Last Comment Bug 774084 - crash in nsBuiltinDecoder::GetSeekable
: crash in nsBuiltinDecoder::GetSeekable
Status: VERIFIED FIXED
: crash, regression
Product: Core
Classification: Components
Component: Audio/Video (show other bugs)
: 15 Branch
: All Windows 7
: -- critical (vote)
: mozilla17
Assigned To: Paul Adenot (:padenot)
:
Mentors:
Depends on:
Blocks: 756372
  Show dependency treegraph
 
Reported: 2012-07-15 09:18 PDT by Scoobidiver (away)
Modified: 2012-08-28 02:46 PDT (History)
5 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
verified
verified


Attachments
Fix a crash in nsBuiltinDecoder::GetSeekable. r= (1.04 KB, patch)
2012-07-15 11:00 PDT, Paul Adenot (:padenot)
kinetik: review+
lukasblakk+bugs: approval‑mozilla‑aurora+
lukasblakk+bugs: approval‑mozilla‑beta+
Details | Diff | Splinter Review

Description Scoobidiver (away) 2012-07-15 09:18:14 PDT
It's #45 top browser crasher in 15.0a2.
It first appeared in 15.0a1/20120519. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=e794cef56df6&tochange=642d1a36702f
It might be a regression from bug 754643.

Signature 	nsBuiltinDecoder::GetSeekable(nsTimeRanges*) More Reports Search
UUID	846f71b2-3652-4bfd-85cc-212992120714
Date Processed	2012-07-14 19:51:06
Uptime	13749
Last Crash	3.1 weeks before submission
Install Age	5.6 hours since version was first installed.
Install Time	2012-07-14 14:15:08
Product	Firefox
Version	16.0a1
Build ID	20120714030554
Release Channel	nightly
OS	Windows NT
OS Version	6.2.8400
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 42 stepping 7
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x8086, AdapterDeviceID: 0x0126, AdapterSubsysID: 050e1028, AdapterDriverVersion: 9.17.10.2736
Has dual GPUs. GPU #2: AdapterVendorID2: 0x10de, AdapterDeviceID2: 0x0df4, AdapterSubsysID2: 050e1028, AdapterDriverVersion2: 9.18.13.280D2D? D2D+ DWrite? DWrite+ D3D10 Layers? D3D10 Layers+ 
EMCheckCompatibility	True
Adapter Vendor ID	0x8086
Adapter Device ID	0x0126
Total Virtual Memory	4294836224
Available Virtual Memory	3264307200
System Memory Use Percentage	43
Available Page File	11563372544
Available Physical Memory	4212248576

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsBuiltinDecoder::GetSeekable 	content/media/nsBuiltinDecoder.cpp:959
1 	xul.dll 	nsBuiltinDecoder::Seek 	content/media/nsBuiltinDecoder.cpp:311
2 	xul.dll 	nsHTMLMediaElement::SetCurrentTime 	content/html/content/src/nsHTMLMediaElement.cpp:1273
3 	xul.dll 	nsHTMLAudioElement::SetCurrentTime 	obj-firefox/dist/include/nsHTMLVideoElement.h:40
4 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
5 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2382
6 	xul.dll 	XPCWrappedNative::SetAttribute 	js/xpconnect/src/xpcprivate.h:2815
7 	xul.dll 	XPC_WN_GetterSetter 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1514
8 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:344
...

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsBuiltinDecoder%3A%3AGetSeekable%28nsTimeRanges*%29
Comment 1 Josh Matthews [:jdm] 2012-07-15 09:34:16 PDT
Nearly every other use of mDecoderStateMachine in this file is guarded by a null check. It is missing in GetSeekable.
Comment 2 Paul Adenot (:padenot) 2012-07-15 11:00:04 PDT
Created attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

Indeed we need to check if we still have a state machine, thanks.

Here is a patch.
Comment 3 Matthew Gregan [:kinetik] 2012-08-07 15:59:16 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a1325b95bd4

Given that this is a top crash and a regression in 15, we should try to get this on the branches as well.
Comment 4 Matthew Gregan [:kinetik] 2012-08-07 16:02:35 PDT
Comment on attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 756372
User impact if declined: crashes when using HTML5 media
Testing completed (on m-c, etc.): tested locally
Risk to taking this patch (and alternatives if risky): extremely low, patch adds a simple null check
String or UUID changes made by this patch: none
Comment 5 Ed Morley [:emorley] 2012-08-08 09:31:47 PDT
https://hg.mozilla.org/mozilla-central/rev/0a1325b95bd4
Comment 6 Lukas Blakk [:lsblakk] use ?needinfo 2012-08-09 10:07:11 PDT
Comment on attachment 642399 [details] [diff] [review]
Fix a crash in nsBuiltinDecoder::GetSeekable. r=

low risk, null check - approving for branches.
Comment 8 Mihaela Velimiroviciu (:mihaelav) 2012-08-28 02:46:15 PDT
There are no crash reports with this signature on builds after August 12 in Socorro.
Hence, marking VERIFIED for Firefox 15 and 16.

Note You need to log in before you can comment on or make changes to this bug.