Closed Bug 701662 Opened 8 years ago Closed 8 years ago

media player: plays but all controls are missing

Categories

(Toolkit :: Video/Audio Controls, defect, major)

defect
Not set
major

Tracking

()

VERIFIED FIXED
mozilla12
Tracking Status
firefox10 + verified
firefox11 + verified

People

(Reporter: kdevel, Assigned: mwu)

References

Details

(Keywords: regression, verified-beta, Whiteboard: [qa!] [testday-20120203])

Attachments

(2 files)

User Agent:  

Steps to reproduce:

1. Open an OGG file


Actual results:

1. Media player starts playing but does not display any controls. Right mouse menu works.


Expected results:

1. Show media player controls.

Error Console says:

Error: Permission denied to access property 'getAttribute'
Source File: 
Line: 86

Error: uncaught exception: [Exception... "Security Manager vetoed action arg 0 [nsIDOMDocumentXBL.getBindingParent]"  nsresult: "0x80570027 (NS_ERROR_XPC_SECURITY_MANAGER_VETO)"  location: "JS frame :: <unknown filename> ::  :: line 112"  data: no]

Error: Permission denied to access property 'getAttribute'
Source File: 
Line: 86

Error: uncaught exception: [Exception... "Security Manager vetoed action arg 0 [nsIDOMDocumentXBL.getBindingParent]"  nsresult: "0x80570027 (NS_ERROR_XPC_SECURITY_MANAGER_VETO)"  location: "JS frame :: <unknown filename> ::  :: line 112"  data: no]

Error: Permission denied to access property 'getAttribute'
Source File: 
Line: 86

Error: Permission denied to access property 'type'
Source File: 
Line: 129

Built from https://hg.mozilla.org/mozilla-central/rev/ae9e5bf847fc

After deleting startupCache/startupCache.8.little and restarting Fx the player shows its controls, but after the next restart the controls are gone again.
OS: Other → Linux
Hardware: Other → x86_64
Can reproduce this error only with my old build of rev. ae9e5bf847fc not with a fresh one nor with any of the recent nightlies.
Now I can reproduce the issue with a 32 bit build of rev. ae9e5bf847fc and also yesterday's fresh 64 bit build refuses now to display the media player controls.
Can reproduce the issue with 2011-11-05-03-11-11-mozilla-central. Need to start/restart Fx three times in order to reproduce.
The error is only reproducible when Fx is run from the install directory. Running from the objdir/dist directory does not show the issue.
The first bad revision is:
changeset: 79730:b46ffd95bfd8
user: Neil Deakin <neil@mozilla.com>
date: Thu Nov 03 16:39:08 2011 -0400
summary: Bug 94199, part 4, serialize/deserialize xbl to startup cache, r=bz
Reproduces with new nightly 2011-11-12-03-15-41-mozilla-central

new STR:

1. Start Fx with new profile.
2. http://upload.wikimedia.org/wikipedia/commons/c/c7/Fr-deuxi%C3%A8me.ogg
3. Quit and restart Fx.
4. http://upload.wikimedia.org/wikipedia/commons/c/c7/Fr-deuxi%C3%A8me.ogg
5. Quit and restart Fx.
6. http://upload.wikimedia.org/wikipedia/commons/c/c7/Fr-deuxi%C3%A8me.ogg

Starting with step 6 Fx does no longer show media player controls.
Severity: normal → major
Nightly 2011-11-12 Windows x64 reproduces the error after third start of Fx.
OS: Linux → All
Hardware: x86_64 → All
Component: General → Video/Audio Controls
Product: Firefox → Toolkit
QA Contact: general → video.audio
Can this issue be reproduced with a clean profile?
(In reply to Chris Pearce (:cpearce) (Mozilla Corporation) from comment #9)
> Can this issue be reproduced with a clean profile?

Yes:

"new STR:

1. Start Fx with new profile.
..."
OK, so it sounds like we end up deserializing the controls binding with the wrong principal or something....
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: regression
OK, so here's part of the problem.  The stack to a JS exception being thrown:

(gdb) jsstack 
0 () ["<unknown>":112]
    this = [object XULElement @ 0x129a1e710 (native @ 0x1478ae8f0)]
1 anonymous(binding = [object XULElement @ 0x129a1e080 (native @ 0x129ad7ca0)]) ["chrome://global/content/bindings/videocontrols.xml":1088]
    self = undefined
    event = undefined
    shouldShow = undefined
    this = [object Object]
2 () ["<unknown>":298]
    this = [object XULElement @ 0x129a1e080 (native @ 0x129ad7ca0)]

Frame 2 there is the constructor, which is doing this:

  this.Utils.init(this);

this.Utils is a field value.  Frame 1 is that init method.  And we have...

(gdb) p *cx->fp()->prev()->script()->principals
$14 = {
  codebase = 0x11b350748 "http://upload.wikimedia.org/wikipedia/commons/c/c7/Fr-deuxi%C3%A8me.ogg", 

In fact, everything on that stack has that codebase.

Frame 0 seems to be set up by one of the xpconnect wrappers or something.  

Given that frame 1 is untrusted code (sort of expected) that's touching a native anonymous content root... why does this ever work?  Blake?
Boris, while the 2011-11-15 nightly (9ae1d4f44b8b) does show the error, a build of the current tip 3ea216303184 works fine. Unfortunately I was unable to bisect since mercurial (1.9.3) told me it ran into an "inconsistent state" after

hg bisect -r
hg bisect -b 9ae1d4f44b8b
hg bisect -g 3ea216303184
hg bisect -g
hg bisect -g
hg bisect --extend
hg bisect -g
Somewhere in this range 

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3ea216303184&tochange=30161b298513

the issue reappeared. 30161b298513 is affected.
In addition to missing controls, context menu items for media files (such as Play/Pause) are also not working.

Mozilla/5.0 (Windows NT 6.2; WOW64; rv:11.0a1) Gecko/20111118 Firefox/11.0a1
This is actually somewhat reminiscent of bug 692132...
Hmm.  Does this happen for audio/video linked to via an <audio> or <video> tag, or only when directly opening the media file?
This happens only when opening files directly.

http://www.vorbis.com/music/Epoq-Lepidoptera.ogg

vs.

data:text/html,<html><video autoplay controls src="http://www.vorbis.com/music/Epoq-Lepidoptera.ogg">
(In reply to Boris Zbarsky (:bz) from comment #17)
> Hmm.  Does this happen for audio/video linked to via an <audio> or <video>
> tag, or only when directly opening the media file?

The following page also affected .(Controls should appear by mouse hover)

[STR]
1.Start Nightly
2.Open http://www.mozilla.org/projects/firefox/prerelease.html
3.Quit Nightly
4.Start Nightly
5.Open http://www.mozilla.org/projects/firefox/prerelease.html
6.Quit Nightly
7.Start Nightly
8.Open http://www.mozilla.org/projects/firefox/prerelease.html
[Actual]
No controls appears.(even if mouse hover)
I encountered this bug today.

As a workaround you can create a boolean in about:config with the name "nglayout.debug.disable_xul_cache" and set it to true and restart Firefox.

This appears to have fixed the issue for me.
Just as a word of warning, that configuration is not exactly supported, and has bugs of its own.

Neil, what's the plan here?  Are you waiting for someone else to deal with this?  This bug needs an owner.
I looked into it but couldn't find anything obvious. I assumed from comment 12 that you or Blake were starting to look into this. I could work on it, but wrappers/jsapi/principals is beyond my knowledge, so it would be better if someone else could help.
I haven't had time to look into it, and probably won't in the near future unless I drop something else.

And comment 12 may well be on the wrong tack to start with, of course.

Quite honestly, I don't understand how this binding ever works, since it's having scripts with the page principal touch native anonymous content....
In any case, the point is that we need to either disable XBL fastload on aurora or find an owner for this bug and get it fixed on aurora.
I can now reproduce this in [Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0a1) Gecko/20111207 Firefox/11.0a1] but only when I have the TestPilot 1.2 extension enabled.
OK, I finally got hold of Blake.

The security check for anon content whitelists scripts with chrome://global/ filenames.

But when the exception is thrown my stack looks like this:

(gdb) jsstack 
0 _getIntegerAttribute(aDefaultValue = 0, aAttr = "minpos") ["<unknown>":86]
    intvalue = undefined
    value = undefined
    this = [object XULElement @ 0x24a074c0 (native @ 0x221674d0)]
1 get_min() ["<unknown>":0]
    this = [object XULElement @ 0x24a074c0 (native @ 0x221674d0)]
2 () ["<unknown>":75]
    value = NaN
    this = [object XULElement @ 0x24a074c0 (native @ 0x221674d0)]
3 anonymous(binding = [object XULElement @ 0x24a14790 (native @ 0x22173a90)]) ["chrome://global/content/bindings/videocontrols.xml":1224]
    self = undefined
    shouldShow = undefined
    this = [object Object]
4 () ["<unknown>":307]
    this = [object XULElement @ 0x24a14790 (native @ 0x22173a90)]

So the "init" method of this.utils has the right filename.  But the constructor frame (frame 4), and the other frames all have null filenames.  Some of these I don't know what they are, but frame 0, which ends up throwing, is a <method> on the scale.xml#scale binding.
So JS_XDRFunctionObject creates an XDRScriptState on the stack.  In _encode_ mode, it then sets the filename on it to the script filename of the function.  But in encode mode js_XDRScript never looks at state->filename.

It does look at state->filename in _decode_ mode, like so:

    if (xdr->mode == JSXDR_DECODE && state->filename) {

but when we decode via JS_XDRFunctionObject the filename is of course null.

So the upshot is that XDR of function objects per se totally loses the script filename.

Seems like the right solution would be to allow passing in the filename to use when decoding, at least.  Then the XBL code could do that....  Or would the SaveScriptFilename thing not do the right thing for this situation?  Should the XBL code just randomly stamp the filename on the script once XDR is done?
Video controls being completely broken is pretty bad. I think we should back out bug 94199.
Oh, so after bug 632253 landed, users of XDRScriptState have to encode/decode the filename themselves and then set state->filename appropriately. We should be able to keep all that within JS_XDRFunctionObject.
Tested against the STR in comment 7.
Assignee: nobody → mwu
Attachment #582886 - Flags: review?(igor)
(In reply to Michael Wu [:mwu] from comment #30)
> Tested against the STR in comment 7.

Works. Thx.
Comment on attachment 582886 [details] [diff] [review]
Serialize the filename in JS_XDRFunctionObject

Review of attachment 582886 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for fixing this!
Attachment #582886 - Flags: review?(igor) → review+
Comment on attachment 582886 [details] [diff] [review]
Serialize the filename in JS_XDRFunctionObject

This fix should probably go to aurora, don't know if we should back out or fix for beta.
Attachment #582886 - Flags: approval-mozilla-beta?
Attachment #582886 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/95719847043a
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
(In reply to Michael Wu [:mwu] from comment #34)
> Comment on attachment 582886 [details] [diff] [review]
> Serialize the filename in JS_XDRFunctionObject
> 
> This fix should probably go to aurora, don't know if we should back out or
> fix for beta.

95719847043a didn't land before the uplift, so we need this fix on both aurora and beta. We don't have video controls under some circumstances on these branches!
Comment on attachment 582886 [details] [diff] [review]
Serialize the filename in JS_XDRFunctionObject

Approved for aurora and beta. Please land asap
Attachment #582886 - Flags: approval-mozilla-beta?
Attachment #582886 - Flags: approval-mozilla-beta+
Attachment #582886 - Flags: approval-mozilla-aurora?
Attachment #582886 - Flags: approval-mozilla-aurora+
Oops, I forgot to set my pushes to m-a and m-b to have Michael as the patch author. Sorry!
Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:12.0a1) Gecko/20111223 Firefox/12.0a1

Is it really fixed?
This video still doesn't have any controls.
http://html-5-video.com/data/images/happyfit2.webm
Found the culprit, it was Adblock Plus messing with the controls. I'll contact its author. Sorry for bugspam.
(In reply to Sid from comment #42)
> Found the culprit, it was Adblock Plus messing with the controls. I'll
> contact its author. Sorry for bugspam.

Already reported, see Bug 708431.
Is this bug isolated to mobile Firefox?
(In reply to Anthony Hughes, Mozilla QA (irc: ashughes) from comment #44)
> Is this bug isolated to mobile Firefox?

This affects desktop Firefox.
Whiteboard: [qa+]
Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0
Mozilla/5.0 (X11; Linux i686; rv:10.0) Gecko/20100101 Firefox/10.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:10.0) Gecko/20100101 Firefox/10.0

Verified using the steps from comment #7 (and also the linbk from comment #19) and the issue did not occur: video controls were displayed every time
Keywords: verified-beta
Whiteboard: [qa+] → [qa!:10] [qa+]
Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0
Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0

Verified the fix also on latest beta - Firefox 11.0 beta 1: the viddeo/audio controls were displayed each time.
Marking as VERIFIED
Whiteboard: [qa!:10] [qa+] → [qa!] [testday-20120203]
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.