1115190 - crash in mp4_demuxer::Moof::~Moof()

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect, P1)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-e955bfd7-8309-48b3-9724-481d92141223.
=============================================================

Seen while reviewing crash stats. More reports are here: https://crash-stats.mozilla.com/report/list?productFirefox&signature=mp4_demuxer::Moof::~Moof%28%29

Crashes started showing up using 2014121700. Seems to affect Windows 6.x users - could something have regressed here? Almost all URLs are youtube.com.

Frame 	Module 	Signature 	Source
0 	xul.dll 	mp4_demuxer::Moof::~Moof() 	
1 	xul.dll 	nsTArray_Impl<mp4_demuxer::Moof, nsTArrayInfallibleAllocator>::RemoveElementsAt(unsigned int, unsigned int) 	xpcom/glue/nsTArray.h
2 	xul.dll 	mp4_demuxer::MoofParser::~MoofParser() 	
3 	xul.dll 	mp4_demuxer::MoofParser::`scalar deleting destructor'(unsigned int) 	
4 	xul.dll 	mp4_demuxer::Index::`scalar deleting destructor'(unsigned int) 	
5 	xul.dll 	mp4_demuxer::Index::Release() 	media/libstagefright/binding/include/mp4_demuxer/Index.h
6 	xul.dll 	mp4_demuxer::SampleIterator::`scalar deleting destructor'(unsigned int) 	
7 	xul.dll 	mp4_demuxer::StageFrightPrivate::~StageFrightPrivate() 	
8 	xul.dll 	mp4_demuxer::MP4Demuxer::~MP4Demuxer() 	media/libstagefright/binding/mp4_demuxer.cpp
9 	xul.dll 	mp4_demuxer::MP4Demuxer::`scalar deleting destructor'(unsigned int) 	
10 	xul.dll 	mozilla::MP4Reader::~MP4Reader() 	dom/media/fmp4/MP4Reader.cpp
11 	xul.dll 	mozilla::MP4Reader::`scalar deleting destructor'(unsigned int) 	
12 	xul.dll 	mozilla::MediaDecoderReader::Release() 	dom/media/MediaDecoderReader.h
13 	xul.dll 	mozilla::SourceBufferDecoder::BreakCycles() 	dom/media/mediasource/SourceBufferDecoder.h
14 	xul.dll 	mozilla::MediaSourceReader::BreakCycles() 	dom/media/mediasource/MediaSourceReader.cpp
15 	xul.dll 	mozilla::nsDecoderDisposeEvent::Run() 	dom/media/MediaDecoderStateMachine.cpp
16 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp
17 	xul.dll 	mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) 	ipc/glue/MessagePump.cpp
18 	xul.dll 	MessageLoop::RunHandler() 	ipc/chromium/src/base/message_loop.cc
19 	xul.dll 	MessageLoop::Run() 	ipc/chromium/src/base/message_loop.cc
20 	xul.dll 	nsBaseAppShell::Run() 	widget/nsBaseAppShell.cpp
21 	xul.dll 	nsAppShell::Run() 	widget/windows/nsAppShell.cpp
22 	xul.dll 	nsAppStartup::Run() 	toolkit/components/startup/nsAppStartup.cpp
23 	xul.dll 	XREMain::XRE_mainRun() 	toolkit/xre/nsAppRunner.cpp
24 	xul.dll 	XREMain::XRE_main(int, char** const, nsXREAppData const*) 	toolkit/xre/nsAppRunner.cpp
25 	xul.dll 	XRE_main 	toolkit/xre/nsAppRunner.cpp
26 	firefox.exe 	do_main 	browser/app/nsBrowserApp.cpp
27 	firefox.exe 	NS_internal_main(int, char**) 	browser/app/nsBrowserApp.cpp
28 	firefox.exe 	wmain 	toolkit/xre/nsWindowsWMain.cpp
29 	firefox.exe 	__tmainCRTStartup 	f:/dd/vctools/crt/crtw32/startup/crt0.c:255
30 	kernel32.dll 	BaseThreadInitThunk 	
31 	ntdll.dll 	__RtlUserThreadStart 	
32 	ntdll.dll 	_RtlUserThreadStart

Comment 1

[Marcia Knous [:marcia]]

While reviewing crash stats I also see two other signatures which include the mp4_demuxer:

[@ mp4_demuxer::Index::GetEndCompositionIfBuffered(nsTArray<mozilla::MediaByteRange> const&) ]

[@ mp4_demuxer::SampleIterator::Get() ]

The signatures also seem to be Windows NT and youtube.com URLs.

Comment 2

[Robert Kaiser]

(In reply to Marcia Knous [:marcia - use needinfo] from comment #1)
> While reviewing crash stats I also see two other signatures which include
> the mp4_demuxer

As mentioned in bug 1102612 comment #13, I saw multiple mp4/MSE-related signatures in the bold (significantly rising) first few entries of https://crash-analysis.mozilla.com/rkaiser/2014-12-21/2014-12-21.firefox.36.explosiveness.html - it's probably a good idea to make sure bugs are filed on all of that bunch.

Comment 3

[Marcia Knous [:marcia]]

ni on Bobby and Anthony to see if they have some insight into whether all of the crash stacks in Comment 1 are related. Anthony it looks like you touched some code in this stack as well - http://hg.mozilla.org/mozilla-central/annotate/b915a50bc6be/media/libstagefright/binding/include/mp4_demuxer/Index.h#l37

Comment 4

[Bobby Holley (:bholley)]

I'd like to get bug 1115749 landed and see if these persist.

Comment 5

[Marcia Knous [:marcia]]

2014122600 was the last time I see in a crash in this stack, so I think maybe we can close this one out for now.