893880 - TextTrack crash [@mozilla::dom::TextTrackCueList::Update]

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: callstack

This happens fairly often with the fuzzer but until now I wasn't able to produce an external testcase for it.

Tested with http://hg.mozilla.org/integration/mozilla-inbound/rev/fa6ef0b63025

Comment 1

[Scoobidiver (away)]

There's a crash in the wild: bp-2d109cf5-7d41-4fe5-82e6-ef2f52130715. Maybe you can get the URL.

Comment 2

[Ralph Giles (:rillian)]

The crash url was http://ie.microsoft.com/testdrive/Graphics/VideoFormatSupport/Default.html which doesn't have track elements, just <video>. I haven't been able to reproduce the crash locally.

Since the crash is in the Cycle Collection of HTMLMediaElement even when no TextTracks are instantiated, the pref won't protect general users from this crash. This is therefore something we need to fix independently of enabling webvtt in bug 887978.

Comment 3

[Ralph Giles (:rillian)]

This reminds me of bug 882589 in that media events are firing when they shouldn't.

Comment 4

[Rick Eyre (:reyre)]

Could this have anything to do with the removal of libwebvtt? That's my first suspicion.

Comment 5

[Christoph Diehl [:posidron]]

Attachment: testcase

Let the testcase run for a few seconds.

Comment 6

[Christoph Diehl [:posidron]]

Attachment: media.zip

Comment 7

[Christoph Diehl [:posidron]]

This is still reproducible.

Tested with https://hg.mozilla.org/integration/mozilla-inbound/rev/e56e8fbacb7c

Comment 8

[Ralph Giles (:rillian)]

Thanks cdiehl. Now that the reimplementation has landed we can make progress on these again.

Comment 9

[Andrew Quartey [:drexler]]

Attachment: fix

I'm able to reproduce this. This happens because |mCueList| not having any cues gets cycle collected early and when the test tries to reload the page, it first pauses the player which in turn tries to update any cues it has.

Comment 10

[Ralph Giles (:rillian)]

Comment on attachment 823647 [details] [diff] [review]
fix

Review of attachment 823647 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks. Is shis is the only dereference which can be triggered during shutdown?

Comment 11

[Andrew Quartey [:drexler]]

> Thanks. Is shis is the only dereference which can be triggered during
> shutdown?

Yes. I even modified the test case to see if there was the possibility of |mTextTrackManager| being collected before it's defereferenced.

Comment 12

[Andrew Quartey [:drexler]]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/0d29189eef9b

Comment 13

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0d29189eef9b

Comment 14

[Bogdan Maris, Desktop Test Engineering]

Was not able to reproduce the initial crash, 
Based on Socorro there were no crashes registered in the last 3 weeks on Firefox 28 with both signature.

http://goo.gl/8xRgGN
http://goo.gl/MEiKJG