866737 - crash in mozilla::dom::PannerNode::FindConnectedSources

Status: RESOLVED FIXED

(Core :: Web Audio, defect)

Description

[Scoobidiver (away)]

It first showed up in 23.0a1/20130416. The regression range might be:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=261d6997d1d1&tochange=1d9c510b3742

Signature 	mozilla::dom::PannerNode::FindConnectedSources(mozilla::dom::AudioNode*, nsTArray<mozilla::dom::AudioBufferSourceNode*>&, std::set<mozilla::dom::AudioNode*, std::less<mozilla::dom::AudioNode*>, std::allocator<mozilla::dom::AudioNode*> >&) More Reports Search
UUID	d6842db5-383d-4fc6-8132-231df2130429
Date Processed	2013-04-29 13:03:37
Uptime	23
Last Crash	35 seconds before submission
Install Age	7.2 hours since version was first installed.
Install Time	2013-04-29 05:51:30
Product	Firefox
Version	23.0a1
Build ID	20130428031010
Release Channel	nightly
OS	Windows NT
OS Version	5.1.2600 Service Pack 3
Build Architecture	x86
Build Architecture Info	GenuineIntel family 15 model 2 stepping 9
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0x0
App Notes 	
AdapterVendorID: 0x0000, AdapterDeviceID: 0x0000, AdapterSubsysID: 00000000, AdapterDriverVersion: 
D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers- 
Processor Notes 	sp-processor05.phx1.mozilla.com_19953:2012
EMCheckCompatibility	True
Adapter Vendor ID	0x0000
Adapter Device ID	0x0000
Total Virtual Memory	2147352576
Available Virtual Memory	1906249728
System Memory Use Percentage	47
Available Page File	912732160
Available Physical Memory	277131264
Accessibility	Active

Frame 	Module 	Signature 	Source
0 	xul.dll 	mozilla::dom::PannerNode::FindConnectedSources 	content/media/webaudio/PannerNode.cpp:493
1 	xul.dll 	mozilla::dom::PannerNode::FindConnectedSources 	content/media/webaudio/PannerNode.cpp:466
2 	xul.dll 	mozilla::dom::FindConnectedSourcesOn 	content/media/webaudio/AudioContext.cpp:270
3 	xul.dll 	nsTHashtable<nsPtrHashKey<mozilla::dom::PannerNode> >::s_EnumStub 	obj-firefox/dist/include/nsTHashtable.h:486
4 	xul.dll 	PL_DHashTableEnumerate 	obj-firefox/xpcom/build/pldhash.cpp:714
5 	xul.dll 	nsTHashtable<nsPtrHashKey<mozilla::dom::PannerNode> >::EnumerateEntries 	obj-firefox/dist/include/nsTHashtable.h:237
6 	xul.dll 	mozilla::dom::AudioContext::UpdatePannerSource 	content/media/webaudio/AudioContext.cpp:278
7 	xul.dll 	mozilla::dom::AudioNode::Disconnect 	content/media/webaudio/AudioNode.cpp:213
8 	xul.dll 	mozilla::dom::AudioNodeBinding::disconnect 	obj-firefox/dom/bindings/AudioNodeBinding.cpp:102
9 	mozjs.dll 	mozjs.dll@0xe3fa0 	
10 		@0x11ea01

More reports at:
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3APannerNode%3A%3AFindConnectedSources%28mozilla%3A%3Adom%3A%3AAudioNode*%2C+nsTArray%3Cmozilla%3A%3Adom%3A%3AAudioBufferSourceNode*%3E%26%2C+std%3A%3Aset%3Cmozilla%3A%3Adom%3A%3AAudioNode*%2C+std%3A%3Aless%3Cmozilla%3A%3Adom%3A%3AAudioNode*%3E%2C+std%3A%3Aallocator%3Cmozilla%3A%3Adom%3A%3AAudioNode*%3E+%3E%26%29
https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3Adom%3A%3APannerNode%3A%3AFindConnectedSources%28%29
https://crash-stats.mozilla.com/query/query?product=Firefox&version=Firefox%3A23.0a1&query_search=signature&query_type=contains&query=%3A%3AClear%28%29&do_query=1

Comment 1

[(no longer active)]

PannerNode needs to unregister itself when getting deleted by the CC.

Comment 2

[(no longer active)]

Hmm, this is use after free, basically.

Comment 3

[Andrew McCreight [:mccr8]]

Use-after-unlink isn't so bad.  The CC doesn't actually delete things. :)

Comment 4

[Andrew McCreight [:mccr8]]

Well, sounds like this isn't actually a use-after-unlink, but something having a weak reference.

Comment 5

[(no longer active)]

Yes, the issue here is that CC nulls out mContext, which means that code in ~PannerNode to unregister the node before it going away will not run, which means that when you do something that causes the mPannerNodes hashtable to be accessed again, you'll end up accessing the freed PannerNode object.

Comment 6

[(no longer active)]

Attachment: Patch (v1)

Comment 7

[(no longer active)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/20cb411cf7df

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/20cb411cf7df

Comment 9

[(no longer active)]

Mass moving Web Audio bugs to the Web Audio component.  Filter on duckityduck.