cases.

Comment 7

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Testcase - infinite playback ended

This bug has a by product that because nsOggDecoder doesn't notice that it's loading an invalid video when src="", we end up firing infinite playback-ended events when changing that src of an element in a "ended" handler. See attached testcase.

Comment 8

[Robert O'Callahan (:roc) (email my personal email if necessary)]

I think we fixed the issues here.