Closed Bug 523575 Opened 15 years ago Closed 15 years ago

random mochitest crash in content/media/test/test_playback_errors.html

Categories

(Core :: Audio/Video, defect)

Product:
Core
Component:
Audio/Video
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: dbaron, Assigned: kinetik)

References

Details

Attachments

(2 files)

crashing stack
45.47 KB, text/plain
Details
test file
39.63 KB, video/ogg
Details
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256130056.1256131048.4978.gz WINNT 5.2 mozilla-central test mochitests on 2009/10/21 06:00:56 had a random crash of mochitest-plain, with the last output before the crash being: 40931 INFO Running /tests/content/media/test/test_playback_errors.html... 40932 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | chain.ogv time should run forwards: p=1.5989999771118164 c=1.5989999771118164 40933 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | chain.ogv time should run forwards: p=0.2663329839706421 c=0.2663329839706421 40934 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | bogus.wav only one error fired 40935 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | bogus.ogv only one error fired 40936 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | 448636.ogv only one error fired 40937 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | bug495129.ogv only one error fired 40938 INFO TEST-PASS | /tests/content/media/test/test_playback_errors.html | bug504843.ogv only one error fired Stack walking on these boxes doesn't seem to be working.
bug 522829 is filed on stack walking not working. It's a buildbot config issue from switching to packaged unit tests.
Repro'd this, stack: > msvcr80d.dll!_free_dbg_nolock(void * pUserData=0x09930df8, int nBlockUse=1) Line 1333 + 0x3b bytes C++ msvcr80d.dll!_free_dbg(void * pUserData=0x09930df8, int nBlockUse=1) Line 1220 + 0xd bytes C++ msvcr80d.dll!free(void * pUserData=0x09930df8) Line 1178 + 0xb bytes C++ gklayout.dll!oggplay_data_free_list(_OggPlayDataHeader * list=0x09c2b770) Line 206 + 0xa bytes C gklayout.dll!oggplay_data_shutdown_list(OggPlayDecode * decode=0x0790b158) Line 217 + 0xc bytes C gklayout.dll!oggplay_callback_shutdown(OggPlayDecode * decoder=0x0790b158) Line 923 + 0x9 bytes C gklayout.dll!oggplay_close(_OggPlay * me=0x07349f60) Line 877 + 0x12 bytes C gklayout.dll!nsOggDecodeStateMachine::~nsOggDecodeStateMachine() Line 743 + 0xc bytes C++ gklayout.dll!nsOggDecodeStateMachine::`scalar deleting destructor'() + 0xf bytes C++ xpcom_core.dll!nsRunnable::Release() Line 51 + 0x90 bytes C++ gklayout.dll!nsCOMPtr<nsOggDecodeStateMachine>::assign_assuming_AddRef(nsOggDecodeStateMachine * newPtr=0x00000000) Line 496 C++ gklayout.dll!nsCOMPtr<nsOggDecodeStateMachine>::assign_with_AddRef(nsISupports * rawPtr=0x00000000) Line 1182 C++ gklayout.dll!nsCOMPtr<nsOggDecodeStateMachine>::operator=(nsOggDecodeStateMachine * rhs=0x00000000) Line 641 C++ gklayout.dll!nsOggDecoder::Stop() Line 1988 C++ gklayout.dll!nsRunnableMethod<nsOggDecoder,void>::Run() Line 265 C++ xpcom_core.dll!nsThread::ProcessNextEvent(int mayWait=1, int * result=0x0025f53c) Line 527 + 0x19 bytes C++ xpcom_core.dll!NS_ProcessNextEvent_P(nsIThread * thread=0x025a98c8, int mayWait=1) Line 230 + 0x16 bytes C++ gkwidget.dll!nsBaseAppShell::Run() Line 170 + 0xc bytes C++ toolkitcomps.dll!nsAppStartup::Run() Line 182 + 0x1c bytes C++ xul.dll!XRE_main(int argc=5, char * * argv=0x02811f88, const nsXREAppData * aAppData=0x025a39a0) Line 3471 + 0x25 bytes C++ firefox.exe!NS_internal_main(int argc=5, char * * argv=0x02811f88) Line 156 + 0x12 bytes C++ firefox.exe!wmain(int argc=5, wchar_t * * argv=0x0281e4d0) Line 110 + 0xd bytes C++
We crash when we load bug498380.ogv, which is in our test suite. This file contains 3 CMML packets, and when liboggplay comes to free this track's decoder, it crashes for some reason.
Considering the test file has been on trunk for a week or so and this only just started crashing, I'm suspicious of bug 523335 shaking this lose. I haven't been able to reproduce the crash on OS X yet, so no clues about what's going on yet.
My Windows box crashes loading bug498380.ogv, and that build didn't have the changeset from bug 523335. Maybe it's Windows only.
Attached video test file —
Test file that crashes (on Windows only, can't get it to crash on OS X), but doesn't hit the assert in oggz_close that was removed in bug 498380.
Not sure of the cause yet, but some notes: With my test file we're crashing here: http://hg.mozilla.org/mozilla-central/file/7f1f309a34f8/media/liboggplay/src/liboggplay/oggplay_data.c#l264 when we try to free the first list entry. Possibly looking at a double free where the list entry has been freed but left in the list. Disabling CMML here: http://hg.mozilla.org/mozilla-central/file/7f1f309a34f8/media/liboggplay/src/liboggplay/oggplay_callback.c#l827 is sufficient to avoid the crash. I can't see anything obviously wrong inside the CMML callbacks, though. After the CMML packets are processed, there are three entries in the data_list. The data of each record is garbage, because the three CMML packets in the file are presented to oggplay_callback_cmml twice. The first time they are treated (correctly) as the three CMML header packets. The second time through the callback treats them as data and the packet contents end up in the data_list. Nothing actually *uses* that data, so it doesn't matter too much, but it's still incorrect.
Assignee: nobody → kinetik
Could bug 523816 be a possible cause of this?
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256228466.1256228827.506.gz WINNT 5.2 mozilla-central test opt mochitests-1/5 on 2009/10/22 09:21:06
Posted a fix to bug 523816.
Depends on: 523816
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256277087.1256277556.20254.gz WINNT 5.2 mozilla-central test opt mochitests-1/5 on 2009/10/22 22:51:27 http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256310533.1256311143.12542.gz WINNT 5.2 mozilla-central test opt mochitests-1/5 on 2009/10/23 08:08:53
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256301095.1256301675.30298.gz WINNT 5.2 mozilla-central test mochitests-1/5 on 2009/10/23 05:31:35
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256313635.1256314628.21225.gz WINNT 5.2 mozilla-central test mochitests-1/5 on 2009/10/23 09:00:35
Fix checked in.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
http://tinderbox.mozilla.org/showlog.cgi?log=Firefox-Unittest/1256339628.1256340342.26351.gz WINNT 5.2 mozilla-central test opt mochitests-1/5 on 2009/10/23 16:13:48 (This orange cycle was built from changeset fdeaaf29f021, right before Matthew's checkin.)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: