635400 - crash [@ nsBuiltinDecoder::GetBuffered] [@ nsBuiltinDecoder::GetBuffered(nsTimeRanges*)]

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Josh Matthews [:jdm]]

This bug was filed from the Socorro interface and is 
report bp-d34fadb9-8756-45b1-975c-d302b2110218 .
============================================================= 

0 	libxul.so 	nsBuiltinDecoder::GetBuffered 	content/media/nsBuiltinDecoder.h:445
1 	libxul.so 	nsHTMLMediaElement::GetBuffered 	content/html/content/src/nsHTMLMediaElement.cpp:2568
2 	libxul.so 	nsHTMLVideoElement::GetBuffered 	nsHTMLVideoElement.h:65
3 	libxul.so 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/unix/xptcinvoke_arm.cpp:199
4 	libxul.so 	XPCWrappedNative::CallMethod 	js/src/xpconnect/src/xpcwrappednative.cpp:3072
5 	libxul.so 	XPC_WN_GetterSetter 	js/src/xpconnect/src/xpcprivate.h:2643
6 	libxul.so 	js::Invoke 	js/src/jscntxtinlines.h:697
7 	libxul.so 	js::ExternalGetOrSet 	js/src/jsinterp.cpp:858
8 	libxul.so 	js_GetProperty 	js/src/jsobj.cpp:5149
9 	libxul.so 	js::mjit::ic::GetProp 	js/src/methodjit/PolyIC.cpp:1692
10 	libxul.so 	libxul.so@0xb1d10a 	
11 	libxul.so 	js::mjit::ic::GetProp 	js/src/methodjit/PolyIC.cpp:1635
12 	libmozalloc.so 	je_free 	memory/jemalloc/jemalloc.c:1442
13 		@0x4430313f 	
14 	libxul.so 	js::mjit::JaegerShot 	js/src/jscntxt.h:2890
15 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:654
16 	libxul.so 	CallOrConstructBoundFunction 	js/src/jsfun.cpp:2290
17 	libxul.so 	CallCompiler::generateNativeStub 	js/src/methodjit/MonoIC.cpp:667
18 	libxul.so 	js::mjit::ic::NativeCall 	js/src/methodjit/MonoIC.cpp:874
19 	libxul.so 	libxul.so@0xb1d10a 	
20 	libxul.so 	js::mjit::ic::NativeCall 	js/src/methodjit/MonoIC.cpp:872
21 	libxul.so 	js::mjit::JaegerShot 	js/src/jscntxt.h:2890
22 	libxul.so 	js::Invoke 	js/src/jsinterp.cpp:654
23 	libxul.so 	js::ExternalInvoke 	js/src/jsinterp.cpp:858
24 	libxul.so 	JS_CallFunctionValue 	js/src/jsinterp.h:961
25 	libxul.so 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1702
26 	libxul.so 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:589
27 	libxul.so 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/unix/xptcstubs_arm.cpp:134
28 	libxul.so 	libxul.so@0x96990c 	
29 	libxul.so 	nsEventListenerManager::HandleEventSubType 	content/events/src/nsEventListenerManager.cpp:1114
30 		@0x441a30c7 	
31 	libxul.so 	nsEventListenerManager::HandleEventInternal 	content/events/src/nsEventListenerManager.cpp:1209
32 	libxul.so 	nsEventTargetChainItem::HandleEvent 	content/events/src/nsEventListenerManager.h:146
33 	libxul.so 	nsEventTargetChainItem::HandleEventTargetChain 	content/events/src/nsEventDispatcher.cpp:343
34 	libxul.so 	nsEventDispatcher::Dispatch 	content/events/src/nsEventDispatcher.cpp:630
35 	libxul.so 	nsEventDispatcher::DispatchDOMEvent 	content/events/src/nsEventDispatcher.cpp:691
36 	libxul.so 	nsEventListenerManager::DispatchEvent 	content/events/src/nsEventListenerManager.cpp:1333
37 	libxul.so 	nsDOMEventRTTearoff::DispatchEvent 	content/base/src/nsGenericElement.cpp:1967
38 	libxul.so 	nsContentUtils::DispatchTrustedEvent 	content/base/src/nsContentUtils.cpp:3397
39 	libxul.so 	nsHTMLMediaElement::DispatchEvent 	content/html/content/src/nsHTMLMediaElement.cpp:2266
40 	libxul.so 	nsAsyncEventRunner::Run 	content/html/content/src/nsHTMLMediaElement.cpp:210
41 	libxul.so 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:633
42 	libxul.so 	NS_ProcessNextEvent_P 	nsThreadUtils.cpp:250
43 	libxul.so 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:111
44 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:230
45 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:220
46 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:512
47 	libxul.so 	nsBaseAppShell::Run 	widget/src/xpwidgets/nsBaseAppShell.cpp:201
48 	libxul.so 	XRE_RunAppShell 	toolkit/xre/nsEmbedFunctions.cpp:640
49 	libxul.so 	mozilla::ipc::MessagePumpForChildProcess::Run 	ipc/glue/MessagePump.cpp:222
50 	libxul.so 	MessageLoop::RunInternal 	ipc/chromium/src/base/message_loop.cc:220
51 	libxul.so 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:512
52 	libxul.so 	XRE_InitChildProcess 	toolkit/xre/nsEmbedFunctions.cpp:519
53 	libmozutils.so 	ChildProcessInit 	other-licenses/android/APKOpen.cpp:771
54 	plugin-container 	main 	ipc/app/MozillaRuntimeMainAndroid.cpp:69
55 	libc.so 	libc.so@0xd4e2 

>virtual nsresult GetBuffered(nsTimeRanges* aBuffered) {
>  return mDecoderStateMachine->GetBuffered(aBuffered);
>}

mDecodertateMachine is null here.

Comment 1

[Matthew Gregan [:kinetik]]

This was fixed by the backout of bug 631058.

Comment 2

[Josh Matthews [:jdm]]

https://crash-stats.mozilla.com/report/list?range_value=2&range_unit=weeks&date=2011-03-23%2016%3A00%3A00&signature=nsBuiltinDecoder%3A%3AGetBuffered&version=Fennec%3A4.0

Still seeing crashes in 4.0.

Comment 3

[Matthew Gregan [:kinetik]]

For the element's mDecoder to be valid but mDecoderStateMachine to be invalid, a call to nsMediaDecoder::Shutdown must have been made by something other than the element.  There are three places I can see that happening: the shutdown observer, and in the NetworkError and DecodeError calls.

I can reproduce this crash easily by inducing a NetworkError from a test server and then calling element.buffered.length.

Comment 4

[Matthew Gregan [:kinetik]]

Thanks for pointing out that this bug was still occurring.

Comment 5

[Matthew Gregan [:kinetik]]

Attachment: patch v0

Fixes nsBuiltinDecoder and nsWaveDecoder.  If bug 635649 lands before this one, it'll be covered by the fix in nsBuiltinDecoder.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

A testcase would be nice, can you induce a network error using sjs? I wouldn't stress to much about it if it's a hassle though.

Comment 7

[Matthew Gregan [:kinetik]]

It's testable, but painful to do reliably.  I have an idea how to fix that, so I'll tag this to come back to when I deal with that.

Comment 8

[Matthew Gregan [:kinetik]]

http://hg.mozilla.org/mozilla-central/rev/2026ba368286

Comment 9

[u279076]

I'm not seeing a recent report of this crash -- VERIFIED FIXED

Comment 10

[Robert Kaiser]

This seems to be on the rise on 4.0 in the last days with almost all comments being about people trying Youtube's HTML5 stuff, and I think we really want HTML5 video to work, so as it looks like the fix works well on trunk, I'd like to nominate this to get into 4.0.1 if possible.

Comment 11

[Matthew Gregan [:kinetik]]

I agree.  This crash is very easy to hit on mobile due to unreliable network connectivity.  The patch is very simple and low risk.

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 521416 [details] [diff] [review]
patch v0

Approved for the mozilla2.0 repository, a=dveditz for release-drivers

Please land this for the Tumucumaque Macaw release.

Comment 13

[Matthew Gregan [:kinetik]]

http://hg.mozilla.org/releases/mozilla-2.0/rev/244ac2eb3baf