941701 - [WebVTT] Crash in [@ mozilla::dom::TextTrackCue::GetCueAsHTML()]

Status: VERIFIED FIXED

(Core :: Audio/Video, defect)

Description

[Ali Al Dallal [:alicoding]]

https://crash-stats.mozilla.com/report/index/a2241395-f19c-464e-b8a0-592372131121

http://rickeyre.ca/2013/06/20/webvtt-cycle-collector-demo.html

I crash watching this demo on your blog


I'm using Firefox Nightly build 28.0a1 (2013-11-21) On Mavericks 10.9

Comment 1

[Andrew Quartey [:drexler]]

I can't _consistently_ reproduce this on linux, however a combination of pausing the video, reloading the page and attempting to play again after another pause does trigger this crash.

Comment 2

[Markus Popp]

Here is another crash report from what seems to be the same bug:

https://crash-stats.mozilla.com/report/index/01f8bd43-00b8-4ef4-b4e3-728132131205

The crash occurs fairly consistently after watching videos at http://tvthek.orf.at/ or http://mediathek.daserste.de/ - maybe sending the videos to fullscreen has something to do with it (I was granting these 2 sites fullscreen permissions when I stumbled upon these crashes).

Comment 3

[Rick Eyre (:reyre)]

Looking at the crash report it looks like getCueAsHTML is running while the HTMLMediaElement is being unbound from the tree. That's probably resulting in it trying to access something that no longer exists. We've had issues like this before while the cycle collector runs.

Comment 4

[Markus Popp]

(In reply to Rick Eyre (:reyre) from comment #3)
> Looking at the crash report it looks like getCueAsHTML is running while the
> HTMLMediaElement is being unbound from the tree. That's probably resulting
> in it trying to access something that no longer exists. We've had issues
> like this before while the cycle collector runs.

Indeed it looks like these crashes occur usually a while (can be up to a few minutes I guess) after subtitles were involved, and seemingly random (doesn't crash every time). This makes cycle collector very plausible, like if these 2 events happen to fall together, Firefox crashes.

Comment 5

[Rick Eyre (:reyre)]

I'm having a hard time reproducing this on the current tree. The code around this crash recently changed. Can you reproduce anymore Andrew?

Comment 6

[Andrew Quartey [:drexler]]

 Can you reproduce anymore Andrew?

I'll look into it and let you know.

Comment 7

[Ada [:adalucinet]]

I can easily reproduce this issue with Firefox 28 beta 3 (Build ID: 20140213172947) on Mac OS X 10.8.5 and Ubuntu 13.10 x64 with the same STR as in comment 1 and https://people.xiph.org/~giles/2013/vtt-01.html video.
On Windows 7 x64 I get a different crash signature: https://crash-stats.mozilla.com/report/index/d0ad6693-6cb5-4272-b2e8-374e12140214 
No crashes encountered with latest Aurora and Nightly builds.

Comment 8

[Ralph Giles (:rillian)]

Thanks for reproducing, Alexandra! I cannot reproduce with 28 beta 2 on MacOS X 10.8.5. Will try beta 3.

Is your crash signature on mac the same as comment 1? Can you get a backtrace from a debug build?

Comment 9

[Ralph Giles (:rillian)]

I can reproduce with 28 beta 3. I used https://ftp.mozilla.org/pub/mozilla.org/firefox/candidates/28.0b3-candidates/build1/mac/en-GB/Firefox%2028.0b3.dmg Build id 20140213172947 as in comment 7.

https://crash-stats.mozilla.com/report/index/ea5120c9-41b7-4969-a25d-445e42140214

Comment 10

[Rick Eyre (:reyre)]

Attachment: v1: Fix crash in TextTrackCue::GetCueAsHTML r=rillian

Seems to have fixed the crash for me.

TextTrackCue::GetCueAsHTML gets called when the HTMLMediaElement
shutsdown which means that TextTrackCues Document sometimes no longer
exists based on when the cycle collector freed it. I've added a null
check to make sure that it exists before we start doing anything.

Comment 11

[Rick Eyre (:reyre)]

I believe it's not reproducible on Nightly or Aurora because the TextTrack rendering algorithm no longer calls GetCueAsHTML. It goes though a different path. So just playing a video is no longer sufficient to cause this crash in Nightly or Aurora.

Comment 12

[Rick Eyre (:reyre)]

Comment on attachment 8376373 [details] [diff] [review]
v1: Fix crash in TextTrackCue::GetCueAsHTML r=rillian

[Approval Request Comment]
Bug caused by (feature/regressing bug #): WebVTT
User impact if declined: Crashes when watching WebVTT
Testing completed (on m-c, etc.): Manual
Risk to taking this patch (and alternatives if risky): No risk really. We've just added a null check for the TextTrackCue's document.

Comment 13

[Rick Eyre (:reyre)]

Comment on attachment 8376373 [details] [diff] [review]
v1: Fix crash in TextTrackCue::GetCueAsHTML r=rillian

[Approval Request Comment]
Bug caused by (feature/regressing bug #): WebVTT
User impact if declined: Crashes when watching WebVTT
Testing completed (on m-c, etc.): Manual
Risk to taking this patch (and alternatives if risky): No risk really. We've just added a null check for the TextTrackCue's document.

Comment 14

[Ralph Giles (:rillian)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a9285940b371

Comment 15

[Sylvestre Ledru [:Sylvestre]]

I will wait for the patch to land in m-c before uplifting it.

Comment 16

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/a9285940b371

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/cca60b2c6a48
https://hg.mozilla.org/releases/mozilla-beta/rev/3ceabcc6ff66

Comment 18

[Rick Eyre (:reyre)]

Thanks for landing those in Aurora and Beta, Ryan.

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g28_v1_3/rev/3ceabcc6ff66

Comment 20

[Ada [:adalucinet]]

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0
Mozilla/5.0 (X11; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:28.0) Gecko/20100101 Firefox/28.0

Verified as fixed with Firefox 28 beta 4 (Build ID: 20140218122424).

Comment 21

[Ada [:adalucinet]]

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:29.0) Gecko/20100101 Firefox/29.0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:30.0) Gecko/20100101 Firefox/30.0
Mozilla/5.0 (X11; Linux x86_64; rv:29.0) Gecko/20100101 Firefox/29.0
Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:30.0) Gecko/20100101 Firefox/30.0

Verified as fixed with latest Aurora (Build ID: 20140306004001) and Nightly (Build ID: 20140306030201).