crash in nsBuiltinDecoder::GetSeekable

VERIFIED FIXED in Firefox 15

Status

()

Core
Audio/Video
--
critical
VERIFIED FIXED
5 years ago
5 years ago

People

(Reporter: Scoobidiver (away), Assigned: padenot)

Tracking

({crash, regression})

15 Branch
mozilla17
All
Windows 7
crash, regression
Points:
---

Firefox Tracking Flags

(firefox15 verified, firefox16 verified)

Details

(crash signature)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
It's #45 top browser crasher in 15.0a2.
It first appeared in 15.0a1/20120519. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e794cef56df6&tochange=642d1a36702f
It might be a regression from bug 754643.

Signature 	nsBuiltinDecoder::GetSeekable(nsTimeRanges*) More Reports Search
UUID	846f71b2-3652-4bfd-85cc-212992120714
Date Processed	2012-07-14 19:51:06
Uptime	13749
Last Crash	3.1 weeks before submission
Install Age	5.6 hours since version was first installed.
Install Time	2012-07-14 14:15:08
Product	Firefox
Version	16.0a1
Build ID	20120714030554
Release Channel	nightly
OS	Windows NT
OS Version	6.2.8400
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 050e1028, AdapterDriverVersion: 9.17.10.2736
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0df4, AdapterSubsysID2: 050e1028, AdapterDriverVersion2: 9.18.13.280D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0126
Total Virtual Memory	4294836224
Available Virtual Memory	3264307200
System Memory Use Percentage	43
Available Page File	11563372544
Available Physical Memory	4212248576

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsBuiltinDecoder::GetSeekable 	content/media/nsBuiltinDecoder.cpp:959
1 	xul.dll 	nsBuiltinDecoder::Seek 	content/media/nsBuiltinDecoder.cpp:311
2 	xul.dll 	nsHTMLMediaElement::SetCurrentTime 	content/html/content/src/nsHTMLMediaElement.cpp:1273
3 	xul.dll 	nsHTMLAudioElement::SetCurrentTime 	obj-firefox/dist/include/nsHTMLVideoElement.h:40
4 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
5 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2382
6 	xul.dll 	XPCWrappedNative::SetAttribute 	js/xpconnect/src/xpcprivate.h:2815
7 	xul.dll 	XPC_WN_GetterSetter 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1514
8 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:344
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsBuiltinDecoder%3A%3AGetSeekable%28nsTimeRanges*%29

Comment 1

5 years ago
Nearly every other use of mDecoderStateMachine in this file is guarded by a null check. It is missing in GetSeekable.

Updated

5 years ago
Blocks: 756372
Assignee: nobody → paul
Created attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

Indeed we need to check if we still have a state machine, thanks.

Here is a patch.
Attachment #642399 - Flags: review?(kinetik)
Attachment #642399 - Flags: review?(kinetik) → review+
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a1325b95bd4

Given that this is a top crash and a regression in 15, we should try to get this on the branches as well.
Status: NEW → ASSIGNED
Crash Signature: [@ nsBuiltinDecoder::GetSeekable(nsTimeRanges*)] → [@ nsBuiltinDecoder::GetSeekable(nsTimeRanges*)] [@ nsBuiltinDecoder::GetSeekable]
Keywords: checkin-needed
Target Milestone: --- → mozilla17
Comment on attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 756372
User impact if declined: crashes when using HTML5 media
Testing completed (on m-c, etc.): tested locally
Risk to taking this patch (and alternatives if risky): extremely low, patch adds a simple null check
String or UUID changes made by this patch: none
Attachment #642399 - Flags: approval-mozilla-beta?
Attachment #642399 - Flags: approval-mozilla-aurora?
https://hg.mozilla.org/mozilla-central/rev/0a1325b95bd4
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Comment on attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

low risk, null check - approving for branches.
Attachment #642399 - Flags: approval-mozilla-beta?
Attachment #642399 - Flags: approval-mozilla-beta+
Attachment #642399 - Flags: approval-mozilla-aurora?
Attachment #642399 - Flags: approval-mozilla-aurora+
https://hg.mozilla.org/releases/mozilla-aurora/rev/7119a45e0fea
https://hg.mozilla.org/releases/mozilla-beta/rev/19ad43a4a27b
status-firefox15: --- → fixed
status-firefox16: --- → fixed
There are no crash reports with this signature on builds after August 12 in Socorro.
Hence, marking VERIFIED for Firefox 15 and 16.
Status: RESOLVED → VERIFIED
status-firefox15: fixed → verified
status-firefox16: fixed → verified
You need to log in before you can comment on or make changes to this bug.