Closed Bug 854319 Opened 10 years ago Closed 10 years ago

crash in mozilla::MediaResource::`.* deleting destructor''

Categories

(Core :: Web Audio, defect)

Product:
Core
Component:
Web Audio
Version:
22 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla23
Tracking Flags:
Tracking Status
firefox21 --- unaffected
firefox22 + verified
firefox23 --- verified

People

(Reporter: scoobidiver, Assigned: ehsan.akhgari)

References

(
URL
)

Details

(Keywords: crash, regression, reproducible)

Crash Data

Attachments

(2 files)

Part 1: Call BeginDecoding before OnDecodeThreadStart
1.01 KB, patch
cpearce
: review+
akeybl
: approval-mozilla-beta+
Details | Diff | Splinter Review
Part 2: Fix the crash
1.60 KB, patch
cpearce
: review+
Details | Diff | Splinter Review 
It first showed up in 22.0a1/20130318. The regression range might be (discontinuous across builds):
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0b052daa913c&tochange=b03bb3ce8cee

Signature 	moz_abort | je_free | mozilla::MediaResource::`vector deleting destructor''(unsigned int) More Reports Search
UUID	60883227-943b-4947-ad7a-77de32130325
Date Processed	2013-03-25 05:34:52
Uptime	24
Last Crash	26 seconds before submission
Install Age	3.3 minutes since version was first installed.
Install Time	2013-03-25 05:31:29
Product	Firefox
Version	22.0a1
Build ID	20130324031024
Release Channel	nightly
OS	Windows NT
OS Version	6.1.7601 Service Pack 1
Build Architecture	x86
Build Architecture Info	GenuineIntel family 6 model 15 stepping 13
Crash Reason	EXCEPTION_BREAKPOINT
Crash Address	0x73e81bbf
App Notes 	
AdapterVendorID: 0x1002, AdapterDeviceID: 0x9589, AdapterSubsysID: 200217af, AdapterDriverVersion: 8.632.1.2000
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ 
Processor Notes 	sp-processor02.phx1.mozilla.com_32486:2008
EMCheckCompatibility	True
Adapter Vendor ID	0x1002
Adapter Device ID	0x9589
Total Virtual Memory	4294836224
Available Virtual Memory	3644788736
System Memory Use Percentage	57
Available Page File	2802237440
Available Physical Memory	905871360

Frame 	Module 	Signature 	Source
0 	mozglue.dll 	moz_abort 	memory/build/jemalloc_config.c:33
1 	mozglue.dll 	je_free 	memory/mozjemalloc/jemalloc.c:6589
2 	xul.dll 	mozilla::MediaResource::`vector deleting destructor' 	
3 	xul.dll 	mozilla::MediaResource::Release 	obj-firefox/dist/include/MediaStreamGraph.h:93
4 	xul.dll 	nsRefPtr<mozilla::MediaStreamListener>::assign_assuming_AddRef 	obj-firefox/dist/include/nsAutoPtr.h:868
5 	xul.dll 	mozilla::ReleaseWMFByteStreamResourcesEvent::Run 	content/media/wmf/WMFByteStream.cpp:78
6 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:627
7 	xul.dll 	NS_ProcessNextEvent_P 	obj-firefox/xpcom/build/nsThreadUtils.cpp:238
8 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:82
9 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:209
10 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:183
11 	xul.dll 	nsBaseAppShell::Run 	widget/xpwidgets/nsBaseAppShell.cpp:163
12 	xul.dll 	nsAppShell::Run 	widget/windows/nsAppShell.cpp:113
13 	xul.dll 	nsAppStartup::Run 	toolkit/components/startup/nsAppStartup.cpp:288
14 	xul.dll 	XREMain::XRE_mainRun 	toolkit/xre/nsAppRunner.cpp:3880
15 	xul.dll 	XREMain::XRE_main 	toolkit/xre/nsAppRunner.cpp:3947
16 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp:4161
17 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp:228
18 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp:105
19 	firefox.exe 	__tmainCRTStartup 	crtexe.c:552
20 	kernel32.dll 	BaseThreadInitThunk 	
21 	ntdll.dll 	__RtlUserThreadStart 	
22 	ntdll.dll 	_RtlUserThreadStart 	

More reports at:
https://crash-stats.mozilla.com/report/list?signature=moz_abort+|+je_free+|+mozilla%3A%3AMediaResource%3A%3A%60vector+deleting+destructor%27%27%28unsigned+int%29
https://crash-stats.mozilla.com/report/list?signature=moz_abort+|+je_free+|+mozilla%3A%3AMediaResource%3A%3A%60scalar+deleting+destructor%27%27%28unsigned+int%29
Windows media foundation code in the stacktrace but I couldn't see any relevant patches in the regression range.
I just hit this trying the "Deleting Borders" Chrome Experiment at http://deletingborders.com/: bp-32cacfa7-e285-4bfe-8c63-1f1ef2130410
While loading Deleting Borders, I hit this bug (more often) or bug 683664 or indefinitely hangs.
URL: http://www.deletingborders.com/
status-firefox23: --- → affected
Keywords: regressionwindow-wanted, reproducible
Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/4a54cc0f7c36
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130315 Firefox/22.0 ID:20130315211034
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/6922ed98876a
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130315 Firefox/22.0 ID:20130315223532
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b9fb91275c69&tochange=6922ed98876a
Triggered by
6922ed98876a	Ehsan Akhgari — Bug 851603 - Enable Web Audio in Nightly; r=roc
Blocks: 851603
Keywords: regressionwindow-wanted
Assignee: nobody → ehsan
Blocks: webaudio
Crash Signature: [@ moz_abort | je_free | mozilla::MediaResource::`vector deleting destructor''(unsigned int)] [@ moz_abort | je_free | mozilla::MediaResource::`scalar deleting destructor''(unsigned int)] → [@ moz_abort | je_free | mozilla::MediaResource::`vector deleting destructor''(unsigned int)] [@ moz_abort | je_free | mozilla::MediaResource::`scalar deleting destructor''(unsigned int)] [@ moz_abort | arena_run_reg_dalloc | arena_dalloc_small | arena_…
This prevents a fatal MOZ_ASSERT.
Attachment #737762 - Flags: review?(cpearce)
Attachment #737763 - Flags: review?(cpearce)
Attachment #737762 - Flags: review?(cpearce) → review+
Comment on attachment 737763 [details] [diff] [review]
Part 2: Fix the crash

Review of attachment 737763 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #737763 - Flags: review?(cpearce) → review+
https://hg.mozilla.org/mozilla-central/rev/7a0eb8b304eb
https://hg.mozilla.org/mozilla-central/rev/ee39d8eb931f
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
Blocks: 862709
Comment on attachment 737762 [details] [diff] [review]
Part 1: Call BeginDecoding before OnDecodeThreadStart

(Note that I'm applying for Aurora 22, which will be Beta 22 soon.)

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Web Audio.
User impact if declined: This is a crash fix for people who have enabled Web Audio.  Should not affect the usual release population.
Testing completed (on m-c, etc.): it has baked for a while.
Risk to taking this patch (and alternatives if risky): Should be fairly low risk.
String or IDL/UUID changes made by this patch: none.
Attachment #737762 - Flags: approval-mozilla-aurora?
Comment on attachment 737762 [details] [diff] [review]
Part 1: Call BeginDecoding before OnDecodeThreadStart

Given the risk evaluation that this should not impact normal release users, approving for Beta 22.
Attachment #737762 - Flags: approval-mozilla-aurora? → approval-mozilla-beta+
Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.
Component: Video/Audio → Web Audio
No crash reports found in Socorro, for neither one of the 4 signatures of this bug, regarding last month.

Marking this verified on Fx 22, based on the above statement.
status-firefox22: fixed → verified
QA Contact: manuela.muntean
Keywords: verifyme
Verified fixed on Fx 23. No crash reports found in Socorro, for neither one of the 4 signatures of this bug, regarding last month.

Also, http://www.deletingborders.com/ seems to be working ok with Fx 23 beta 1 (build ID: 20130625125232) on a Win 7 machine.
status-firefox23: fixed → verified
Status: RESOLVED → VERIFIED
Keywords: verifyme
You need to log in before you can comment on or make changes to this bug.