Closed Bug 1408987 Opened 7 years ago Closed 7 years ago

Intermittent SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/dom/media/mediasource/TrackBuffersManager.h:199:25 in HasVideo

Categories

(Core :: Audio/Video: Playback, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla58
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- unaffected
firefox57 --- unaffected
firefox58 --- fixed

People

(Reporter: aryx, Assigned: alwu)

References

(Blocks 2 open bugs)

Details

(5 keywords)

Attachments

(2 files, 4 obsolete files)

https://treeherder.mozilla.org/logviewer.html#?job_id=137200894&repo=mozilla-inbound [task 2017-10-16T10:16:45.333Z] 10:16:45 INFO - TEST-START | dom/media/test/test_eme_stream_capture_blocked_case1.html [task 2017-10-16T10:16:45.707Z] 10:16:45 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:45.864Z] 10:16:45 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:45.962Z] 10:16:45 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.086Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.094Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.224Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.252Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.335Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.452Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:46.468Z] 10:16:46 INFO - file=[xpconnect wrapped nsIFile] [task 2017-10-16T10:16:47.124Z] 10:16:47 INFO - GECKO(1664) | ================================================================= [task 2017-10-16T10:16:47.125Z] 10:16:47 ERROR - GECKO(1664) | ==1710==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e000262948 at pc 0x7f3e61cbeb5b bp 0x7f3e28de54d0 sp 0x7f3e28de54c8 [task 2017-10-16T10:16:47.126Z] 10:16:47 INFO - GECKO(1664) | READ of size 4 at 0x61e000262948 thread T693 (MediaPD~oder #2) [task 2017-10-16T10:16:47.931Z] 10:16:47 INFO - GECKO(1664) | #0 0x7f3e61cbeb5a in HasVideo /builds/worker/workspace/build/src/dom/media/mediasource/TrackBuffersManager.h:199:25 [task 2017-10-16T10:16:47.932Z] 10:16:47 INFO - GECKO(1664) | #1 0x7f3e61cbeb5a in mozilla::TrackBuffersManager::Buffered() const /builds/worker/workspace/build/src/dom/media/mediasource/TrackBuffersManager.cpp:373 [task 2017-10-16T10:16:47.932Z] 10:16:47 INFO - GECKO(1664) | #2 0x7f3e61cbdb21 in mozilla::MediaSourceTrackDemuxer::GetBuffered() /builds/worker/workspace/build/src/dom/media/mediasource/MediaSourceDemuxer.cpp:391:20 [task 2017-10-16T10:16:47.947Z] 10:16:47 INFO - GECKO(1664) | #3 0x7f3e619d2648 in mozilla::MediaFormatReader::DemuxerProxy::Wrapper::UpdateBuffered() /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1094:32 [task 2017-10-16T10:16:47.948Z] 10:16:47 INFO - GECKO(1664) | #4 0x7f3e619e4398 in operator() /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1172:28 [task 2017-10-16T10:16:47.949Z] 10:16:47 INFO - GECKO(1664) | #5 0x7f3e619e4398 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaFormatReader::DemuxerProxy::NotifyDataArrived()::$_13, mozilla::MozPromise<bool, mozilla::MediaResult, true> >::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:1511 [task 2017-10-16T10:16:47.949Z] 10:16:47 INFO - GECKO(1664) | #6 0x7f3e5c64c217 in mozilla::TaskQueue::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:246:12 [task 2017-10-16T10:16:47.950Z] 10:16:47 INFO - GECKO(1664) | #7 0x7f3e5c66b63f in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:228:14 [task 2017-10-16T10:16:47.951Z] 10:16:47 INFO - GECKO(1664) | #8 0x7f3e5c66bb3c in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:156:15 [task 2017-10-16T10:16:47.954Z] 10:16:47 INFO - GECKO(1664) | #9 0x7f3e5c6639d6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 [task 2017-10-16T10:16:47.956Z] 10:16:47 INFO - GECKO(1664) | #10 0x7f3e5c67dea8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 [task 2017-10-16T10:16:47.960Z] 10:16:47 INFO - GECKO(1664) | #11 0x7f3e5d457bed in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:338:20 [task 2017-10-16T10:16:47.960Z] 10:16:47 INFO - GECKO(1664) | #12 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:47.961Z] 10:16:47 INFO - GECKO(1664) | #13 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:47.962Z] 10:16:47 INFO - GECKO(1664) | #14 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:47.964Z] 10:16:47 INFO - GECKO(1664) | #15 0x7f3e5c65edf3 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:425:11 [task 2017-10-16T10:16:47.967Z] 10:16:47 INFO - GECKO(1664) | #16 0x7f3e777d74d3 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5 [task 2017-10-16T10:16:47.968Z] 10:16:47 INFO - GECKO(1664) | #17 0x7f3e7babc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) [task 2017-10-16T10:16:48.031Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e7ab453dc in clone /build/glibc-bfm8X4/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109 [task 2017-10-16T10:16:48.032Z] 10:16:48 INFO - GECKO(1664) | 0x61e000262948 is located 200 bytes inside of 2728-byte region [0x61e000262880,0x61e000263328) [task 2017-10-16T10:16:48.032Z] 10:16:48 INFO - GECKO(1664) | freed by thread T691 (MediaPl~back #5) here: [task 2017-10-16T10:16:48.032Z] 10:16:48 INFO - GECKO(1664) | #0 0x4bc0fb in __interceptor_free /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:47:3 [task 2017-10-16T10:16:48.033Z] 10:16:48 INFO - GECKO(1664) | #1 0x7f3e61d13aa1 in operator delete /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:230:12 [task 2017-10-16T10:16:48.034Z] 10:16:48 INFO - GECKO(1664) | #2 0x7f3e61d13aa1 in Release /builds/worker/workspace/build/src/dom/media/mediasource/TrackBuffersManager.h:77 [task 2017-10-16T10:16:48.036Z] 10:16:48 INFO - GECKO(1664) | #3 0x7f3e61d13aa1 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:41 [task 2017-10-16T10:16:48.037Z] 10:16:48 INFO - GECKO(1664) | #4 0x7f3e61d13aa1 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:398 [task 2017-10-16T10:16:48.039Z] 10:16:48 INFO - GECKO(1664) | #5 0x7f3e61d13aa1 in assign_assuming_AddRef /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:66 [task 2017-10-16T10:16:48.040Z] 10:16:48 INFO - GECKO(1664) | #6 0x7f3e61d13aa1 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:168 [task 2017-10-16T10:16:48.041Z] 10:16:48 INFO - GECKO(1664) | #7 0x7f3e61d13aa1 in Revoke /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:740 [task 2017-10-16T10:16:48.043Z] 10:16:48 INFO - GECKO(1664) | #8 0x7f3e61d13aa1 in Revoke /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1208 [task 2017-10-16T10:16:48.045Z] 10:16:48 INFO - GECKO(1664) | #9 0x7f3e61d13aa1 in mozilla::detail::RunnableMethodImpl<mozilla::TrackBuffersManager*, void (mozilla::TrackBuffersManager::*)(mozilla::SourceBufferTask*), true, (mozilla::RunnableKind)0, RefPtr<mozilla::SourceBufferTask> >::~RunnableMethodImpl() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1167 [task 2017-10-16T10:16:48.047Z] 10:16:48 INFO - GECKO(1664) | #10 0x7f3e61d13c3d in mozilla::detail::RunnableMethodImpl<mozilla::TrackBuffersManager*, void (mozilla::TrackBuffersManager::*)(mozilla::SourceBufferTask*), true, (mozilla::RunnableKind)0, RefPtr<mozilla::SourceBufferTask> >::~RunnableMethodImpl() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1167:33 [task 2017-10-16T10:16:48.050Z] 10:16:48 INFO - GECKO(1664) | #11 0x7f3e5c67a56b in mozilla::Runnable::Release() /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:47:1 [task 2017-10-16T10:16:48.052Z] 10:16:48 INFO - GECKO(1664) | #12 0x7f3e5c64c312 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:41:11 [task 2017-10-16T10:16:48.053Z] 10:16:48 INFO - GECKO(1664) | #13 0x7f3e5c64c312 in Release /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:398 [task 2017-10-16T10:16:48.054Z] 10:16:48 INFO - GECKO(1664) | #14 0x7f3e5c64c312 in assign_assuming_AddRef /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:66 [task 2017-10-16T10:16:48.056Z] 10:16:48 INFO - GECKO(1664) | #15 0x7f3e5c64c312 in operator= /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/RefPtr.h:168 [task 2017-10-16T10:16:48.057Z] 10:16:48 INFO - GECKO(1664) | #16 0x7f3e5c64c312 in mozilla::TaskQueue::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:254 [task 2017-10-16T10:16:48.058Z] 10:16:48 INFO - GECKO(1664) | #17 0x7f3e5c66b63f in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:228:14 [task 2017-10-16T10:16:48.059Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e5c66bb3c in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:156:15 [task 2017-10-16T10:16:48.060Z] 10:16:48 INFO - GECKO(1664) | #19 0x7f3e5c6639d6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 [task 2017-10-16T10:16:48.061Z] 10:16:48 INFO - GECKO(1664) | #20 0x7f3e5c67dea8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 [task 2017-10-16T10:16:48.061Z] 10:16:48 INFO - GECKO(1664) | #21 0x7f3e5d457bed in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:338:20 [task 2017-10-16T10:16:48.062Z] 10:16:48 INFO - GECKO(1664) | #22 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.063Z] 10:16:48 INFO - GECKO(1664) | #23 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.064Z] 10:16:48 INFO - GECKO(1664) | #24 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.065Z] 10:16:48 INFO - GECKO(1664) | #25 0x7f3e5c65edf3 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:425:11 [task 2017-10-16T10:16:48.066Z] 10:16:48 INFO - GECKO(1664) | #26 0x7f3e777d74d3 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5 [task 2017-10-16T10:16:48.067Z] 10:16:48 INFO - GECKO(1664) | #27 0x7f3e7babc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) [task 2017-10-16T10:16:48.068Z] 10:16:48 INFO - GECKO(1664) | previously allocated by thread T0 (Web Content) here: [task 2017-10-16T10:16:48.068Z] 10:16:48 INFO - GECKO(1664) | #0 0x4bc44c in malloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3 [task 2017-10-16T10:16:48.070Z] 10:16:48 INFO - GECKO(1664) | #1 0x4ed85d in moz_xmalloc /builds/worker/workspace/build/src/memory/mozalloc/mozalloc.cpp:84:17 [task 2017-10-16T10:16:48.071Z] 10:16:48 INFO - GECKO(1664) | #2 0x7f3e61ccb41e in operator new /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/mozalloc.h:206:12 [task 2017-10-16T10:16:48.071Z] 10:16:48 INFO - GECKO(1664) | #3 0x7f3e61ccb41e in mozilla::dom::SourceBuffer::SourceBuffer(mozilla::dom::MediaSource*, mozilla::MediaContainerType const&) /builds/worker/workspace/build/src/dom/media/mediasource/SourceBuffer.cpp:315 [task 2017-10-16T10:16:48.072Z] 10:16:48 INFO - GECKO(1664) | #4 0x7f3e61ca4579 in mozilla::dom::MediaSource::AddSourceBuffer(nsTSubstring<char16_t> const&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/dom/media/mediasource/MediaSource.cpp:257:43 [task 2017-10-16T10:16:48.073Z] 10:16:48 INFO - GECKO(1664) | #5 0x7f3e5fa87aef in mozilla::dom::MediaSourceBinding::addSourceBuffer(JSContext*, JS::Handle<JSObject*>, mozilla::dom::MediaSource*, JSJitMethodCallArgs const&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/MediaSourceBinding.cpp:447:64 [task 2017-10-16T10:16:48.074Z] 10:16:48 INFO - GECKO(1664) | #6 0x7f3e60f86c00 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/dom/bindings/BindingUtils.cpp:3039:13 [task 2017-10-16T10:16:48.091Z] 10:16:48 INFO - GECKO(1664) | #7 0x7f3e673f9824 in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15 [task 2017-10-16T10:16:48.093Z] 10:16:48 INFO - GECKO(1664) | #8 0x7f3e673f9824 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:473 [task 2017-10-16T10:16:48.095Z] 10:16:48 INFO - GECKO(1664) | #9 0x7f3e673e3e8c in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:528:12 [task 2017-10-16T10:16:48.097Z] 10:16:48 INFO - GECKO(1664) | #10 0x7f3e673e3e8c in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3067 [task 2017-10-16T10:16:48.100Z] 10:16:48 INFO - GECKO(1664) | #11 0x7f3e673caa8a in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12 [task 2017-10-16T10:16:48.102Z] 10:16:48 INFO - GECKO(1664) | #12 0x7f3e673f9923 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495:15 [task 2017-10-16T10:16:48.103Z] 10:16:48 INFO - GECKO(1664) | #13 0x7f3e673fa812 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:541:10 [task 2017-10-16T10:16:48.105Z] 10:16:48 INFO - GECKO(1664) | #14 0x7f3e674e0cc2 in js::PromiseObject::create(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, bool) /builds/worker/workspace/build/src/js/src/builtin/Promise.cpp:1666:19 [task 2017-10-16T10:16:48.106Z] 10:16:48 INFO - GECKO(1664) | #15 0x7f3e675b6234 in PromiseConstructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/src/builtin/Promise.cpp:1594:30 [task 2017-10-16T10:16:48.107Z] 10:16:48 INFO - GECKO(1664) | #16 0x7f3e673faebe in CallJSNative /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:291:15 [task 2017-10-16T10:16:48.108Z] 10:16:48 INFO - GECKO(1664) | #17 0x7f3e673faebe in CallJSNativeConstructor /builds/worker/workspace/build/src/js/src/jscntxtinlines.h:324 [task 2017-10-16T10:16:48.110Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e673faebe in InternalConstruct(JSContext*, js::AnyConstructArgs const&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:568 [task 2017-10-16T10:16:48.111Z] 10:16:48 INFO - GECKO(1664) | #19 0x7f3e673e3ece in ConstructFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:606:12 [task 2017-10-16T10:16:48.112Z] 10:16:48 INFO - GECKO(1664) | #20 0x7f3e673e3ece in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3059 [task 2017-10-16T10:16:48.113Z] 10:16:48 INFO - GECKO(1664) | #21 0x7f3e673caa8a in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12 [task 2017-10-16T10:16:48.114Z] 10:16:48 INFO - GECKO(1664) | #22 0x7f3e673f9923 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495:15 [task 2017-10-16T10:16:48.120Z] 10:16:48 INFO - GECKO(1664) | #23 0x7f3e67630cef in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jit/BaselineIC.cpp:2534:14 [task 2017-10-16T10:16:48.120Z] 10:16:48 INFO - GECKO(1664) | #24 0x1cfb296cc356 (<unknown module>) [task 2017-10-16T10:16:48.121Z] 10:16:48 INFO - GECKO(1664) | #25 0x621003309acf (<unknown module>) [task 2017-10-16T10:16:48.122Z] 10:16:48 INFO - GECKO(1664) | #26 0x1cfb296c0849 (<unknown module>) [task 2017-10-16T10:16:48.131Z] 10:16:48 INFO - GECKO(1664) | #27 0x7f3e67946a4c in EnterJit /builds/worker/workspace/build/src/js/src/jit/Jit.cpp:104:9 [task 2017-10-16T10:16:48.132Z] 10:16:48 INFO - GECKO(1664) | #28 0x7f3e67946a4c in js::jit::MaybeEnterJit(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/jit/Jit.cpp:170 [task 2017-10-16T10:16:48.134Z] 10:16:48 INFO - GECKO(1664) | #29 0x7f3e673ca8bd in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:408:34 [task 2017-10-16T10:16:48.134Z] 10:16:48 INFO - GECKO(1664) | #30 0x7f3e673f9923 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495:15 [task 2017-10-16T10:16:48.135Z] 10:16:48 INFO - GECKO(1664) | #31 0x7f3e673e3e8c in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:528:12 [task 2017-10-16T10:16:48.136Z] 10:16:48 INFO - GECKO(1664) | #32 0x7f3e673e3e8c in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3067 [task 2017-10-16T10:16:48.137Z] 10:16:48 INFO - GECKO(1664) | #33 0x7f3e673caa8a in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:423:12 [task 2017-10-16T10:16:48.138Z] 10:16:48 INFO - GECKO(1664) | #34 0x7f3e673f9923 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:495:15 [task 2017-10-16T10:16:48.139Z] 10:16:48 INFO - GECKO(1664) | #35 0x7f3e673fa812 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:541:10 [task 2017-10-16T10:16:48.147Z] 10:16:48 INFO - GECKO(1664) | #36 0x7f3e67e3980b in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:3021:12 [task 2017-10-16T10:16:48.156Z] 10:16:48 INFO - GECKO(1664) | #37 0x7f3e609a5ed7 in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/build/src/obj-firefox/dom/bindings/EventListenerBinding.cpp:47:8 [task 2017-10-16T10:16:48.157Z] 10:16:48 INFO - GECKO(1664) | Thread T693 (MediaPD~oder #2) created by T686 (MediaPl~back #1) here: [task 2017-10-16T10:16:48.166Z] 10:16:48 INFO - GECKO(1664) | #0 0x4a4826 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3 [task 2017-10-16T10:16:48.167Z] 10:16:48 INFO - GECKO(1664) | #1 0x7f3e777d4279 in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14 [task 2017-10-16T10:16:48.167Z] 10:16:48 INFO - GECKO(1664) | #2 0x7f3e777d3e8e in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12 [task 2017-10-16T10:16:48.168Z] 10:16:48 INFO - GECKO(1664) | #3 0x7f3e5c660732 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:598:8 [task 2017-10-16T10:16:48.169Z] 10:16:48 INFO - GECKO(1664) | #4 0x7f3e5c6686af in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:357:22 [task 2017-10-16T10:16:48.170Z] 10:16:48 INFO - GECKO(1664) | #5 0x7f3e5c67bb73 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:148:45 [task 2017-10-16T10:16:48.171Z] 10:16:48 INFO - GECKO(1664) | #6 0x7f3e5c66a7e9 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:109:17 [task 2017-10-16T10:16:48.172Z] 10:16:48 INFO - GECKO(1664) | #7 0x7f3e5c66be0f in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:277:5 [task 2017-10-16T10:16:48.172Z] 10:16:48 INFO - GECKO(1664) | #8 0x7f3e5c66d571 in mozilla::SharedThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SharedThreadPool.h:71:68 [task 2017-10-16T10:16:48.173Z] 10:16:48 INFO - GECKO(1664) | #9 0x7f3e5c64ad3e in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:128:26 [task 2017-10-16T10:16:48.174Z] 10:16:48 INFO - GECKO(1664) | #10 0x7f3e5c66e4e2 in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskQueue.h:71:21 [task 2017-10-16T10:16:48.175Z] 10:16:48 INFO - GECKO(1664) | #11 0x7f3e619b85de in mozilla::AutoTaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/obj-firefox/dist/include/AutoTaskQueue.h:43:17 [task 2017-10-16T10:16:48.178Z] 10:16:48 INFO - GECKO(1664) | #12 0x7f3e5c62514e in mozilla::AbstractThread::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:226:3 [task 2017-10-16T10:16:48.182Z] 10:16:48 INFO - GECKO(1664) | #13 0x7f3e619d5243 in InvokeAsync<(lambda at /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1030:14)> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:1557:12 [task 2017-10-16T10:16:48.184Z] 10:16:48 INFO - GECKO(1664) | #14 0x7f3e619d5243 in InvokeAsync<(lambda at /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1030:14)> /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:1574 [task 2017-10-16T10:16:48.185Z] 10:16:48 INFO - GECKO(1664) | #15 0x7f3e619d5243 in mozilla::MediaFormatReader::DemuxerProxy::Wrapper::SkipToNextRandomAccessPoint(mozilla::media::TimeUnit const&) /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1028 [task 2017-10-16T10:16:48.186Z] 10:16:48 INFO - GECKO(1664) | #16 0x7f3e6197bc59 in mozilla::MediaFormatReader::SkipVideoDemuxToNextKeyFrame(mozilla::media::TimeUnit) /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:2664:25 [task 2017-10-16T10:16:48.191Z] 10:16:48 INFO - GECKO(1664) | #17 0x7f3e6197b285 in mozilla::MediaFormatReader::RequestVideoData(mozilla::media::TimeUnit const&) /builds/worker/workspace/build/src/dom/media/MediaFormatReader.cpp:1624:5 [task 2017-10-16T10:16:48.205Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e61aaedca in applyImpl<mozilla::MediaFormatReader, RefPtr<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true> > (mozilla::MediaFormatReader::*)(const mozilla::media::TimeUnit &), StoreCopyPassByRRef<mozilla::media::TimeUnit> , 0> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1142:12 [task 2017-10-16T10:16:48.208Z] 10:16:48 INFO - GECKO(1664) | #19 0x7f3e61aaedca in apply<mozilla::MediaFormatReader, RefPtr<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true> > (mozilla::MediaFormatReader::*)(const mozilla::media::TimeUnit &)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1148 [task 2017-10-16T10:16:48.210Z] 10:16:48 INFO - GECKO(1664) | #20 0x7f3e61aaedca in Invoke /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:1370 [task 2017-10-16T10:16:48.212Z] 10:16:48 INFO - GECKO(1664) | #21 0x7f3e61aaedca in mozilla::detail::ProxyRunnable<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true>, RefPtr<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true> > (mozilla::MediaFormatReader::*)(mozilla::media::TimeUnit const&), mozilla::MediaFormatReader, StoreCopyPassByRRef<mozilla::media::TimeUnit> >::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/MozPromise.h:1395 [task 2017-10-16T10:16:48.213Z] 10:16:48 INFO - GECKO(1664) | #22 0x7f3e5c644008 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:209:37 [task 2017-10-16T10:16:48.214Z] 10:16:48 INFO - GECKO(1664) | #23 0x7f3e5c64c217 in mozilla::TaskQueue::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:246:12 [task 2017-10-16T10:16:48.216Z] 10:16:48 INFO - GECKO(1664) | #24 0x7f3e5c66b63f in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:228:14 [task 2017-10-16T10:16:48.217Z] 10:16:48 INFO - GECKO(1664) | #25 0x7f3e5c66bb3c in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:156:15 [task 2017-10-16T10:16:48.218Z] 10:16:48 INFO - GECKO(1664) | #26 0x7f3e5c6639d6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 [task 2017-10-16T10:16:48.220Z] 10:16:48 INFO - GECKO(1664) | #27 0x7f3e5c67dea8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 [task 2017-10-16T10:16:48.221Z] 10:16:48 INFO - GECKO(1664) | #28 0x7f3e5d457bed in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:338:20 [task 2017-10-16T10:16:48.222Z] 10:16:48 INFO - GECKO(1664) | #29 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.223Z] 10:16:48 INFO - GECKO(1664) | #30 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.224Z] 10:16:48 INFO - GECKO(1664) | #31 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.225Z] 10:16:48 INFO - GECKO(1664) | #32 0x7f3e5c65edf3 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:425:11 [task 2017-10-16T10:16:48.226Z] 10:16:48 INFO - GECKO(1664) | #33 0x7f3e777d74d3 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5 [task 2017-10-16T10:16:48.228Z] 10:16:48 INFO - GECKO(1664) | #34 0x7f3e7babc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) [task 2017-10-16T10:16:48.228Z] 10:16:48 INFO - GECKO(1664) | Thread T686 (MediaPl~back #1) created by T0 (Web Content) here: [task 2017-10-16T10:16:48.229Z] 10:16:48 INFO - GECKO(1664) | #0 0x4a4826 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3 [task 2017-10-16T10:16:48.230Z] 10:16:48 INFO - GECKO(1664) | #1 0x7f3e777d4279 in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14 [task 2017-10-16T10:16:48.231Z] 10:16:48 INFO - GECKO(1664) | #2 0x7f3e777d3e8e in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12 [task 2017-10-16T10:16:48.231Z] 10:16:48 INFO - GECKO(1664) | #3 0x7f3e5c660732 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:598:8 [task 2017-10-16T10:16:48.233Z] 10:16:48 INFO - GECKO(1664) | #4 0x7f3e5c6686af in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:357:22 [task 2017-10-16T10:16:48.233Z] 10:16:48 INFO - GECKO(1664) | #5 0x7f3e5c67bb73 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:148:45 [task 2017-10-16T10:16:48.233Z] 10:16:48 INFO - GECKO(1664) | #6 0x7f3e5c66a7e9 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:109:17 [task 2017-10-16T10:16:48.234Z] 10:16:48 INFO - GECKO(1664) | #7 0x7f3e5c66be0f in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:277:5 [task 2017-10-16T10:16:48.234Z] 10:16:48 INFO - GECKO(1664) | #8 0x7f3e5c66d571 in mozilla::SharedThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SharedThreadPool.h:71:68 [task 2017-10-16T10:16:48.235Z] 10:16:48 INFO - GECKO(1664) | #9 0x7f3e5c64ad3e in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:128:26 [task 2017-10-16T10:16:48.236Z] 10:16:48 INFO - GECKO(1664) | #10 0x7f3e5c66e4e2 in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskQueue.h:71:21 [task 2017-10-16T10:16:48.237Z] 10:16:48 INFO - GECKO(1664) | #11 0x7f3e5c643bec in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:261:13 [task 2017-10-16T10:16:48.237Z] 10:16:48 INFO - GECKO(1664) | #12 0x7f3e5c642385 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:91:7 [task 2017-10-16T10:16:48.238Z] 10:16:48 INFO - GECKO(1664) | #13 0x7f3e5c642125 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:446:17 [task 2017-10-16T10:16:48.239Z] 10:16:48 INFO - GECKO(1664) | #14 0x7f3e5c642125 in mozilla::EventTargetWrapper::FireTailDispatcher() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:79 [task 2017-10-16T10:16:48.239Z] 10:16:48 INFO - GECKO(1664) | #15 0x7f3e5c645252 in applyImpl<mozilla::EventTargetWrapper, void (mozilla::EventTargetWrapper::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1142:12 [task 2017-10-16T10:16:48.240Z] 10:16:48 INFO - GECKO(1664) | #16 0x7f3e5c645252 in apply<mozilla::EventTargetWrapper, void (mozilla::EventTargetWrapper::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1148 [task 2017-10-16T10:16:48.241Z] 10:16:48 INFO - GECKO(1664) | #17 0x7f3e5c645252 in mozilla::detail::RunnableMethodImpl<mozilla::EventTargetWrapper*, void (mozilla::EventTargetWrapper::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1192 [task 2017-10-16T10:16:48.241Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e5c4ceff4 in mozilla::CycleCollectedJSContext::ProcessStableStateQueue() /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:312:12 [task 2017-10-16T10:16:48.251Z] 10:16:48 INFO - GECKO(1664) | #19 0x7f3e5ddfc00d in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp:1207:30 [task 2017-10-16T10:16:48.260Z] 10:16:48 INFO - GECKO(1664) | #20 0x7f3e5c66401f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1053:24 [task 2017-10-16T10:16:48.262Z] 10:16:48 INFO - GECKO(1664) | #21 0x7f3e5c67dea8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 [task 2017-10-16T10:16:48.263Z] 10:16:48 INFO - GECKO(1664) | #22 0x7f3e5d4569c1 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 [task 2017-10-16T10:16:48.264Z] 10:16:48 INFO - GECKO(1664) | #23 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.265Z] 10:16:48 INFO - GECKO(1664) | #24 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.266Z] 10:16:48 INFO - GECKO(1664) | #25 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.267Z] 10:16:48 INFO - GECKO(1664) | #26 0x7f3e62dbec4f in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27 [task 2017-10-16T10:16:48.269Z] 10:16:48 INFO - GECKO(1664) | #27 0x7f3e6714bd97 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:877:22 [task 2017-10-16T10:16:48.274Z] 10:16:48 INFO - GECKO(1664) | #28 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.276Z] 10:16:48 INFO - GECKO(1664) | #29 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.276Z] 10:16:48 INFO - GECKO(1664) | #30 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.278Z] 10:16:48 INFO - GECKO(1664) | #31 0x7f3e6714b74a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:703:34 [task 2017-10-16T10:16:48.280Z] 10:16:48 INFO - GECKO(1664) | #32 0x4ec2de in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30 [task 2017-10-16T10:16:48.281Z] 10:16:48 INFO - GECKO(1664) | #33 0x4ec2de in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280 [task 2017-10-16T10:16:48.282Z] 10:16:48 INFO - GECKO(1664) | #34 0x7f3e7aa5e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 [task 2017-10-16T10:16:48.284Z] 10:16:48 INFO - GECKO(1664) | Thread T691 (MediaPl~back #5) created by T688 (MediaPl~back #3) here: [task 2017-10-16T10:16:48.287Z] 10:16:48 INFO - GECKO(1664) | #0 0x4a4826 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3 [task 2017-10-16T10:16:48.287Z] 10:16:48 INFO - GECKO(1664) | #1 0x7f3e777d4279 in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14 [task 2017-10-16T10:16:48.288Z] 10:16:48 INFO - GECKO(1664) | #2 0x7f3e777d3e8e in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12 [task 2017-10-16T10:16:48.288Z] 10:16:48 INFO - GECKO(1664) | #3 0x7f3e5c660732 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:598:8 [task 2017-10-16T10:16:48.289Z] 10:16:48 INFO - GECKO(1664) | #4 0x7f3e5c6686af in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:357:22 [task 2017-10-16T10:16:48.291Z] 10:16:48 INFO - GECKO(1664) | #5 0x7f3e5c67bb73 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:148:45 [task 2017-10-16T10:16:48.292Z] 10:16:48 INFO - GECKO(1664) | #6 0x7f3e5c66a7e9 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:109:17 [task 2017-10-16T10:16:48.293Z] 10:16:48 INFO - GECKO(1664) | #7 0x7f3e5c66be0f in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:277:5 [task 2017-10-16T10:16:48.295Z] 10:16:48 INFO - GECKO(1664) | #8 0x7f3e5c66d571 in mozilla::SharedThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SharedThreadPool.h:71:68 [task 2017-10-16T10:16:48.296Z] 10:16:48 INFO - GECKO(1664) | #9 0x7f3e5c64ad3e in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:128:26 [task 2017-10-16T10:16:48.297Z] 10:16:48 INFO - GECKO(1664) | #10 0x7f3e5c66e4e2 in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskQueue.h:71:21 [task 2017-10-16T10:16:48.299Z] 10:16:48 INFO - GECKO(1664) | #11 0x7f3e5c643bec in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:261:13 [task 2017-10-16T10:16:48.301Z] 10:16:48 INFO - GECKO(1664) | #12 0x7f3e5c642385 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:91:7 [task 2017-10-16T10:16:48.301Z] 10:16:48 INFO - GECKO(1664) | #13 0x7f3e5c64c2da in ~AutoTaskGuard /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskQueue.h:183:5 [task 2017-10-16T10:16:48.303Z] 10:16:48 INFO - GECKO(1664) | #14 0x7f3e5c64c2da in mozilla::TaskQueue::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:247 [task 2017-10-16T10:16:48.304Z] 10:16:48 INFO - GECKO(1664) | #15 0x7f3e5c66b63f in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:228:14 [task 2017-10-16T10:16:48.305Z] 10:16:48 INFO - GECKO(1664) | #16 0x7f3e5c66bb3c in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:156:15 [task 2017-10-16T10:16:48.307Z] 10:16:48 INFO - GECKO(1664) | #17 0x7f3e5c6639d6 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1037:14 [task 2017-10-16T10:16:48.308Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e5c67dea8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 [task 2017-10-16T10:16:48.309Z] 10:16:48 INFO - GECKO(1664) | #19 0x7f3e5d457bed in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:338:20 [task 2017-10-16T10:16:48.311Z] 10:16:48 INFO - GECKO(1664) | #20 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.312Z] 10:16:48 INFO - GECKO(1664) | #21 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.314Z] 10:16:48 INFO - GECKO(1664) | #22 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.316Z] 10:16:48 INFO - GECKO(1664) | #23 0x7f3e5c65edf3 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:425:11 [task 2017-10-16T10:16:48.317Z] 10:16:48 INFO - GECKO(1664) | #24 0x7f3e777d74d3 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:216:5 [task 2017-10-16T10:16:48.318Z] 10:16:48 INFO - GECKO(1664) | #25 0x7f3e7babc6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) [task 2017-10-16T10:16:48.320Z] 10:16:48 INFO - GECKO(1664) | Thread T688 (MediaPl~back #3) created by T0 (Web Content) here: [task 2017-10-16T10:16:48.323Z] 10:16:48 INFO - GECKO(1664) | #0 0x4a4826 in __interceptor_pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:245:3 [task 2017-10-16T10:16:48.324Z] 10:16:48 INFO - GECKO(1664) | #1 0x7f3e777d4279 in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:457:14 [task 2017-10-16T10:16:48.326Z] 10:16:48 INFO - GECKO(1664) | #2 0x7f3e777d3e8e in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:548:12 [task 2017-10-16T10:16:48.327Z] 10:16:48 INFO - GECKO(1664) | #3 0x7f3e5c660732 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:598:8 [task 2017-10-16T10:16:48.327Z] 10:16:48 INFO - GECKO(1664) | #4 0x7f3e5c6686af in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:357:22 [task 2017-10-16T10:16:48.328Z] 10:16:48 INFO - GECKO(1664) | #5 0x7f3e5c67bb73 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:148:45 [task 2017-10-16T10:16:48.329Z] 10:16:48 INFO - GECKO(1664) | #6 0x7f3e5c66a7e9 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:109:17 [task 2017-10-16T10:16:48.330Z] 10:16:48 INFO - GECKO(1664) | #7 0x7f3e5c66be0f in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:277:5 [task 2017-10-16T10:16:48.332Z] 10:16:48 INFO - GECKO(1664) | #8 0x7f3e5c66d571 in mozilla::SharedThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/SharedThreadPool.h:71:68 [task 2017-10-16T10:16:48.333Z] 10:16:48 INFO - GECKO(1664) | #9 0x7f3e5c64ad3e in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:128:26 [task 2017-10-16T10:16:48.334Z] 10:16:48 INFO - GECKO(1664) | #10 0x7f3e5c66e4e2 in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskQueue.h:71:21 [task 2017-10-16T10:16:48.335Z] 10:16:48 INFO - GECKO(1664) | #11 0x7f3e5c643bec in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:261:13 [task 2017-10-16T10:16:48.337Z] 10:16:48 INFO - GECKO(1664) | #12 0x7f3e5c642385 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:91:7 [task 2017-10-16T10:16:48.338Z] 10:16:48 INFO - GECKO(1664) | #13 0x7f3e5c642125 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:446:17 [task 2017-10-16T10:16:48.338Z] 10:16:48 INFO - GECKO(1664) | #14 0x7f3e5c642125 in mozilla::EventTargetWrapper::FireTailDispatcher() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:79 [task 2017-10-16T10:16:48.339Z] 10:16:48 INFO - GECKO(1664) | #15 0x7f3e5c645252 in applyImpl<mozilla::EventTargetWrapper, void (mozilla::EventTargetWrapper::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1142:12 [task 2017-10-16T10:16:48.339Z] 10:16:48 INFO - GECKO(1664) | #16 0x7f3e5c645252 in apply<mozilla::EventTargetWrapper, void (mozilla::EventTargetWrapper::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1148 [task 2017-10-16T10:16:48.340Z] 10:16:48 INFO - GECKO(1664) | #17 0x7f3e5c645252 in mozilla::detail::RunnableMethodImpl<mozilla::EventTargetWrapper*, void (mozilla::EventTargetWrapper::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1192 [task 2017-10-16T10:16:48.341Z] 10:16:48 INFO - GECKO(1664) | #18 0x7f3e5c4ceff4 in mozilla::CycleCollectedJSContext::ProcessStableStateQueue() /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:312:12 [task 2017-10-16T10:16:48.342Z] 10:16:48 INFO - GECKO(1664) | #19 0x7f3e5ddfc00d in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp:1207:30 [task 2017-10-16T10:16:48.343Z] 10:16:48 INFO - GECKO(1664) | #20 0x7f3e5c66401f in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1053:24 [task 2017-10-16T10:16:48.344Z] 10:16:48 INFO - GECKO(1664) | #21 0x7f3e5c67dea8 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:524:10 [task 2017-10-16T10:16:48.344Z] 10:16:48 INFO - GECKO(1664) | #22 0x7f3e5d4569c1 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:97:21 [task 2017-10-16T10:16:48.345Z] 10:16:48 INFO - GECKO(1664) | #23 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.345Z] 10:16:48 INFO - GECKO(1664) | #24 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.346Z] 10:16:48 INFO - GECKO(1664) | #25 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.347Z] 10:16:48 INFO - GECKO(1664) | #26 0x7f3e62dbec4f in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:158:27 [task 2017-10-16T10:16:48.348Z] 10:16:48 INFO - GECKO(1664) | #27 0x7f3e6714bd97 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:877:22 [task 2017-10-16T10:16:48.348Z] 10:16:48 INFO - GECKO(1664) | #28 0x7f3e5d3b5d1b in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10 [task 2017-10-16T10:16:48.349Z] 10:16:48 INFO - GECKO(1664) | #29 0x7f3e5d3b5d1b in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319 [task 2017-10-16T10:16:48.350Z] 10:16:48 INFO - GECKO(1664) | #30 0x7f3e5d3b5d1b in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299 [task 2017-10-16T10:16:48.350Z] 10:16:48 INFO - GECKO(1664) | #31 0x7f3e6714b74a in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:703:34 [task 2017-10-16T10:16:48.351Z] 10:16:48 INFO - GECKO(1664) | #32 0x4ec2de in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:63:30 [task 2017-10-16T10:16:48.351Z] 10:16:48 INFO - GECKO(1664) | #33 0x4ec2de in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:280 [task 2017-10-16T10:16:48.352Z] 10:16:48 INFO - GECKO(1664) | #34 0x7f3e7aa5e82f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 [task 2017-10-16T10:16:48.353Z] 10:16:48 INFO - GECKO(1664) | SUMMARY: AddressSanitizer: heap-use-after-free /builds/worker/workspace/build/src/dom/media/mediasource/TrackBuffersManager.h:199:25 in HasVideo [task 2017-10-16T10:16:48.354Z] 10:16:48 INFO - GECKO(1664) | Shadow bytes around the buggy address: [task 2017-10-16T10:16:48.355Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c800444d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.355Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c800444e0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa [task 2017-10-16T10:16:48.356Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c800444f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [task 2017-10-16T10:16:48.356Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa [task 2017-10-16T10:16:48.357Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044510: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.357Z] 10:16:48 INFO - GECKO(1664) | =>0x0c3c80044520: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd [task 2017-10-16T10:16:48.359Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.360Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.361Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044550: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.361Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044560: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.362Z] 10:16:48 INFO - GECKO(1664) | 0x0c3c80044570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd [task 2017-10-16T10:16:48.362Z] 10:16:48 INFO - GECKO(1664) | Shadow byte legend (one shadow byte represents 8 application bytes): [task 2017-10-16T10:16:48.363Z] 10:16:48 INFO - GECKO(1664) | Addressable: 00 [task 2017-10-16T10:16:48.364Z] 10:16:48 INFO - GECKO(1664) | Partially addressable: 01 02 03 04 05 06 07 [task 2017-10-16T10:16:48.364Z] 10:16:48 INFO - GECKO(1664) | Heap left redzone: fa [task 2017-10-16T10:16:48.365Z] 10:16:48 INFO - GECKO(1664) | Heap right redzone: fb [task 2017-10-16T10:16:48.366Z] 10:16:48 INFO - GECKO(1664) | Freed heap region: fd [task 2017-10-16T10:16:48.367Z] 10:16:48 INFO - GECKO(1664) | Stack left redzone: f1 [task 2017-10-16T10:16:48.367Z] 10:16:48 INFO - GECKO(1664) | Stack mid redzone: f2 [task 2017-10-16T10:16:48.368Z] 10:16:48 INFO - GECKO(1664) | Stack right redzone: f3 [task 2017-10-16T10:16:48.368Z] 10:16:48 INFO - GECKO(1664) | Stack partial redzone: f4 [task 2017-10-16T10:16:48.369Z] 10:16:48 INFO - GECKO(1664) | Stack after return: f5 [task 2017-10-16T10:16:48.370Z] 10:16:48 INFO - GECKO(1664) | Stack use after scope: f8 [task 2017-10-16T10:16:48.370Z] 10:16:48 INFO - GECKO(1664) | Global redzone: f9 [task 2017-10-16T10:16:48.371Z] 10:16:48 INFO - GECKO(1664) | Global init order: f6 [task 2017-10-16T10:16:48.372Z] 10:16:48 INFO - GECKO(1664) | Poisoned by user: f7 [task 2017-10-16T10:16:48.372Z] 10:16:48 INFO - GECKO(1664) | Container overflow: fc [task 2017-10-16T10:16:48.373Z] 10:16:48 INFO - GECKO(1664) | Array cookie: ac [task 2017-10-16T10:16:48.373Z] 10:16:48 INFO - GECKO(1664) | Intra object redzone: bb [task 2017-10-16T10:16:48.374Z] 10:16:48 INFO - GECKO(1664) | ASan internal: fe [task 2017-10-16T10:16:48.375Z] 10:16:48 INFO - GECKO(1664) | Left alloca redzone: ca [task 2017-10-16T10:16:48.376Z] 10:16:48 INFO - GECKO(1664) | Right alloca redzone: cb [task 2017-10-16T10:16:48.377Z] 10:16:48 INFO - GECKO(1664) | ==1710==ABORTING
Fallout from bug 1407940?
Group: core-security → media-core-security
Flags: needinfo?(jyavenard)
No.. I think this is an issue following bug 1247189 http://searchfox.org/mozilla-central/rev/40b456626e2d0409b7034768b4d9526fc7235ea4/dom/media/mediasource/MediaSourceDemuxer.cpp#391 Can still access mManager, and it access mManager on the main thread. But we have mManager being cleared on the TaskQueue http://searchfox.org/mozilla-central/rev/40b456626e2d0409b7034768b4d9526fc7235ea4/dom/media/mediasource/MediaSourceDemuxer.cpp#217 So we have a race on MediaSourceTrackDemuxer::mManager member... it needs to be made thread safe.
Blocks: 1247189
Flags: needinfo?(jyavenard) → needinfo?(alwu)
Priority: -- → P2
Assignee: nobody → alwu
Flags: needinfo?(alwu)
Attached patch Bug 1408987 - part2 : add mutex for mManager. (obsolete) (deleted) — Splinter Review
Attachment #8919162 - Flags: review?(jyavenard)
Comment on attachment 8919161 [details] [diff] [review] Bug 1408987 - part1 : add assertion OnTaskQueue() to indicate the running thread for funcitons. Review of attachment 8919161 [details] [diff] [review]: ----------------------------------------------------------------- fix the spelling in the commit description (functions vs funcitons) I suggest: "Add OnTaskQueue() assertion to clarify functions' running thread" In any case, r- as the code will now assert if some functions are called after being detached/breakcycle while it would have handle the error softly before. You need to choose one behaviour over the other: either you assert if the functions are called after detached, or you reject the condition nicely. Don't do both... Asserting is likely fine. ::: dom/media/mediasource/MediaSourceDemuxer.cpp @@ +406,5 @@ > > RefPtr<MediaSourceTrackDemuxer::SeekPromise> > MediaSourceTrackDemuxer::DoSeek(const TimeUnit& aTime) > { > + MOZ_ASSERT(OnTaskQueue()); in the test below you check if the manager is detached, however now it will just assert. so if we want to handle failure softly, we can't assert. It should be one or the other, can't be both. and it's the same wherever you check for mManager
Attachment #8919161 - Flags: review?(jyavenard) → review-
Comment on attachment 8919162 [details] [diff] [review] Bug 1408987 - part2 : add mutex for mManager. Review of attachment 8919162 [details] [diff] [review]: ----------------------------------------------------------------- Code is good. However, we already have mMonitor, no need for another mutex. Change mMonitor to mMutex and re-use it for protecting mManager ::: dom/media/mediasource/MediaSourceDemuxer.h @@ +150,5 @@ > // Amount of pre-roll time when seeking. > // Set to 80ms if track is Opus. > const media::TimeUnit mPreRoll; > + > + // Monitor to protect following objects accessed across multiple threads it's a mutex. @@ +152,5 @@ > const media::TimeUnit mPreRoll; > + > + // Monitor to protect following objects accessed across multiple threads > + Mutex mMutex; > + // Would be accessed in main thread and task queue, and be set on task queue. mManager won't be accessed on the main thread, but the MFR's demuxer proxy taskqueue
Attachment #8919162 - Flags: review?(jyavenard) → review-
(In reply to Jean-Yves Avenard [:jya] from comment #5) > in the test below you check if the manager is detached, however now it will > just assert. I'll change the assertion to the place after we check whether the manager is detached.
Attachment #8919161 - Attachment is obsolete: true
Attachment #8919185 - Flags: review?(jyavenard)
Attached patch Bug 1408987 - part2 : add mutex for mManager. (obsolete) (deleted) — Splinter Review
Attachment #8919162 - Attachment is obsolete: true
Attachment #8919186 - Flags: review?(jyavenard)
Attachment #8919186 - Attachment is obsolete: true
Attachment #8919186 - Flags: review?(jyavenard)
Attachment #8919187 - Flags: review?(jyavenard)
Attachment #8919185 - Flags: review?(jyavenard) → review+
Comment on attachment 8919187 [details] [diff] [review] Bug 1408987 - part2 : make mManager thread-safe. Review of attachment 8919187 [details] [diff] [review]: ----------------------------------------------------------------- ::: dom/media/mediasource/MediaSourceDemuxer.h @@ +142,5 @@ > // Monitor protecting members below accessed from multiple threads. > Monitor mMonitor; > media::TimeUnit mNextRandomAccessPoint; > + // Would be accessed in MFR's demuxer proxy task queue and its parent's task > + // queue, and only be set on parent's task queue. It can be accessed while on s/parent's task queue/TaskQueue
Attachment #8919187 - Flags: review?(jyavenard) → review+
Attachment #8919187 - Attachment is obsolete: true
Attachment #8919202 - Flags: review+
Keywords: checkin-needed
this needs a security assessment first
Keywords: checkin-needed
Comment on attachment 8919185 [details] [diff] [review] Bug 1408987 - part1 : add OnTaskQueue() assertion to clarify functions' running thread. [Security approval request comment] > How easily could an exploit be constructed based on the patch? This is used to clarify functions' running thread > Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? No > Which older supported branches are affected by this flaw? None > If not all supported branches, which bug introduced the flaw? bug 1247189 > Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? No > How likely is this patch to cause regressions; how much testing does it need? It should not cause regression, it's only about adding assertion
Attachment #8919185 - Flags: sec-approval?
Comment on attachment 8919202 [details] [diff] [review] Bug 1408987 - part2 : make mManager thread-safe. r=jya. [Security approval request comment] > How easily could an exploit be constructed based on the patch? Make mManager thread-safe > Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? No > Which older supported branches are affected by this flaw? None > If not all supported branches, which bug introduced the flaw? bug 1247189 > Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? No > How likely is this patch to cause regressions; how much testing does it need? I think locking the variable won't cause regressions.
Attachment #8919202 - Flags: sec-approval?
Comment on attachment 8919185 [details] [diff] [review] Bug 1408987 - part1 : add OnTaskQueue() assertion to clarify functions' running thread. Doesn't need sec-approval since it's trunk-only. We'll obviously need to make sure this gets nominated as well if/when bug 1247189 gets nominated for Beta approval, however.
Attachment #8919185 - Flags: sec-approval?
Attachment #8919202 - Flags: sec-approval?
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla58
Group: media-core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: