789741 - crash in nsMediaSniffer::GetMIMETypeFromContent

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Scoobidiver (away)]

It first appeared in 18.0a1/20120908. The regression range is:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=36427d4b2cf6&tochange=1d4fc0c60063
It's likely a regression from bug 789077.

Signature 	nsMediaSniffer::GetMIMETypeFromContent(nsIRequest*, unsigned char const*, unsigned int, nsACString_internal&) More Reports Search
UUID	707dc775-b1ac-4906-896a-eaa2c2120908
Date Processed	2012-09-08 18:14:36
Uptime	14
Last Crash	1.2 minutes before submission
Install Age	3.2 minutes since version was first installed.
Install Time	2012-09-09 03:10:30
Product	Firefox
Version	18.0a1
Build ID	20120908030556
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 15 stepping 6
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x10de, AdapterDeviceID: 0x00cd, AdapterSubsysID: 029b10de, AdapterDriverVersion: 8.15.11.8593
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
EMCheckCompatibility	True
Adapter Vendor ID	0x10de
Adapter Device ID	0x00cd
Total Virtual Memory	4294836224
Available Virtual Memory	4006703104
System Memory Use Percentage	21
Available Page File	11202719744
Available Physical Memory	5023891456

Frame 	Module 	Signature 	Source
0 	xul.dll 	nsMediaSniffer::GetMIMETypeFromContent 	toolkit/components/mediasniffer/nsMediaSniffer.cpp:89
1 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:70
2 	xul.dll 	XPCWrappedNative::CallMethod 	js/xpconnect/src/XPCWrappedNative.cpp:2405
3 	xul.dll 	XPC_WN_CallMethod 	js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1469
4 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:344
5 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:2406
6 	xul.dll 	nsRefPtr<nsIDOMEventListener>::~nsRefPtr<nsIDOMEventListener> 	obj-firefox/dist/include/nsAutoPtr.h:874
7 	mozjs.dll 	js::InvokeKernel 	js/src/jsinterp.cpp:355
8 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:388
9 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5908
10 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/xpconnect/src/XPCWrappedJSClass.cpp:1433
11 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/xpconnect/src/XPCWrappedJS.cpp:580
12 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:85
13 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:112
14 	xul.dll 	nsStreamListenerTee::OnStopRequest 	netwerk/base/src/nsStreamListenerTee.cpp:49

More reports at:
https://crash-stats.mozilla.com/report/list?signature=nsMediaSniffer%3A%3AGetMIMETypeFromContent%28nsIRequest*%2C+unsigned+char+const*%2C+unsigned+int%2C+nsACString_internal%26%29

Comment 1

[Paul Adenot (:padenot)]

Attachment: Maybe fix the crash?

I could not reproduce on a local win7 debug build, I'll investigate in the next few days.

Kinda weird it seems to segfault on the for loop, though, but maybe the line number if not right.

I'm wondering if we should test for the return value of the QI, here, it's the only thing that could cause a segfault like that, I suppose, but I'm not sure.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 659536 [details] [diff] [review]
Maybe fix the crash?

I just poked a few of the crash reports, and they claim to crash with a null deref on this line:

  nsresult rv = channel->GetContentType(contentType);

And also, they all have the "Yahoo! Toolbar" extension.  So yeah, clearly something is violating the API here, but the null-check seems like the right way to deal.  Please land this.  ;)  r=me

Comment 3

[Paul Adenot (:padenot)]

Attachment: (Added r=bz)

Comment 4

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/4cbc8f1be382

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4cbc8f1be382