Last Comment Bug 745035 - crash while calling load on a videoDocument in an iframe
: crash while calling load on a videoDocument in an iframe
Status: NEW
: crash
Product: Core
Classification: Components
Component: Audio/Video: Playback (show other bugs)
: Trunk
: x86_64 All
: -- critical with 1 vote (vote)
: ---
Assigned To: Nobody; OK to take it and work on it
:
Mentors:
http://scotland.proximity.on.ca/sdown...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-12 17:14 PDT by scott.downe
Modified: 2015-10-13 07:29 PDT (History)
4 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description scott.downe 2012-04-12 17:14:31 PDT
#0  0x00000001000fca65 in TouchBadMemory () at /Users/dave/repos/mozilla-central/memory/mozalloc/mozalloc_abort.cpp:68
    #1  0x00000001000fcab0 in mozalloc_abort (msg=0x7fff5fbfcb60 "###!!! ABORT: You can't dereference a NULL nsCOMPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/nsCOMPtr.h, line 809") at /Users/dave/repos/mozilla-central/memory/mozalloc/mozalloc_abort.cpp:89
    #2  0x0000000101239bba in Abort (aMsg=Could not find the frame base for "Abort(char const*)".
    ) at /Users/dave/repos/mozilla-central/xpcom/base/nsDebugImpl.cpp:388
    #3  0x000000010123a080 in NS_DebugBreak_P (aSeverity=3, aStr=0x103383790 "You can't dereference a NULL nsCOMPtr with operator->().", aExpr=0x1033851a8 "mRawPtr != 0", aFile=0x10338a028 "../../../dist/include/nsCOMPtr.h", aLine=809) at /Users/dave/repos/mozilla-central/xpcom/base/nsDebugImpl.cpp:345
    #4  0x00000001012974c1 in nsCOMPtr<nsIChannel>::operator-> (this=0x146f5a010) at nsCOMPtr.h:809
    #5  0x000000010201ee15 in mozilla::MediaResource::ModifyLoadFlags (this=0x146f5a000, aFlags=7405569) at /Users/dave/repos/mozilla-central/content/media/MediaResource.cpp:1245
    #6  0x000000010201f0cd in mozilla::MediaResource::MoveLoadsToBackground (this=0x146f5a000) at /Users/dave/repos/mozilla-central/content/media/MediaResource.cpp:1225
    #7  0x000000010200e8bf in nsBuiltinDecoder::MoveLoadsToBackground (this=0x146eb9240) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoder.cpp:1008
    #8  0x0000000101baceb4 in nsHTMLMediaElement::ChangeDelayLoadStatus (this=0x146f55140, aDelay=false) at /Users/dave/repos/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:2786
    #9  0x0000000101bade32 in nsHTMLMediaElement::FirstFrameLoaded (this=0x146f55140, aResourceFullyLoaded=false) at /Users/dave/repos/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:2213
    #10 0x00000001020100b5 in nsBuiltinDecoder::MetadataLoaded (this=0x146eb9240, aChannels=2, aRate=48000) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoder.cpp:455
    #11 0x000000010201c36c in nsAudioMetadataEventRunner::Run (this=0x14731db20) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoderStateMachine.cpp:164
    #12 0x0000000102a3d27e in nsThread::ProcessNextEvent (this=0x100339760, mayWait=false, result=0x7fff5fbfd25f) at /Users/dave/repos/mozilla-central/xpcom/threads/nsThread.cpp:656
    #13 0x00000001029d1bfc in NS_ProcessPendingEvents_P (thread=0x100339760, timeout=20) at /Users/dave/repos/mozilla-central/objdir-debug/xpcom/build/nsThreadUtils.cpp:195
    #14 0x000000010275d009 in nsBaseAppShell::NativeEventCallback (this=0x100325a60) at /Users/dave/repos/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:130
    #15 0x000000010270a566 in nsAppShell::ProcessGeckoEvents (aInfo=0x100325a60) at /Users/dave/repos/mozilla-central/widget/cocoa/nsAppShell.mm:441
    #16 0x00007fff8585a3d1 in __CFRunLoopDoSources0 ()
    #17 0x00007fff858585c9 in __CFRunLoopRun ()
    #18 0x00007fff85857d8f in CFRunLoopRunSpecific ()
    #19 0x00007fff8757a7ee in RunCurrentEventLoopInMode ()
    #20 0x00007fff8757a5f3 in ReceiveNextEventCommon ()
    #21 0x00007fff8757a4ac in BlockUntilNextEventMatchingListInMode ()
    #22 0x00007fff843f3eb2 in _DPSNextEvent ()
    #23 0x00007fff843f3801 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
    #24 0x000000010270881e in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (self=0x10039c470, _cmd=0x7fff84aeb138, mask=18446744073709551615, expiration=0x11a4e0ca0, mode=0x7fff70aa3390, flag=1 '\001') at /Users/dave/repos/mozilla-central/widget/cocoa/nsAppShell.mm:208
    #25 0x00007fff843b968f in -[NSApplication run] ()
    #26 0x0000000102709e68 in nsAppShell::Run (this=0x100325a60) at /Users/dave/repos/mozilla-central/widget/cocoa/nsAppShell.mm:795
    #27 0x000000010245ece3 in nsAppStartup::Run (this=0x118f1e380) at /Users/dave/repos/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:295
    #28 0x000000010124f127 in XREMain::XRE_mainRun (this=0x7fff5fbfea50) at /Users/dave/repos/mozilla-central/toolkit/xre/nsAppRunner.cpp:3772
    #29 0x0000000101250a9e in XREMain::XRE_main (this=0x7fff5fbfea50, argc=2, argv=0x7fff5fbff5f8, aAppData=0x100007220) at /Users/dave/repos/mozilla-central/toolkit/xre/nsAppRunner.cpp:3849
    #30 0x0000000101250c77 in XRE_main (argc=2, argv=0x7fff5fbff5f8, aAppData=0x100007220) at /Users/dave/repos/mozilla-central/toolkit/xre/nsAppRunner.cpp:3925
    #31 0x00000001000015ae in do_main (argc=2, argv=0x7fff5fbff5f8) at /Users/dave/repos/mozilla-central/browser/app/nsBrowserApp.cpp:190
    #32 0x0000000100001d04 in main (argc=2, argv=0x7fff5fbff5f8) at /Users/dave/repos/mozilla-central/browser/app/nsBrowserApp.cpp:277
Comment 1 David Humphrey (:humph) 2012-04-12 17:16:22 PDT
Also on Mac.  Looks like mChannel goes away in the middle of a call to MediaResource::ModifyLoadFlags.  Threading?
Comment 2 David Humphrey (:humph) 2012-04-12 17:17:35 PDT
Prior to the crash I see mChannel go null here:

#0  mozilla::ChannelMediaResource::CloseChannel (this=0x146f5a000) at /Users/dave/repos/mozilla-central/content/media/MediaResource.cpp:586
#1  0x00000001020201ed in mozilla::ChannelMediaResource::Close (this=0x146f5a000) at /Users/dave/repos/mozilla-central/content/media/MediaResource.cpp:521
#2  0x0000000102011069 in nsBuiltinDecoder::Shutdown (this=0x146eb9240) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoder.cpp:162
#3  0x0000000101bb1c2a in nsHTMLMediaElement::AbortExistingLoads (this=0x146f55140) at /Users/dave/repos/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:525
#4  0x0000000101bb2122 in nsHTMLMediaElement::Load (this=0x146f55140) at /Users/dave/repos/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:644
#5  0x0000000101bbabc9 in nsHTMLVideoElement::Load (this=0x146f55140) at nsHTMLVideoElement.h:72
#6  0x0000000102a609b9 in NS_InvokeByIndex_P (that=0x146f55288, methodIndex=134, paramCount=0, params=0x7fff5fbf9ff0) at /Users/dave/repos/mozilla-central/xpcom/reflect/xptcall/src/md/unix/xptcinvoke_x86_64_unix.cpp:195
#7  0x0000000102279740 in CallMethodHelper::Invoke (this=0x7fff5fbf9fb0) at /Users/dave/repos/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:3110
#8  0x000000010227c153 in CallMethodHelper::Call (this=0x7fff5fbf9fb0) at /Users/dave/repos/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:2441
#9  0x0000000102275e04 in XPCWrappedNative::CallMethod (ccx=@0x7fff5fbfa150, mode=XPCWrappedNative::CALL_METHOD) at /Users/dave/repos/mozilla-central/js/xpconnect/src/XPCWrappedNative.cpp:2407
#10 0x0000000102281631 in XPC_WN_CallMethod (cx=0x1233d5c00, argc=0, vp=0x1193000b0) at /Users/dave/repos/mozilla-central/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1549
#11 0x000000010318edb9 in js::CallJSNative (cx=0x1233d5c00, native=0x1022813d8 <XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*)>, args=@0x7fff5fbfa380) at jscntxtinlines.h:314
#12 0x00000001030b7717 in js::InvokeKernel (cx=0x1233d5c00, args={<js::CallReceiver> = {usedRval_ = false, argv_ = 0x1193000c0}, argc_ = 0}, construct=js::NO_CONSTRUCT) at /Users/dave/repos/mozilla-central/js/src/jsinterp.cpp:516
#13 0x00000001030ae720 in js::Interpret (cx=0x1233d5c00, entryFrame=0x119300038, interpMode=js::JSINTERP_NORMAL) at /Users/dave/repos/mozilla-central/js/src/jsinterp.cpp:2685
#14 0x00000001030b709a in js::RunScript () at /Users/dave/repos/mozilla-central/js/src/jsinterp.cpp:472
#15 0x00000001030b77c2 in js::InvokeKernel (cx=0x1233d5c00, args={<js::CallReceiver> = {usedRval_ = false, argv_ = 0x119300030}, argc_ = 1}, construct=js::NO_CONSTRUCT) at /Users/dave/repos/mozilla-central/js/src/jsinterp.cpp:531
#16 0x000000010301425b in js::Invoke (cx=0x1233d5c00, args=@0x7fff5fbfb250, construct=js::NO_CONSTRUCT) at jsinterp.h:172
#17 0x00000001030b7c71 in js::Invoke (cx=0x1233d5c00, thisv=@0x7fff5fbfb320, fval=@0x7fff5fbfb2e8, argc=1, argv=0x7fff5fbfb9f0, rval=0x7fff5fbfb720) at /Users/dave/repos/mozilla-central/js/src/jsinterp.cpp:563
#18 0x0000000102fd5bc4 in JS_CallFunctionValue (cx=0x1233d5c00, obj=0x119a1a4c0, fval={data = {asBits = 18445477441039475712, debugView = {payload47 = 4725122048, tag = JSVAL_TAG_OBJECT}, s = {payload = {i32 = 430154752, u32 = 430154752, why = 430154752}}, asDouble = -nan(0xb800119a3a400), asPtr = 0xfffb800119a3a400, asWord = 18445477441039475712}}, argc=1, argv=0x7fff5fbfb9f0, rval=0x7fff5fbfb720) at /Users/dave/repos/mozilla-central/js/src/jsapi.cpp:5404
#19 0x0000000102269ed8 in nsXPCWrappedJSClass::CallMethod (this=0x11b582a60, wrapper=0x146d02c80, methodIndex=3, info=0x118e28d28, nativeParams=0x7fff5fbfbb40) at /Users/dave/repos/mozilla-central/js/xpconnect/src/XPCWrappedJSClass.cpp:1517
#20 0x0000000102260d9e in nsXPCWrappedJS::CallMethod (this=0x146d02c80, methodIndex=3, info=0x118e28d28, params=0x7fff5fbfbb40) at /Users/dave/repos/mozilla-central/js/xpconnect/src/XPCWrappedJS.cpp:617
#21 0x0000000102a61ff4 in PrepareAndDispatch (self=0x146d3b1a0, methodIndex=3, args=0x7fff5fbfbcc0, gpregs=0x7fff5fbfbc40, fpregs=0x7fff5fbfbc70) at /Users/dave/repos/mozilla-central/xpcom/reflect/xptcall/src/md/unix/xptcstubs_x86_64_darwin.cpp:153
#22 0x0000000102a60a53 in SharedStub () at xpt_struct.h:334
#23 0x0000000101a84df6 in nsEventListenerManager::HandleEventSubType (this=0x11c8b64c0, aListenerStruct=0x11c8b64f8, aListener=0x146d3b1a0, aDOMEvent=0x146fd23a0, aCurrentTarget=0x123de89d0, aPhaseFlags=6, aPusher=0x7fff5fbfc020) at /Users/dave/repos/mozilla-central/content/events/src/nsEventListenerManager.cpp:819
#24 0x0000000101a85058 in nsEventListenerManager::HandleEventInternal (this=0x11c8b64c0, aPresContext=0x0, aEvent=0x7fff5fbfc120, aDOMEvent=0x7fff5fbfc000, aCurrentTarget=0x123de89d0, aFlags=6, aEventStatus=0x7fff5fbfc008, aPusher=0x7fff5fbfc020) at /Users/dave/repos/mozilla-central/content/events/src/nsEventListenerManager.cpp:877
#25 0x0000000101ab9107 in nsEventListenerManager::HandleEvent (this=0x11c8b64c0, aPresContext=0x0, aEvent=0x7fff5fbfc120, aDOMEvent=0x7fff5fbfc000, aCurrentTarget=0x123de89d0, aFlags=6, aEventStatus=0x7fff5fbfc008, aPusher=0x7fff5fbfc020) at nsEventListenerManager.h:169
#26 0x0000000101ab92b3 in nsEventTargetChainItem::HandleEvent (this=0x11a48a700, aVisitor=@0x7fff5fbfbff0, aFlags=6, aMayHaveNewListenerManagers=false, aPusher=0x7fff5fbfc020) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:216
#27 0x0000000101ab7459 in nsEventTargetChainItem::HandleEventTargetChain (this=0x11a48a7a8, aVisitor=@0x7fff5fbfbff0, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=false, aPusher=0x7fff5fbfc020) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:348
#28 0x0000000101ab84d8 in nsEventDispatcher::Dispatch (aTarget=0x123de89d0, aPresContext=0x0, aEvent=0x7fff5fbfc120, aDOMEvent=0x0, aEventStatus=0x7fff5fbfc1a8, aCallback=0x0, aTargets=0x0) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:682
#29 0x0000000101d12d49 in nsGlobalWindow::PostHandleEvent (this=0x123a1ec00, aVisitor=@0x7fff5fbfc3c0) at /Users/dave/repos/mozilla-central/dom/base/nsGlobalWindow.cpp:2815
#30 0x0000000101ab7238 in nsEventTargetChainItem::PostHandleEvent (this=0x11a48a070, aVisitor=@0x7fff5fbfc3c0, aPusher=0x7fff5fbfc3f0) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:293
#31 0x0000000101ab7476 in nsEventTargetChainItem::HandleEventTargetChain (this=0x11a48a3f0, aVisitor=@0x7fff5fbfc3c0, aFlags=518, aCallback=0x0, aMayHaveNewListenerManagers=false, aPusher=0x7fff5fbfc3f0) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:351
#32 0x0000000101ab7666 in nsEventTargetChainItem::HandleEventTargetChain (this=0x11a48a3f0, aVisitor=@0x7fff5fbfc3c0, aFlags=6, aCallback=0x0, aMayHaveNewListenerManagers=false, aPusher=0x7fff5fbfc3f0) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:403
#33 0x0000000101ab84d8 in nsEventDispatcher::Dispatch (aTarget=0x123a1d800, aPresContext=0x146ede000, aEvent=0x7fff5fbfc4f0, aDOMEvent=0x0, aEventStatus=0x7fff5fbfc574, aCallback=0x0, aTargets=0x0) at /Users/dave/repos/mozilla-central/content/events/src/nsEventDispatcher.cpp:682
#34 0x00000001015aeebb in DocumentViewerImpl::LoadComplete (this=0x1241b6c50, aStatus=0) at /Users/dave/repos/mozilla-central/layout/base/nsDocumentViewer.cpp:1070
#35 0x000000010238f0cf in nsDocShell::EndPageLoad (this=0x123a19000, aProgress=0x123a19028, aChannel=0x146eda858, aStatus=0) at /Users/dave/repos/mozilla-central/docshell/base/nsDocShell.cpp:6198
#36 0x00000001023960f5 in nsDocShell::OnStateChange (this=0x123a19000, aProgress=0x123a19028, aRequest=0x146eda858, aStateFlags=131088, aStatus=0) at /Users/dave/repos/mozilla-central/docshell/base/nsDocShell.cpp:6029
#37 0x00000001023b1a1b in nsDocLoader::DoFireOnStateChange (this=0x123a19000, aProgress=0x123a19028, aRequest=0x146eda858, aStateFlags=@0x7fff5fbfcbfc, aStatus=0) at /Users/dave/repos/mozilla-central/uriloader/base/nsDocLoader.cpp:1383
#38 0x00000001023b256e in nsDocLoader::doStopDocumentLoad (this=0x123a19000, request=0x146eda858, aStatus=0) at /Users/dave/repos/mozilla-central/uriloader/base/nsDocLoader.cpp:963
#39 0x00000001023b295b in nsDocLoader::DocLoaderIsEmpty (this=0x123a19000, aFlushLayout=true) at /Users/dave/repos/mozilla-central/uriloader/base/nsDocLoader.cpp:852
#40 0x00000001023b36fc in nsDocLoader::OnStopRequest (this=0x123a19000, aRequest=0x146eda858, aCtxt=0x0, aStatus=0) at /Users/dave/repos/mozilla-central/uriloader/base/nsDocLoader.cpp:736
#41 0x00000001012b5cdc in nsLoadGroup::RemoveRequest (this=0x11c224fc0, request=0x146eda858, ctxt=0x0, aStatus=0) at /Users/dave/repos/mozilla-central/netwerk/base/src/nsLoadGroup.cpp:731
#42 0x000000010201edb5 in mozilla::MediaResource::ModifyLoadFlags (this=0x146f5a000, aFlags=7405569) at /Users/dave/repos/mozilla-central/content/media/MediaResource.cpp:1241
#43 0x000000010201f0cd in mozilla::MediaResource::MoveLoadsToBackground (this=0x146f5a000) at /Users/dave/repos/mozilla-central/content/media/MediaResource.cpp:1225
#44 0x000000010200e8bf in nsBuiltinDecoder::MoveLoadsToBackground (this=0x146eb9240) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoder.cpp:1008
#45 0x0000000101baceb4 in nsHTMLMediaElement::ChangeDelayLoadStatus (this=0x146f55140, aDelay=false) at /Users/dave/repos/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:2786
#46 0x0000000101bade32 in nsHTMLMediaElement::FirstFrameLoaded (this=0x146f55140, aResourceFullyLoaded=false) at /Users/dave/repos/mozilla-central/content/html/content/src/nsHTMLMediaElement.cpp:2213
#47 0x00000001020100b5 in nsBuiltinDecoder::MetadataLoaded (this=0x146eb9240, aChannels=2, aRate=48000) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoder.cpp:455
#48 0x000000010201c36c in nsAudioMetadataEventRunner::Run (this=0x14731db20) at /Users/dave/repos/mozilla-central/content/media/nsBuiltinDecoderStateMachine.cpp:164
#49 0x0000000102a3d27e in nsThread::ProcessNextEvent (this=0x100339760, mayWait=false, result=0x7fff5fbfd25f) at /Users/dave/repos/mozilla-central/xpcom/threads/nsThread.cpp:656
#50 0x00000001029d1bfc in NS_ProcessPendingEvents_P (thread=0x100339760, timeout=20) at /Users/dave/repos/mozilla-central/objdir-debug/xpcom/build/nsThreadUtils.cpp:195
#51 0x000000010275d009 in nsBaseAppShell::NativeEventCallback (this=0x100325a60) at /Users/dave/repos/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:130
#52 0x000000010270a566 in nsAppShell::ProcessGeckoEvents (aInfo=0x100325a60) at /Users/dave/repos/mozilla-central/widget/cocoa/nsAppShell.mm:441
#53 0x00007fff8585a3d1 in __CFRunLoopDoSources0 ()
#54 0x00007fff858585c9 in __CFRunLoopRun ()
#55 0x00007fff85857d8f in CFRunLoopRunSpecific ()
#56 0x00007fff8757a7ee in RunCurrentEventLoopInMode ()
#57 0x00007fff8757a5f3 in ReceiveNextEventCommon ()
#58 0x00007fff8757a4ac in BlockUntilNextEventMatchingListInMode ()
#59 0x00007fff843f3eb2 in _DPSNextEvent ()
#60 0x00007fff843f3801 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#61 0x000000010270881e in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (self=0x10039c470, _cmd=0x7fff84aeb138, mask=18446744073709551615, expiration=0x11a4e0ca0, mode=0x7fff70aa3390, flag=1 '\001') at /Users/dave/repos/mozilla-central/widget/cocoa/nsAppShell.mm:208
#62 0x00007fff843b968f in -[NSApplication run] ()
#63 0x0000000102709e68 in nsAppShell::Run (this=0x100325a60) at /Users/dave/repos/mozilla-central/widget/cocoa/nsAppShell.mm:795
#64 0x000000010245ece3 in nsAppStartup::Run (this=0x118f1e380) at /Users/dave/repos/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:295
#65 0x000000010124f127 in XREMain::XRE_mainRun (this=0x7fff5fbfea50) at /Users/dave/repos/mozilla-central/toolkit/xre/nsAppRunner.cpp:3772
#66 0x0000000101250a9e in XREMain::XRE_main (this=0x7fff5fbfea50, argc=2, argv=0x7fff5fbff5f8, aAppData=0x100007220) at /Users/dave/repos/mozilla-central/toolkit/xre/nsAppRunner.cpp:3849
#67 0x0000000101250c77 in XRE_main (argc=2, argv=0x7fff5fbff5f8, aAppData=0x100007220) at /Users/dave/repos/mozilla-central/toolkit/xre/nsAppRunner.cpp:3925
#68 0x00000001000015ae in do_main (argc=2, argv=0x7fff5fbff5f8) at /Users/dave/repos/mozilla-central/browser/app/nsBrowserApp.cpp:190
#69 0x0000000100001d04 in main (argc=2, argv=0x7fff5fbff5f8) at /Users/dave/repos/mozilla-central/browser/app/nsBrowserApp.cpp:277
Comment 3 scott.downe 2012-04-13 23:45:51 PDT
I don't think it is threading.

Walking through this block here:

void MediaResource::ModifyLoadFlags(nsLoadFlags aFlags)
{
  nsCOMPtr<nsILoadGroup> loadGroup;
  DebugOnly<nsresult> rv = mChannel->GetLoadGroup(getter_AddRefs(loadGroup));
  NS_ASSERTION(NS_SUCCEEDED(rv), "GetLoadGroup() failed!");

  nsresult status;
  mChannel->GetStatus(&status);

  // Note: if (NS_FAILED(status)), the channel won't be in the load group.
  if (loadGroup &&
      NS_SUCCEEDED(status)) {
    rv = loadGroup->RemoveRequest(mChannel, nsnull, status);
    NS_ASSERTION(NS_SUCCEEDED(rv), "RemoveRequest() failed!");
  }

  rv = mChannel->SetLoadFlags(aFlags);
  NS_ASSERTION(NS_SUCCEEDED(rv), "SetLoadFlags() failed!");

  if (loadGroup &&
      NS_SUCCEEDED(status)) {
    rv = loadGroup->AddRequest(mChannel, nsnull);
    NS_ASSERTION(NS_SUCCEEDED(rv), "AddRequest() failed!");
  }
}

At the point: mChannel->GetStatus(&status); mChannel is there and usable.

A chain of events caused by: rv = loadGroup->RemoveRequest(mChannel, nsnull, status); is what sets mChannel to null. Also, this call connects the second stack trace to the first. You can see: #42 0x000000010201edb5 in mozilla::MediaResource::ModifyLoadFlags in the second stack trace and again in the first: #5  0x000000010201ee15 in mozilla::MediaResource::ModifyLoadFlags 

Then later, mChannel is null, because we set it to null.

I am not sure the repercussions on my ideas to fix this yet, but I am going to start with the simple and obvious.

We can change the order of these, by doing setLoadFlags before removeRequest.

We can check for mChannel's existence before we try to reference something on it.

Or, this option seems highly dangerous, but we can place an else to make sure one or the other, not both, of these happen.

I do not know the code well enough yet to know, without trying and testing, if my ideas are on the right track.

Ideas?
Comment 4 (mostly gone) XtC4UaLL [:xtc4uall] 2012-12-16 21:43:33 PST
FWIW, current Nightly is still crashing: bp-2de40514-69cb-406d-bf96-784752121217

Note You need to log in before you can comment on or make changes to this bug.