795892 - Playing video causes reproducible crash in nsCOMPtr_base::assign_with_AddRef

Status: RESOLVED FIXED

(Core :: Audio/Video, defect, critical)

Description

[Benoit Girard (:BenWa)]

This bug was filed from the Socorro interface and is 
report bp-691616c5-4123-4688-9f17-41c4f2121001 .
============================================================= 

I also get at least one other signature:
bp-667bdd46-3bc0-430f-8740-a68262121001

STR:
0) On mac at least with the 2012-09-30 nightly.
1) Open page: http://people.mozilla.com/~bgirard/cleopatra/?zippedProfile=profiles/sps-profile-1348512228.12.zip&videoCapture=videos/video-1348512228.11.webm
2) After loading click play on the video element.

Comment 1

[Scoobidiver (away)]

Without step 2, I hit bug 789075 on Windows in 15.0.1 and above.

Comment 2

[Matthew Gregan [:kinetik]]

I'm bisecting this now.

Comment 3

[Matthew Gregan [:kinetik]]

It's https://hg.mozilla.org/mozilla-central/rev/4cda2cc45466 from bug 788275.

Comment 4

[Matthew Gregan [:kinetik]]

Well, that change surfaced the bug, but it's not the cause.  The real cause is pretty dumb:

605       nsCORSListenerProxy* crossSiteListener =
606         new nsCORSListenerProxy(mListener,
607                                 element->NodePrincipal(),
608                                 false);
609       nsresult rv = crossSiteListener->Init(mChannel);

...it's a shame the compiler can't catch this.

Comment 5

[Matthew Gregan [:kinetik]]

Attachment: patch v0

Comment 6

[:ehsan akhgari]

Oops!  Thanks Matthew for the quick fix.

Comment 7

[Benoit Girard (:BenWa)]

Thanks :)

Comment 8

[:ehsan akhgari]

I pushed this since I feel pretty bad for making this mistake, and wanted to take some responsibility.  :-)

https://hg.mozilla.org/integration/mozilla-inbound/rev/9a73d985e5e9

Comment 9

[Matthew Gregan [:kinetik]]

Don't feel bad, it wasn't your mistake.  This has been hiding in our code waiting to bite someone for a long time.  Thanks for pushing the fix!

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/9a73d985e5e9

Should this have a crashtest?

Comment 11

[Jim Jeffery not reading bug-mail 1/2/11]

Pardon my question, but the test link in Cleopatra still crashes the browser.  

tested using the latest hourly build with this patch.  crash-report will not be of use because of no-symbols in hourly builds. 

If this was supposed to fix the crash it does not seem to be fixed.
Isn't this a dupe of bug 789075 ? which still remains un-fixed ?

Comment 12

[:ehsan akhgari]

(In reply to comment #11)
> Pardon my question, but the test link in Cleopatra still crashes the browser.  
> 
> tested using the latest hourly build with this patch.  crash-report will not be
> of use because of no-symbols in hourly builds. 
> 
> If this was supposed to fix the crash it does not seem to be fixed.
> Isn't this a dupe of bug 789075 ? which still remains un-fixed ?

You're probably seeing the crash in bug 789075, which is still not fixed.

Comment 13

[Matthew Gregan [:kinetik]]

(In reply to Ryan VanderMeulen from comment #10)
> Should this have a crashtest?

https://hg.mozilla.org/integration/mozilla-inbound/rev/0efeec87af33

Comment 14

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0efeec87af33