Closed
Bug 635400
Opened 14 years ago
Closed 14 years ago
crash [@ nsBuiltinDecoder::GetBuffered] [@ nsBuiltinDecoder::GetBuffered(nsTimeRanges*)]
Categories
(Core :: Audio/Video, defect)
Tracking
()
VERIFIED
FIXED
People
(Reporter: jdm, Assigned: kinetik)
Details
(Keywords: crash, Whiteboard: [4.0.1?])
Crash Data
Attachments
(1 file)
1.74 KB,
patch
|
cpearce
:
review+
dveditz
:
approval2.0+
|
Details | Diff | Splinter Review |
This bug was filed from the Socorro interface and is report bp-d34fadb9-8756-45b1-975c-d302b2110218 . ============================================================= 0 libxul.so nsBuiltinDecoder::GetBuffered content/media/nsBuiltinDecoder.h:445 1 libxul.so nsHTMLMediaElement::GetBuffered content/html/content/src/nsHTMLMediaElement.cpp:2568 2 libxul.so nsHTMLVideoElement::GetBuffered nsHTMLVideoElement.h:65 3 libxul.so NS_InvokeByIndex_P xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:199 4 libxul.so XPCWrappedNative::CallMethod js/src/xpconnect/src/xpcwrappednative.cpp:3072 5 libxul.so XPC_WN_GetterSetter js/src/xpconnect/src/xpcprivate.h:2643 6 libxul.so js::Invoke js/src/jscntxtinlines.h:697 7 libxul.so js::ExternalGetOrSet js/src/jsinterp.cpp:858 8 libxul.so js_GetProperty js/src/jsobj.cpp:5149 9 libxul.so js::mjit::ic::GetProp js/src/methodjit/PolyIC.cpp:1692 10 libxul.so libxul.so@0xb1d10a 11 libxul.so js::mjit::ic::GetProp js/src/methodjit/PolyIC.cpp:1635 12 libmozalloc.so je_free memory/jemalloc/jemalloc.c:1442 13 @0x4430313f 14 libxul.so js::mjit::JaegerShot js/src/jscntxt.h:2890 15 libxul.so js::Invoke js/src/jsinterp.cpp:654 16 libxul.so CallOrConstructBoundFunction js/src/jsfun.cpp:2290 17 libxul.so CallCompiler::generateNativeStub js/src/methodjit/MonoIC.cpp:667 18 libxul.so js::mjit::ic::NativeCall js/src/methodjit/MonoIC.cpp:874 19 libxul.so libxul.so@0xb1d10a 20 libxul.so js::mjit::ic::NativeCall js/src/methodjit/MonoIC.cpp:872 21 libxul.so js::mjit::JaegerShot js/src/jscntxt.h:2890 22 libxul.so js::Invoke js/src/jsinterp.cpp:654 23 libxul.so js::ExternalInvoke js/src/jsinterp.cpp:858 24 libxul.so JS_CallFunctionValue js/src/jsinterp.h:961 25 libxul.so nsXPCWrappedJSClass::CallMethod js/src/xpconnect/src/xpcwrappedjsclass.cpp:1702 26 libxul.so nsXPCWrappedJS::CallMethod js/src/xpconnect/src/xpcwrappedjs.cpp:589 27 libxul.so PrepareAndDispatch xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:134 28 libxul.so libxul.so@0x96990c 29 libxul.so nsEventListenerManager::HandleEventSubType content/events/src/nsEventListenerManager.cpp:1114 30 @0x441a30c7 31 libxul.so nsEventListenerManager::HandleEventInternal content/events/src/nsEventListenerManager.cpp:1209 32 libxul.so nsEventTargetChainItem::HandleEvent content/events/src/nsEventListenerManager.h:146 33 libxul.so nsEventTargetChainItem::HandleEventTargetChain content/events/src/nsEventDispatcher.cpp:343 34 libxul.so nsEventDispatcher::Dispatch content/events/src/nsEventDispatcher.cpp:630 35 libxul.so nsEventDispatcher::DispatchDOMEvent content/events/src/nsEventDispatcher.cpp:691 36 libxul.so nsEventListenerManager::DispatchEvent content/events/src/nsEventListenerManager.cpp:1333 37 libxul.so nsDOMEventRTTearoff::DispatchEvent content/base/src/nsGenericElement.cpp:1967 38 libxul.so nsContentUtils::DispatchTrustedEvent content/base/src/nsContentUtils.cpp:3397 39 libxul.so nsHTMLMediaElement::DispatchEvent content/html/content/src/nsHTMLMediaElement.cpp:2266 40 libxul.so nsAsyncEventRunner::Run content/html/content/src/nsHTMLMediaElement.cpp:210 41 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:633 42 libxul.so NS_ProcessNextEvent_P nsThreadUtils.cpp:250 43 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:111 44 libxul.so mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:230 45 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:220 46 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:512 47 libxul.so nsBaseAppShell::Run widget/src/xpwidgets/nsBaseAppShell.cpp:201 48 libxul.so XRE_RunAppShell toolkit/xre/nsEmbedFunctions.cpp:640 49 libxul.so mozilla::ipc::MessagePumpForChildProcess::Run ipc/glue/MessagePump.cpp:222 50 libxul.so MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:220 51 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:512 52 libxul.so XRE_InitChildProcess toolkit/xre/nsEmbedFunctions.cpp:519 53 libmozutils.so ChildProcessInit other-licenses/android/APKOpen.cpp:771 54 plugin-container main ipc/app/MozillaRuntimeMainAndroid.cpp:69 55 libc.so libc.so@0xd4e2 >virtual nsresult GetBuffered(nsTimeRanges* aBuffered) { > return mDecoderStateMachine->GetBuffered(aBuffered); >} mDecodertateMachine is null here.
Reporter | ||
Updated•14 years ago
|
Component: General → Video/Audio
Product: Fennec → Core
QA Contact: general → video.audio
Assignee | ||
Updated•14 years ago
|
Assignee: nobody → kinetik
Status: NEW → ASSIGNED
Reporter | ||
Comment 2•14 years ago
|
||
https://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2011-03-23%2016%3A00%3A00&signature=nsBuiltinDecoder%3A%3AGetBuffered&version=Fennec%3A4.0 Still seeing crashes in 4.0.
Status: VERIFIED → REOPENED
Resolution: FIXED → ---
Assignee | ||
Updated•14 years ago
|
Status: REOPENED → ASSIGNED
Assignee | ||
Comment 3•14 years ago
|
||
For the element's mDecoder to be valid but mDecoderStateMachine to be invalid, a call to nsMediaDecoder::Shutdown must have been made by something other than the element. There are three places I can see that happening: the shutdown observer, and in the NetworkError and DecodeError calls. I can reproduce this crash easily by inducing a NetworkError from a test server and then calling element.buffered.length.
Assignee | ||
Comment 4•14 years ago
|
||
Thanks for pointing out that this bug was still occurring.
No longer blocks: 631058
Assignee | ||
Comment 5•14 years ago
|
||
Fixes nsBuiltinDecoder and nsWaveDecoder. If bug 635649 lands before this one, it'll be covered by the fix in nsBuiltinDecoder.
Attachment #521416 -
Flags: review?(chris)
Updated•14 years ago
|
Attachment #521416 -
Flags: review?(chris) → review+
Comment 6•14 years ago
|
||
A testcase would be nice, can you induce a network error using sjs? I wouldn't stress to much about it if it's a hassle though.
Assignee | ||
Comment 7•14 years ago
|
||
It's testable, but painful to do reliably. I have an idea how to fix that, so I'll tag this to come back to when I deal with that.
Flags: in-testsuite?
Assignee | ||
Updated•14 years ago
|
Summary: crash [@ nsBuiltinDecoder::GetBuffered] → crash [@ nsBuiltinDecoder::GetBuffered] [@ nsBuiltinDecoder::GetBuffered(nsTimeRanges*)]
Assignee | ||
Comment 8•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/2026ba368286
Status: ASSIGNED → RESOLVED
Closed: 14 years ago → 14 years ago
Resolution: --- → FIXED
I'm not seeing a recent report of this crash -- VERIFIED FIXED
Status: RESOLVED → VERIFIED
Comment 10•14 years ago
|
||
This seems to be on the rise on 4.0 in the last days with almost all comments being about people trying Youtube's HTML5 stuff, and I think we really want HTML5 video to work, so as it looks like the fix works well on trunk, I'd like to nominate this to get into 4.0.1 if possible.
blocking2.0: --- → ?
Assignee | ||
Comment 11•14 years ago
|
||
I agree. This crash is very easy to hit on mobile due to unreliable network connectivity. The patch is very simple and low risk.
Updated•14 years ago
|
blocking2.0: ? → Macaw+
Comment 12•14 years ago
|
||
Comment on attachment 521416 [details] [diff] [review] patch v0 Approved for the mozilla2.0 repository, a=dveditz for release-drivers Please land this for the Tumucumaque Macaw release.
Attachment #521416 -
Flags: approval2.0+
Assignee | ||
Updated•14 years ago
|
tracking-fennec: --- → ?
Whiteboard: [4.0.1?]
Updated•13 years ago
|
Crash Signature: [@ nsBuiltinDecoder::GetBuffered]
[@ nsBuiltinDecoder::GetBuffered(nsTimeRanges*)]
Updated•13 years ago
|
tracking-fennec: ? → 4.0.1+
Crash Signature: [@ nsBuiltinDecoder::GetBuffered]
[@ nsBuiltinDecoder::GetBuffered(nsTimeRanges*)] → [@ nsBuiltinDecoder::GetBuffered]
[@ nsBuiltinDecoder::GetBuffered(nsTimeRanges*)]
You need to log in
before you can comment on or make changes to this bug.
Description
•