993003 - crash in mozilla::GetSourceReaderDuration(IMFSourceReader*, __int64&) as of 2014-04-03

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[u279076]

This bug was filed from the Socorro interface and is 
report bp-d81cedd5-5761-424d-bc0f-634fd2140407.
=============================================================
0 	xul.dll 	mozilla::GetSourceReaderDuration(IMFSourceReader *,__int64 &) 	content/media/wmf/WMFReader.cpp
1 	xul.dll 	mozilla::WMFReader::ReadMetadata(mozilla::MediaInfo *,nsDataHashtable<nsCStringHashKey,nsCString> * *) 	content/media/wmf/WMFReader.cpp
2 	xul.dll 	mozilla::MediaDecoderStateMachine::DecodeMetadata() 	content/media/MediaDecoderStateMachine.cpp
3 	xul.dll 	mozilla::MediaDecoderStateMachine::CallDecodeMetadata() 	content/media/MediaDecoderStateMachine.cpp
4 	xul.dll 	nsRunnableMethodImpl<void ( mozilla::dom::DOMStorageCache::*)(void),void,1>::Run() 	obj-firefox/dist/include/nsThreadUtils.h
5 	xul.dll 	mozilla::MediaTaskQueue::Runner::Run() 	content/media/MediaTaskQueue.cpp
6 	xul.dll 	nsThreadPool::Run() 	xpcom/threads/nsThreadPool.cpp
7 	xul.dll 	nsThread::ProcessNextEvent(bool,bool *) 	xpcom/threads/nsThread.cpp
8 	xul.dll 	NS_ProcessNextEvent(nsIThread *,bool) 	xpcom/glue/nsThreadUtils.cpp
9 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate *) 	ipc/glue/MessagePump.cpp
10 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
11 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
12 	xul.dll 	nsThread::ThreadFunc(void *) 	xpcom/threads/nsThread.cpp
13 	nss3.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c
14 	nss3.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c
15 	msvcr100.dll 	_callthreadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c
16 	msvcr100.dll 	_threadstartex 	f:\dd\vctools\crt_bld\self_x86\crt\src\threadex.c
17 	kernel32.dll 	BaseThreadInitThunk 	
18 	ntdll.dll 	__RtlUserThreadStart 	
19 	ntdll.dll 	_RtlUserThreadStart 	

More reports:
https://crash-stats.mozilla.com/report/list?product=Firefox&signature=mozilla%3A%3AGetSourceReaderDuration%28IMFSourceReader%2A%2C+__int64%26%29

Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=4941a2ac0786&tochange=ac6cbaa47f34
=============================================================

This is a new crash which first showed up on 2014-04-03 in Firefox 31.0a1. It's currently the #20 topcrash on Nightly so it's not yet in topcrash territory but we should probably keep an eye on it. 

Flagging this for QAWANTED to see if we can narrow down the regression window using tinderbox builds. There's only one comment so far and it mentions Instagram. 

Some prominent URLs include:
https://onedrive.live.com
http://departmentofunifiedprotection.com/intranet
http://www.torrentreactor.net/torrents/dummy
http://vimeo.com/67606405
http://niceoppai.3dfxwave.com/
http://windows.microsoft.com/en-US/windows-8/meet

The majority of the crashes appear to happen on Windows 7.
http://www.electrocycle.gr/site/

Comment 1

[u279076]

Paul, can you please try to reproduce this and find a regression window if possible?

Comment 2

[u279076]

Looking more at the pushlog, bug 987127 might be a culprit. Chris, what do you think?

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Patch: null-check WMFReader::mSourceReader after trying to create it.

Looking at the code in WMFReader::ReadMetadata(), I think we could end up with a null WMFReader::mSourceReader if DXVA has been blacklisted (so WMFReader::mUseHWAccel is false) and WMFReader::CreateSourceReader() fails for some other reason (say trying to load a file with a blacklisted codec).

So we can just null-check WMFReader::mSourceReader after the CreateSourceReader() calls in to prevent this.

Comment 4

[Paul Silaghi, QA [:pauly]]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #1)
> Paul, can you please try to reproduce this and find a regression window if
> possible?
I couldn't make Firefox crash using any of the links in comment 0.
31.0a1 (2014-04-07), Win 7 x64.

Comment 5

[u279076]

Dropping *wanted keywords since QA wasn't able to reproduce. We'll verify via crashstats a few days after this lands.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Landed for gecko 31:
https://hg.mozilla.org/integration/mozilla-inbound/rev/26d87e24848b

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/26d87e24848b

Comment 8

[u279076]

There are 0 crashes with this signature for Firefox 31 builds newer than 2014-04-09.