Closed Bug 753852 Opened 12 years ago Closed 12 years ago

crash [@ BlockingResourceBase::CheckAcquire] in 327571-1.html 371124-1.html 371124-2.html 372554-1.html 432114-1.html 432114-2.html 436900-1.html 375399-1.html 614499-1.html 677194.html 601247.html 462947.html 404869-1.xul 504224.html 436900-2.html ...

Categories

(Core :: Audio/Video, defect)

Product:
Core
Component:
Audio/Video
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla15

People

(Reporter: emorley, Assigned: roc)

References

Details

(Keywords: crash, intermittent-failure, Whiteboard: [test which aborts the suite])

Crash Data

Attachments

(1 file)

fix
5.39 KB, patch
jesup
: review+
Details | Diff | Splinter Review 
Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-05-10 08:57:32 PDT for push 1259212fa0f7

slave: talos-r3-w7-047

https://tbpl.mozilla.org/php/getParsedLog.php?id=11645876&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-1.html | 439 / 2050 (21%)
++DOMWINDOW == 84 (06BEF948) [serial = 1011] [outer = 06058600]
--DOMWINDOW == 83 (0AAB7878) [serial = 959] [outer = 00000000] [url = data:application/xhtml+xml;charset=utf-8,%3Chtml%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0A%3Cframeset%20contenteditable%3D%22true%22/%3E%0A%3Cscript%3E%0Afunction%20doExecCommand%28%29%7B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28doExecCommand%2C100%29%3B%0Awindow.addEventListener%28%27DOMNodeRemoved%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/html%3E]
--DOMWINDOW == 82 (0A85AD10) [serial = 932] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/40929-1-inner.html]
--DOMWINDOW == 81 (05FA7B00) [serial = 977] [outer = 00000000] [url = data:text/html,1]
--DOMWINDOW == 80 (05FA6F30) [serial = 973] [outer = 00000000] [url = about:blank]
--DOMWINDOW == 79 (0ABABA00) [serial = 941] [outer = 00000000] [url = data:text/html,<body%20onUnload="location%20=%20'http://www.mozilla.org/'">This%20frame's%20onunload%20tries%20to%20load%20another%20page.]
--DOMWINDOW == 78 (06CA10E0) [serial = 963] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-1-inner.html#foo]
--DOMWINDOW == 77 (0AAB60D8) [serial = 967] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-2-inner.html#foo]
++DOCSHELL 06CA8870 == 4 [id = 64]
++DOMWINDOW == 78 (0AAB6AB0) [serial = 1012] [outer = 00000000]
JavaScript error: , line 0: nothing active on context
++DOMWINDOW == 79 (0AAB5EE0) [serial = 1013] [outer = 0AAB6A60]
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-1.html | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:02:39.849000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmphficjjpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1336657640/firefox-15.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-1.html | application crashed (minidump found)
Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpgh53ok\minidumps\a91928ed-cfb3-4447-884d-92580bc0355c.dmp
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x4c

Thread 26 (crashed)
 0  xul.dll!mozilla::BlockingResourceBase::CheckAcquire(mozilla::CallStack const &) [BlockingResourceBase.cpp:1259212fa0f7 : 130 + 0x0]
    eip = 0x6a7b85bf   esp = 0x0c27f654   ebp = 0x0c27f6b4   ebx = 0x0fb47460
    esi = 0x00000048   edi = 0x00000048   eax = 0x23216135   ecx = 0x00000048
    edx = 0x00000000   efl = 0x00010206
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::Mutex::Lock() [BlockingResourceBase.cpp:1259212fa0f7 : 260 + 0xa]
    eip = 0x6a7b86dd   esp = 0x0c27f6bc   ebp = 0x0c27f6c8
    Found by: call frame info
 2  xul.dll!mozilla::MediaStreamGraphImpl::EnsureNextIteration() [MediaStreamGraph.cpp:1259212fa0f7 : 1211 + 0xc]
    eip = 0x6a20aa07   esp = 0x0c27f6d0   ebp = 0x0c27f6dc
    Found by: call frame info
 3  xul.dll!mozilla::SourceMediaStream::EndTrack(int) [MediaStreamGraph.cpp:1259212fa0f7 : 1870 + 0xa]
    eip = 0x6a20bf6f   esp = 0x0c27f6e4   ebp = 0x0c27f6f0
    Found by: call frame info
 4  xul.dll!nsBuiltinDecoderStateMachine::FinishOutputStreams() [nsBuiltinDecoderStateMachine.cpp:1259212fa0f7 : 745 + 0x8]
    eip = 0x6a216b32   esp = 0x0c27f6f8   ebp = 0x0c27f710
    Found by: call frame info
 5  xul.dll!nsBuiltinDecoderStateMachine::RunStateMachine() [nsBuiltinDecoderStateMachine.cpp:1259212fa0f7 : 2047 + 0x6]
    eip = 0x6a21b600   esp = 0x0c27f718   ebp = 0x0c27f75c
    Found by: call frame info
 6  xul.dll!nsBuiltinDecoderStateMachine::CallRunStateMachine() [nsBuiltinDecoderStateMachine.cpp:1259212fa0f7 : 2547 + 0x17]
    eip = 0x6a21bb40   esp = 0x0c27f764   ebp = 0x0c27f778
    Found by: call frame info
 7  xul.dll!nsBuiltinDecoderStateMachine::Run() [nsBuiltinDecoderStateMachine.cpp:1259212fa0f7 : 2529 + 0x6]
    eip = 0x6a21bc27   esp = 0x0c27f774   ebp = 0x0c27f778
    Found by: stack scanning
 8  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:1259212fa0f7 : 656 + 0xd]
    eip = 0x6a7f3fcb   esp = 0x0c27f780   ebp = 0x0c27f7a8
}
Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-05-10 09:25:19 PDT for push 9b326e2ad041

slave: talos-r3-w7-059

https://tbpl.mozilla.org/php/getParsedLog.php?id=11646397&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-2.html | 440 / 2050 (21%)
++DOMWINDOW == 97 (061A50B8) [serial = 1015] [outer = 05F04A38]
++DOCSHELL 06B94A18 == 5 [id = 65]
++DOMWINDOW == 98 (04D0E1B0) [serial = 1016] [outer = 00000000]
--DOMWINDOW == 97 (0AA10388) [serial = 941] [outer = 00000000] [url = data:text/html,<body%20onUnload="location%20=%20'http://www.mozilla.org/'">This%20frame's%20onunload%20tries%20to%20load%20another%20page.]
--DOMWINDOW == 96 (0B87C838) [serial = 963] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-1-inner.html#foo]
--DOMWINDOW == 95 (0E353850) [serial = 967] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-2-inner.html#foo]
--DOMWINDOW == 94 (0A9C72B8) [serial = 981] [outer = 00000000] [url = data:text/html,1]
--DOMWINDOW == 93 (0B87D7F8) [serial = 973] [outer = 00000000] [url = about:blank]
--DOMWINDOW == 92 (0A9C74B0) [serial = 982] [outer = 00000000] [url = data:text/html,2]
--DOMWINDOW == 91 (0AA10190) [serial = 959] [outer = 00000000] [url = data:application/xhtml+xml;charset=utf-8,%3Chtml%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0A%3Cframeset%20contenteditable%3D%22true%22/%3E%0A%3Cscript%3E%0Afunction%20doExecCommand%28%29%7B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28doExecCommand%2C100%29%3B%0Awindow.addEventListener%28%27DOMNodeRemoved%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/html%3E]
--DOMWINDOW == 90 (0E3B69C0) [serial = 977] [outer = 00000000] [url = data:text/html,1]
--DOMWINDOW == 89 (0AC9BBE8) [serial = 932] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/40929-1-inner.html]
WARNING: Subdocument container has no frame: file e:/builds/moz2_slave/m-in-w32-dbg/build/layout/base/nsDocumentViewer.cpp, line 2443
JavaScript error: , line 0: nothing active on context
++DOMWINDOW == 90 (0AC9BBE8) [serial = 1017] [outer = 04D0E160]
JavaScript error: file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-2-inner.html, line 5: document.all.tags is undefined
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
WARNING: No outer window available!: file e:/builds/moz2_slave/m-in-w32-dbg/build/dom/base/nsGlobalWindow.cpp, line 8446
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-2.html | Exited with code -1073741819 during test run
INFO | automation.py | Application ran for: 0:02:38.303000
INFO | automation.py | Reading PID log: c:\users\cltbld\appdata\local\temp\tmpcr91qvpidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1336659446/firefox-15.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/371124-2.html | application crashed (minidump found)
Crash dump filename: c:\users\cltbld\appdata\local\temp\tmpjxzbq8\minidumps\ef3715d5-67f5-4019-8053-e830fe2bc1bf.dmp
Operating system: Windows NT
                  6.1.7600 
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x4c

Thread 27 (crashed)
 0  xul.dll!mozilla::BlockingResourceBase::CheckAcquire(mozilla::CallStack const &) [BlockingResourceBase.cpp:9b326e2ad041 : 130 + 0x0]
    eip = 0x6bca85bf   esp = 0x0d6ff898   ebp = 0x0d6ff8f8   ebx = 0x13023588
    esi = 0x00000048   edi = 0x00000048   eax = 0x6223763e   ecx = 0x00000048
    edx = 0x00000000   efl = 0x00010202
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::Mutex::Lock() [BlockingResourceBase.cpp:9b326e2ad041 : 260 + 0xa]
    eip = 0x6bca86dd   esp = 0x0d6ff900   ebp = 0x0d6ff90c
    Found by: call frame info
 2  xul.dll!mozilla::MediaStreamGraphImpl::EnsureNextIteration() [MediaStreamGraph.cpp:9b326e2ad041 : 1211 + 0xc]
    eip = 0x6b6faa07   esp = 0x0d6ff914   ebp = 0x0d6ff920
    Found by: call frame info
 3  xul.dll!mozilla::SourceMediaStream::EndTrack(int) [MediaStreamGraph.cpp:9b326e2ad041 : 1870 + 0xa]
    eip = 0x6b6fbf6f   esp = 0x0d6ff928   ebp = 0x0d6ff934
    Found by: call frame info
 4  xul.dll!nsBuiltinDecoderStateMachine::FinishOutputStreams() [nsBuiltinDecoderStateMachine.cpp:9b326e2ad041 : 745 + 0x8]
    eip = 0x6b706b32   esp = 0x0d6ff93c   ebp = 0x0d6ff954
    Found by: call frame info
 5  xul.dll!nsBuiltinDecoderStateMachine::RunStateMachine() [nsBuiltinDecoderStateMachine.cpp:9b326e2ad041 : 2047 + 0x6]
    eip = 0x6b70b600   esp = 0x0d6ff95c   ebp = 0x0d6ff9a0
    Found by: call frame info
 6  xul.dll!nsBuiltinDecoderStateMachine::CallRunStateMachine() [nsBuiltinDecoderStateMachine.cpp:9b326e2ad041 : 2547 + 0x17]
    eip = 0x6b70bb40   esp = 0x0d6ff9a8   ebp = 0x0d6ff9bc
    Found by: call frame info
 7  xul.dll!nsBuiltinDecoderStateMachine::Run() [nsBuiltinDecoderStateMachine.cpp:9b326e2ad041 : 2529 + 0x6]
    eip = 0x6b70bc27   esp = 0x0d6ff9b8   ebp = 0x0d6ff9bc
    Found by: stack scanning
 8  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:9b326e2ad041 : 656 + 0xd]
    eip = 0x6bce3fcb   esp = 0x0d6ff9c4   ebp = 0x0d6ff9ec
}
Summary: Intermittent crash in dom/base/crashtests/371124-1.html | Exited with code -1073741819 during test run [@ BlockingResourceBase::CheckAcquire] → Intermittent crash in dom/base/crashtests/371124-1.html, 371124-2.html | Exited with code -1073741819 during test run [@ BlockingResourceBase::CheckAcquire]
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test crashtest on 2012-05-10 07:52:13 PDT for push f11717aa3a10

slave: talos-r4-snow-045

https://tbpl.mozilla.org/php/getParsedLog.php?id=11644156&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///Users/cltbld/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-1.html | 422 / 2050 (20%)
WARNING: No outer window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 8446
++DOMWINDOW == 42 (0x141274428) [serial = 968] [outer = 0x11b679c00]
++DOCSHELL 0x1412aef10 == 4 [id = 58]
++DOMWINDOW == 43 (0x12889a658) [serial = 969] [outer = 0x0]
WARNING: Subdocument container has no frame: file ../../../layout/base/nsDocumentViewer.cpp, line 2443
JavaScript error: , line 0: nothing active on context
++DOMWINDOW == 44 (0x123034048) [serial = 970] [outer = 0x12889a5e0]
WARNING: NS_ENSURE_TRUE(shell) failed: file ../../../docshell/base/nsDocShell.cpp, line 10914
WARNING: NS_ENSURE_TRUE(sf) failed: file ../../../docshell/base/nsDocShell.cpp, line 5132
WARNING: NS_ENSURE_TRUE(shell) failed: file ../../../docshell/base/nsDocShell.cpp, line 10914
WARNING: NS_ENSURE_TRUE(sf) failed: file ../../../docshell/base/nsDocShell.cpp, line 5132
WARNING: No outer window available!: file ../../../dom/base/nsGlobalWindow.cpp, line 8446
TEST-UNEXPECTED-FAIL | file:///Users/cltbld/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-1.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:01:33.795592
INFO | automation.py | Reading PID log: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpxHib5spidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-macosx64-debug/1336660640/firefox-15.0a1.en-US.mac64.crashreporter-symbols.zip
PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-1.html | application crashed (minidump found)
Crash dump filename: /var/folders/Hs/HsDn6a9SG8idoIya6p9mtE+++TI/-Tmp-/tmpmHWBoh/minidumps/9FBDA36E-258F-42B9-83CB-D657D66E4093.dmp
Operating system: Mac OS X
                  10.6.8 10K549
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x58

Thread 18 (crashed)
 0  XUL!mozilla::BlockingResourceBase::CheckAcquire [BlockingResourceBase.cpp : 130 + 0x0]
    rbx = 0x00000050   r12 = 0x00000050   r13 = 0x054ecd50   r14 = 0x054ecc80
    r15 = 0x246c7d40   rip = 0x034faf0e   rsp = 0x2865fd50   rbp = 0x2865feb0
    Found by: given as instruction pointer in context
 1  XUL!mozilla::Mutex::Lock [BlockingResourceBase.cpp : 260 + 0xb]
    rbx = 0x00000050   r12 = 0x00000050   r13 = 0x054ecd50   r14 = 0x054ecc80
    r15 = 0x246c7d40   rip = 0x034fc261   rsp = 0x2865fec0   rbp = 0x2865fee0
    Found by: call frame info
 2  XUL!mozilla::SourceMediaStream::EndTrack [Monitor.h : 70 + 0xb]
    rbx = 0x00000000   r12 = 0x00000050   r13 = 0x054ecd50   r14 = 0x054ecc80
    r15 = 0x246c7d40   rip = 0x028ad8e1   rsp = 0x2865fef0   rbp = 0x2865ff20
    Found by: call frame info
 3  XUL!nsBuiltinDecoderStateMachine::FinishOutputStreams [nsBuiltinDecoderStateMachine.cpp : 745 + 0xc]
    rbx = 0x414654e8   r12 = 0x00000000   r13 = 0x2468a530   r14 = 0x054ecc80
    r15 = 0x246c7d40   rip = 0x028c3c83   rsp = 0x2865ff30   rbp = 0x2865ff70
    Found by: call frame info
 4  XUL!nsBuiltinDecoderStateMachine::RunStateMachine [nsBuiltinDecoderStateMachine.cpp : 2047 + 0x7]
    rbx = 0x246c7d40   r12 = 0x285a1550   r13 = 0x246c7d40   r14 = 0x4245bc80
    r15 = 0x00000001   rip = 0x028d02e8   rsp = 0x2865ff80   rbp = 0x28660010
    Found by: call frame info
 5  XUL!nsBuiltinDecoderStateMachine::CallRunStateMachine [nsBuiltinDecoderStateMachine.cpp : 2547 + 0x7]
    rbx = 0x246c7d40   r12 = 0x2468a610   r13 = 0x288e58e0   r14 = 0x4245bc80
    r15 = 0x00000001   rip = 0x028d0f0c   rsp = 0x28660020   rbp = 0x28660030
    Found by: call frame info
 6  XUL!nsBuiltinDecoderStateMachine::Run [nsBuiltinDecoderStateMachine.cpp : 2529 + 0x7]
    rbx = 0x246c7d40   r12 = 0x2468a610   r13 = 0x288e58e0   r14 = 0x4245bc80
    r15 = 0x00000001   rip = 0x028d1168   rsp = 0x28660040   rbp = 0x28660050
    Found by: call frame info
 7  XUL!nsThread::ProcessNextEvent [nsThread.cpp : 656 + 0x5]
    rbx = 0x00000000   r12 = 0x288e58c0   r13 = 0x288e58e0   r14 = 0x4245bc80
    r15 = 0x00000001   rip = 0x03573118   rsp = 0x28660060   rbp = 0x28660130
    Found by: call frame info
 8  XUL!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 245 + 0xc]
    rbx = 0x00000001   r12 = 0x288e58c0   r13 = 0x288e58e0   r14 = 0x4245bc80
    r15 = 0x00000001   rip = 0x034f815d   rsp = 0x28660140   rbp = 0x28660160
    Found by: call frame info
 9  XUL!nsThread::Shutdown [nsThread.cpp : 498 + 0xd]
    rbx = 0x00000000   r12 = 0x288e58c0   r13 = 0x288e58e0   r14 = 0x4245bc80
    r15 = 0x00000001   rip = 0x0357506e   rsp = 0x28660170   rbp = 0x28660210
}
OS: Windows 7 → All
Hardware: x86 → All
Summary: Intermittent crash in dom/base/crashtests/371124-1.html, 371124-2.html | Exited with code -1073741819 during test run [@ BlockingResourceBase::CheckAcquire] → Intermittent crash in dom/base/crashtests/371124-1.html, dom/base/crashtests/371124-2.html, docshell/base/crashtests/436900-1.html | Exited with code -1073741819 during test run [@ BlockingResourceBase::CheckAcquire]
Looks like a dangling null pointer.
Component: XPCOM → Video/Audio
QA Contact: xpcom → video.audio
Earlier than the others so far:

Rev3 WINNT 5.1 mozilla-inbound debug test crashtest on 2012-05-10 02:57:20 PDT for push 837cb0a0af48

slave: talos-r3-xp-056

https://tbpl.mozilla.org/php/getParsedLog.php?id=11637574&tree=Mozilla-Inbound

{
REFTEST TEST-START | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/372554-1.html | 441 / 2050 (21%)
++DOMWINDOW == 95 (089611A0) [serial = 1018] [outer = 068CDB08]
--DOMWINDOW == 94 (09437240) [serial = 931] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/40929-1-inner.html]
--DOMWINDOW == 93 (09441CF0) [serial = 981] [outer = 00000000] [url = data:text/html,2]
--DOMWINDOW == 92 (05EA1AA8) [serial = 966] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-2-inner.html#foo]
--DOMWINDOW == 91 (06C8E470) [serial = 972] [outer = 00000000] [url = about:blank]
--DOMWINDOW == 90 (068503B8) [serial = 976] [outer = 00000000] [url = data:text/html,1]
--DOMWINDOW == 89 (11433378) [serial = 958] [outer = 00000000] [url = data:application/xhtml+xml;charset=utf-8,%3Chtml%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0A%3Cframeset%20contenteditable%3D%22true%22/%3E%0A%3Cscript%3E%0Afunction%20doExecCommand%28%29%7B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28doExecCommand%2C100%29%3B%0Awindow.addEventListener%28%27DOMNodeRemoved%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/html%3E]
--DOMWINDOW == 88 (0716ADB0) [serial = 980] [outer = 00000000] [url = data:text/html,1]
--DOMWINDOW == 87 (051E0EC8) [serial = 940] [outer = 00000000] [url = data:text/html,<body%20onUnload="location%20=%20'http://www.mozilla.org/'">This%20frame's%20onunload%20tries%20to%20load%20another%20page.]
--DOMWINDOW == 86 (06ADB338) [serial = 962] [outer = 00000000] [url = file:///c:/talos-slave/test/build/reftest/tests/docshell/base/crashtests/436900-1-inner.html#foo]
This GL context (09ED1C20) is owned by thread 030AE728, but the current thread is 08D660E0. That's fine by itself, but our current code in GLContext::MakeCurrent, checking if the context is already current, relies on the assumption that GL calls on a given GLContext are only made by the thread that created that GLContext. If you want to start making GL calls from non-owning threads, you'll have to change a few things around here, see Bug 749678 comments 13 and 15.
###!!! ABORT: file e:\builds\moz2_slave\m-in-w32-dbg\build\obj-firefox\dist\include\GLContext.h, line 698
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/372554-1.html | Exited with code -2147483645 during test run
INFO | automation.py | Application ran for: 0:02:26.250000
INFO | automation.py | Reading PID log: c:\docume~1\cltbld\locals~1\temp\tmpbzv2ippidlog
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-win32-debug/1336636403/firefox-15.0a1.en-US.win32.crashreporter-symbols.zip
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/372554-1.html | application crashed (minidump found)
Crash dump filename: c:\docume~1\cltbld\locals~1\temp\tmpbf_ndq\minidumps\61721ec5-912c-4fda-bb78-cba5c02d8d95.dmp
Operating system: Windows NT
                  5.1.2600 Service Pack 2
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x4c

Thread 26 (crashed)
 0  xul.dll!mozilla::BlockingResourceBase::CheckAcquire(mozilla::CallStack const &) [BlockingResourceBase.cpp:837cb0a0af48 : 130 + 0x0]
    eip = 0x01f585c0   esp = 0x087ffdb8   ebp = 0x087ffe18   ebx = 0x11581028
    esi = 0x00000048   edi = 0x00000048   eax = 0x19af664f   ecx = 0x00000048
    edx = 0x030a6f2c   efl = 0x00010202
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::Mutex::Lock() [BlockingResourceBase.cpp:837cb0a0af48 : 260 + 0xa]
    eip = 0x01f586de   esp = 0x087ffe20   ebp = 0x087ffe2c
    Found by: call frame info
 2  xul.dll!mozilla::MediaStreamGraphImpl::EnsureNextIteration() [MediaStreamGraph.cpp:837cb0a0af48 : 1211 + 0xc]
    eip = 0x019aaa07   esp = 0x087ffe34   ebp = 0x087ffe40
    Found by: call frame info
 3  xul.dll!mozilla::SourceMediaStream::EndTrack(int) [MediaStreamGraph.cpp:837cb0a0af48 : 1870 + 0xa]
    eip = 0x019abf6f   esp = 0x087ffe48   ebp = 0x087ffe54
    Found by: call frame info
 4  xul.dll!nsBuiltinDecoderStateMachine::FinishOutputStreams() [nsBuiltinDecoderStateMachine.cpp:837cb0a0af48 : 745 + 0x8]
    eip = 0x019b6b32   esp = 0x087ffe5c   ebp = 0x087ffe74
    Found by: call frame info
 5  xul.dll!nsBuiltinDecoderStateMachine::RunStateMachine() [nsBuiltinDecoderStateMachine.cpp:837cb0a0af48 : 2047 + 0x6]
    eip = 0x019bb600   esp = 0x087ffe7c   ebp = 0x087ffec0
    Found by: call frame info
 6  xul.dll!nsBuiltinDecoderStateMachine::CallRunStateMachine() [nsBuiltinDecoderStateMachine.cpp:837cb0a0af48 : 2547 + 0x17]
    eip = 0x019bbb40   esp = 0x087ffec8   ebp = 0x087ffedc
    Found by: call frame info
 7  xul.dll!nsBuiltinDecoderStateMachine::Run() [nsBuiltinDecoderStateMachine.cpp:837cb0a0af48 : 2529 + 0x6]
    eip = 0x019bbc27   esp = 0x087ffed8   ebp = 0x087ffedc
    Found by: stack scanning
 8  xul.dll!nsThread::ProcessNextEvent(bool,bool *) [nsThread.cpp:837cb0a0af48 : 656 + 0xd]
    eip = 0x01f93fd9   esp = 0x087ffee4   ebp = 0x087fff0c
}
Summary: Intermittent crash in dom/base/crashtests/371124-1.html, dom/base/crashtests/371124-2.html, docshell/base/crashtests/436900-1.html | Exited with code -1073741819 during test run [@ BlockingResourceBase::CheckAcquire] → Frequent crashes during a variety of crashtests in [@ BlockingResourceBase::CheckAcquire]
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test crashtest on 2012-05-10 09:55:17 PDT for push af2b5a6acb96
slave: talos-r4-snow-006
docshell/base/crashtests/614499-1.html | Exited with code 1 during test run

https://tbpl.mozilla.org/php/getParsedLog.php?id=11646841&tree=Mozilla-Inbound
Rev4 MacOSX Snow Leopard 10.6 mozilla-inbound debug test crashtest on 2012-05-10 10:11:05 PDT for push 8cd71b91b4c6
slave: talos-r4-snow-047
docshell/base/crashtests/436900-2.html
https://tbpl.mozilla.org/php/getParsedLog.php?id=11647158&tree=Mozilla-Inbound
Severity: normal → critical
CC'ing some people based on philor's bug 754078 comment 0 assessment of this.

(Also re-adding some of the crashtests to the summary, given that this seems to be occurring to some of them more than once, so there's a chance it might speed starring at least some of the time.)
Summary: Frequent crashes during a variety of crashtests in [@ BlockingResourceBase::CheckAcquire] → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 462947.html and more
The assertion message from Bug 749678 made us initially suspect a regression from it, but the dates don't quite match: Bug 749678 landed on m-i on May 8 and hit m-c also on May 8, while this intermittent orange only started on May 10.

I tried reproducing on Linux by setting layers.acceleration.force-enabled, but no luck.

Next step: try reproducing on Windows or Mac. But as it doesn't seem like a regression from 749678 at this point, I'm not sure that I can prioritize this higher than my remaining Fennec blocker.
There is a huge WTF in comment 4: why is this GLContext assertion ever triggered on Windows outside of WebGL tests?
https://tbpl.mozilla.org/php/getParsedLog.php?id=11695756&tree=Mozilla-Inbound
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 462947.html and more → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 462947.html, 404869-1.xul and more
https://tbpl.mozilla.org/php/getParsedLog.php?id=11702324&tree=Firefox
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 462947.html, 404869-1.xul and more → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul and more
https://tbpl.mozilla.org/php/getParsedLog.php?id=11709158&tree=Mozilla-Inbound
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul and more → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul and more
Bug 749678 has been  backed out on inbound yesterday (3e0f7b9a39d7). Let's check if this intermittent failure persists.
A-ha! Both comment 27 (OSX 10.6) and comment 28 (WinXP) are with Bug 749678 backed out (comment 26).

So it appears that Bug 749678 was not the culprit!
https://tbpl.mozilla.org/php/getParsedLog.php?id=11732113&tree=Mozilla-Inbound
Rev3 WINNT 6.1 mozilla-inbound debug test crashtest on 2012-05-14 12:31:36 PDT for push d0f6caf941d1

TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/504224.html | Exited with code -1073741819 during test run
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/504224.html | application crashed (minidump found)
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul and more → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more
https://tbpl.mozilla.org/php/getParsedLog.php?id=11734851&tree=Mozilla-Inbound
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more
https://tbpl.mozilla.org/php/getParsedLog.php?id=11738006&tree=Mozilla-Inbound
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more → Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 432114-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more
https://tbpl.mozilla.org/php/getParsedLog.php?id=11730727&tree=Fx-Team
https://tbpl.mozilla.org/php/getParsedLog.php?id=11732287&tree=Fx-Team

Might as well fill this summary up, even though it's inevitable that we're going to have to create a clone bug to add more to eventually. Or just decide it's every single crashtest.

Or fix the crash.
Summary: Frequent crashes in [@ BlockingResourceBase::CheckAcquire] during 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 432114-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more → Frequent [@ BlockingResourceBase::CheckAcquire] in 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 432114-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 677194.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more
https://tbpl.mozilla.org/php/getParsedLog.php?id=11771492&tree=Mozilla-Inbound
Summary: Frequent [@ BlockingResourceBase::CheckAcquire] in 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 432114-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 677194.html, 601247.html, 462947.html, 404869-1.xul, 504224.html and more → Frequent [@ BlockingResourceBase::CheckAcquire] in 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 432114-1.html, 432114-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 677194.html, 601247.html, 462947.html, 404869-1.xul, 504224.html ...
https://tbpl.mozilla.org/php/getParsedLog.php?id=11777785&tree=Mozilla-Inbound
Summary: Frequent [@ BlockingResourceBase::CheckAcquire] in 327571-1.html, 371124-1.html, 371124-2.html, 372554-1.html, 432114-1.html, 432114-2.html, 436900-1.html, 375399-1.html, 614499-1.html, 677194.html, 601247.html, 462947.html, 404869-1.xul, 504224.html ... → crash [@ BlockingResourceBase::CheckAcquire] in 327571-1.html 371124-1.html 371124-2.html 372554-1.html 432114-1.html 432114-2.html 436900-1.html 375399-1.html 614499-1.html 677194.html 601247.html 462947.html 404869-1.xul 504224.html 436900-2.html ...
https://tbpl.mozilla.org/php/getParsedLog.php?id=11778323&tree=Fx-Team

TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/417852-1.html | Exited with code -1073741819 during test run
TEST-UNEXPECTED-FAIL | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/439206-1.html | Exited with code -1073741819 during test run
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/439206-1.html | application crashed (minidump found) 

https://tbpl.mozilla.org/php/getParsedLog.php?id=11798613&tree=Mozilla-Inbound
I did like the part of my dupe that had mozilla::MediaStreamGraphImpl::EnsureNextIteration() in the summary, for things that don't make it as far as the mutex:

https://tbpl.mozilla.org/php/getParsedLog.php?id=11813016&tree=Fx-Team
PROCESS-CRASH | file:///c:/talos-slave/test/build/reftest/tests/dom/base/crashtests/462947.html | application crashed (minidump found)
Crash dump filename: c:\docume~1\cltbld\locals~1\temp\tmpl-mey7\minidumps\37d1b5b9-b0c7-481d-9649-f8d2e1492d84.dmp
Operating system: Windows NT
                  5.1.2600 Service Pack 2
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXCEPTION_ACCESS_VIOLATION_READ
Crash address: 0x48

Thread 24 (crashed)
 0  xul.dll!mozilla::MediaStreamGraphImpl::EnsureNextIteration() [MediaStreamGraph.cpp:65fb8b9ea0b7 : 1211 + 0x3]
    eip = 0x013d253b   esp = 0x052ffe34   ebp = 0x052ffe3c   ebx = 0x11314b00
    esi = 0x00000048   edi = 0x00000000   eax = 0x00000000   ecx = 0x043093e0
    edx = 0x043093fc   efl = 0x00010246
    Found by: given as instruction pointer in context
 1  xul.dll!mozilla::SourceMediaStream::EndTrack(int) [MediaStreamGraph.cpp:65fb8b9ea0b7 : 1870 + 0xa]
    eip = 0x01404ef3   esp = 0x052ffe44   ebp = 0x052ffe48
    Found by: call frame info
 2  xul.dll!nsBuiltinDecoderStateMachine::FinishOutputStreams() [nsBuiltinDecoderStateMachine.cpp:65fb8b9ea0b7 : 745 + 0x7]
    eip = 0x0142c73a   esp = 0x052ffe50   ebp = 0x052ffe6c
    Found by: call frame info
 3  xul.dll!nsBuiltinDecoderStateMachine::RunStateMachine() [nsBuiltinDecoderStateMachine.cpp:65fb8b9ea0b7 : 2047 + 0x5]
    eip = 0x015b8fe2   esp = 0x052ffe74   ebp = 0x052ffea0
    Found by: call frame info
https://tbpl.mozilla.org/php/getParsedLog.php?id=11853478&tree=Firefox

PROCESS-CRASH | file:///Users/cltbld/talos-slave/test/build/reftest/tests/editor/libeditor/html/crashtests/639736-1.xhtml | application crashed (minidump found)
Crash dump filename: /var/folders/qd/srwd5f710sj0fcl9z464lkj00000gn/T/tmpJPk5sw/minidumps/DBD97F58-533A-4621-AA82-915F86D815F9.dmp
Operating system: Mac OS X
                  10.7.2 11C74
CPU: amd64
     family 6 model 23 stepping 10
     2 CPUs

Crash reason:  EXC_BAD_ACCESS / KERN_INVALID_ADDRESS
Crash address: 0x50

Thread 16 (crashed)
 0  XUL!mozilla::SourceMediaStream::EndTrack [mozilla-central:x.h:e794cef56df6 : 106 + 0x0]
    rbx = 0x00000000   r12 = 0x00000000   r13 = 0x3d3881f0   r14 = 0x3edeb2e0
    r15 = 0x1c180eaf   rip = 0x018dca9e   rsp = 0x1c180d80   rbp = 0x3d3881f0
    Found by: given as instruction pointer in context
 1  XUL!nsBuiltinDecoderStateMachine::RunStateMachine [nsBuiltinDecoderStateMachine.cpp : 745 + 0xc]
    rbx = 0x1aa55478   r12 = 0x00000000   r13 = 0x3d3881f0   r14 = 0x3edeb2e0
    r15 = 0x1c180eaf   rip = 0x018ebacd   rsp = 0x1c180da0   rbp = 0x18520100
    Found by: call frame info
 2  XUL!nsBuiltinDecoderStateMachine::Run [nsBuiltinDecoderStateMachine.cpp : 2547 + 0x7]
    rbx = 0x18520100   r12 = 0x3edeb2e0   r13 = 0x150a2e48   r14 = 0x1c180e40
    r15 = 0x1c180eaf   rip = 0x018ebc2c   rsp = 0x1c180df0   rbp = 0x8000ffff
    Found by: call frame info
 3  XUL!nsThread::ProcessNextEvent [nsThread.cpp : 656 + 0x5]
    rbx = 0x150a2e20   r12 = 0x00000001   r13 = 0x150a2e48   r14 = 0x1c180e40
    r15 = 0x1c180eaf   rip = 0x01ff7b93   rsp = 0x1c180e10   rbp = 0x8000ffff
    Found by: call frame info
This is totally me.
Assignee: nobody → roc
There is only one crashtest that uses MediaStreams: /content/media/test/crashtests/752784-1.html.

I guess there's some kind of shutdown problem.
I think this one looks likely to be the same (but the opt build variant rather than debug build variant that's above):
Rev3 Fedora 12 mozilla-inbound opt test crashtest on 2012-05-18 04:55:45 PDT for push 1d43642295b1
https://tbpl.mozilla.org/php/getParsedLog.php?id=11859504&tree=Mozilla-Inbound#error1
though it doesn't have the top 2 frames:


REFTEST TEST-START | file:///home/cltbld/talos-slave/test/build/reftest/tests/intl/uconv/crashtests/563618.html | 530 / 2058 (25%)
TEST-UNEXPECTED-FAIL | file:///home/cltbld/talos-slave/test/build/reftest/tests/intl/uconv/crashtests/563618.html | Exited with code 1 during test run
INFO | automation.py | Application ran for: 0:01:11.817287
INFO | automation.py | Reading PID log: /tmp/tmpUJlnUupidlog
==> process 2172 launched child process 2203
INFO | automation.py | Checking for orphan process with PID: 2203
Downloading symbols from: http://ftp.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-inbound-linux/1337340796/firefox-15.0a1.en-US.linux-i686.crashreporter-symbols.zip
PROCESS-CRASH | file:///home/cltbld/talos-slave/test/build/reftest/tests/intl/uconv/crashtests/563618.html | application crashed (minidump found)
Crash dump filename: /tmp/tmpV5CYlv/minidumps/60cef349-8dab-719c-151e8cb3-081900e1.dmp
Operating system: Linux
                  0.0.0 Linux 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686
CPU: x86
     GenuineIntel family 6 model 23 stepping 10
     2 CPUs

Crash reason:  SIGSEGV
Crash address: 0x44

Thread 17 (crashed)
 0  libxul.so!mozilla::MediaStreamGraphImpl::EnsureNextIteration [Mutex.h : 106 + 0x0]
    eip = 0x017abc66   esp = 0xa14fe154   ebp = 0xa94de100   ebx = 0x024c873c
    esi = 0x00000000   edi = 0x00000000   eax = 0x00000044   ecx = 0x00000000
    edx = 0x00000000   efl = 0x00210206
    Found by: given as instruction pointer in context
 1  libxul.so!nsBuiltinDecoderStateMachine::FinishOutputStreams [nsBuiltinDecoderStateMachine.cpp : 744 + 0xd]
    eip = 0x017b3e42   esp = 0xa14fe180   ebp = 0xa94de100   ebx = 0x024c873c
    esi = 0xa872f1a8   edi = 0x00000000
    Found by: call frame info
 2  libxul.so!nsBuiltinDecoderStateMachine::RunStateMachine [nsBuiltinDecoderStateMachine.cpp : 2045 + 0x7]
    eip = 0x017b8b70   esp = 0xa14fe1b0   ebp = 0x00000000   ebx = 0x024c873c
    esi = 0xa94de100   edi = 0xa5fb5a30
    Found by: call frame info
 3  libxul.so!nsBuiltinDecoderStateMachine::CallRunStateMachine [nsBuiltinDecoderStateMachine.cpp : 2546 + 0x5]
    eip = 0x017b8f2f   esp = 0xa14fe210   ebp = 0xa14fe31c   ebx = 0x024c873c
    esi = 0xa94de100   edi = 0xa94de100
    Found by: call frame info
 4  libxul.so!nsBuiltinDecoderStateMachine::Run [nsBuiltinDecoderStateMachine.cpp : 2528 + 0x7]
    eip = 0x017b9007   esp = 0xa14fe230   ebp = 0xa14fe31c   ebx = 0x024c873c
    esi = 0xb715abc4   edi = 0xa94de100
    Found by: call frame info
 5  libxul.so!nsThread::ProcessNextEvent [nsThread.cpp : 656 + 0x5]
    eip = 0x01c7530b   esp = 0xa14fe260   ebp = 0xa14fe31c   ebx = 0x024c873c
    esi = 0xa94405e0   edi = 0x00000000
    Found by: call frame info
 6  libxul.so!NS_ProcessNextEvent_P [nsThreadUtils.cpp : 245 + 0x12]
    eip = 0x01c4568b   esp = 0xa14fe2d0   ebp = 0xa14fe31c   ebx = 0x024c873c
    esi = 0x00000001   edi = 0xa944060c
    Found by: call frame info
 7  libxul.so!nsThread::ThreadFunc [nsThread.cpp : 289 + 0x9]
    eip = 0x01c74eb2   esp = 0xa14fe300   ebp = 0xa14fe31c   ebx = 0x024c873c
    esi = 0xa94405e0   edi = 0xa944060c
    Found by: call frame info
 8  libnspr4.so!_pt_root [ptthread.c : 155 + 0x8]
    eip = 0x00f1cde7   esp = 0xa14fe340   ebp = 0xa14fe378   ebx = 0x00f2652c
    esi = 0xab116030   edi = 0x003d0f00
    Found by: call frame info
 9  libpthread-2.11.so + 0x5ab4
    eip = 0x00c6bab5   esp = 0xa14fe380   ebp = 0xa14fe478   ebx = 0x00c7cff4
No longer blocks: 438871
Crash Signature: [@ BlockingResourceBase::CheckAcquire] → [@ BlockingResourceBase::CheckAcquire] [@ mozilla::MediaStreamGraphImpl::EnsureNextIteration]
Blocks: 438871
The crash stacks indicate the SourceMediaStream exists but the MediaStreamGraph has gone away (gGraph is null).

Basically I think the problem is that both the nsHTMLMediaElement and its nsDOMMediaStream can be GCed and destroyed while the nsBuiltinDecoderStateMachine is still running. Destruction of the nsDOMMediaStream sends a message to the MediaStreamGraph to remove the SourceMediaStream from the graph; once that's happened, the graph itself will shut down, clearing gGraph. But nsBuiltinDecoderStateMachine is still stuck doing whatever and then finally enters the DECODER_STATE_SHUTDOWN path and calls FinishOutputStreams, and we have the crash here.
The best thing to do is probably to have a flag in MediaStream indicating whether the stream is in the graph or not. Operations on the stream, other than through MediaStreamGraph itself, should check this flag and bail out if the stream is no longer part of the graph.
Attached patch fix — — Splinter Review 
I think this will fix it.

Most of the patch is just reindenting code.
Attachment #626323 - Flags: review?(rjesup)
Attachment #626323 - Flags: review?(rjesup) → review+
Whiteboard: [orange] → [orange][test which aborts the suite]
https://hg.mozilla.org/mozilla-central/rev/1818f759cdbd
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
Whiteboard: [orange][test which aborts the suite] → [test which aborts the suite]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: