[Description:]
When the browser is playing videos on CNN.com it constantly crashes on windows7

[Steps to reproduce:]

• Launch Nightly build
• Go to these sites:
  http://www.cnn.com/2016/10/10/us/weather-matthew/index.html
  http://edition.cnn.com/2017/03/07/vr/manila-philippines-drug-war/index.html
• On the first link watch 2 or 3 videos (watch 1 and some seconds later scroll and watch the second one, and so on)
• On the second link watch the first video until it ends

[Actual results]:
Firefox crashes while watching the video sometimed crashes after watching 2 or 3 videos / or when video ends it crashes.

[Expected results:]
Videos should play without any problem at all.

MacOs 10.14
Nightly 70.0a1 no issue
Beta 69.0.b9 no issue
Release 68.0.1 no issue

Windows7 64bit
Nightly 70.0a1 Crashes firefox
Release 68.0.1 no issue
Beta 69.0.b9 no issue

Ubuntu 18.04 64bit
Release 68.0.1 no issue
Beta 69.0.b9 no issue
Nightly 70.0a1 no issue

Crash report attached.
Will do mozregression as soon as i can

I cannot reproduce it on my Window 10.
Can you find the crash report related to this bug on about:crashes ? It'll be helpful if we can get the crash stack.

Hi C.M

Here are the links from about:crashes ( windows7 )
Please let me know if you need more info:

https://crash-stats.mozilla.org/report/index/3e685aee-88fd-49e1-a631-9b9dc0190731

https://crash-stats.mozilla.org/report/index/9a9586f5-597d-4646-a177-dcd810190731

https://crash-stats.mozilla.org/report/index/b74c6fcd-99c2-4e78-8c35-b7dc00190731

https://crash-stats.mozilla.org/report/index/10c26198-9a37-4676-a26b-ce2ce0190730

It looks like it crashes in VR related code. Can you upload your about:support to this bug? Is there a specific video that can cause crash?

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Attached about:support,

No specific video, sometimes i am still watching the 1st one, then scroll and watch the second one and crashes
and sometimes i am watching the 1st one, then scroll, then start to watch the second one, then scroll and watch the 3rd one and crashes.

Maybe a graphics problem, but I guess it makes sense to leave it here until we've had a chance to investigate it further.

Pablo, is this specific to CNN? Other sites with videos don't have the issue? Are you using any kind of VR hardware with the device that is crashing?

Looks like a null pointer deref IMO. The crash address is constant and low (0x18) which looks like a believable address for members if the shmem here is null and then we try access members here.

Daosheng, could you take a look on this? This might be a regression caused by VR related code.

It is only happening on CNN.com, other sites didn´t crash.
We are using just a regular PC at work, I will try with my personal home PC tonight.

Crashed with my Home PC too. Attached Home.zip with about:crashes and about:support
Machine is a skylake Intel with a Radeon hd7950 with latest drivers.

By going to http://www.cnn.com/2016/10/10/us/weather-matthew/index.html
-hit play on first video, then 10 seconds later scroll down
-hit play on second video, then 10 seconds later scroll down
and it crashed.

Per Comment 4, it looks like we need check if VRShMem is valid before calling JoinShMem()?
https://hg.mozilla.org/mozilla-central/annotate/0cfffbaad82ed31e5e61885cf9811bf149a0408c/gfx/vr/service/VRService.cpp#l141

Bug understood, testing and validating local fix

(In reply to thomasmo from comment #17)

Bug understood, testing and validating local fix

Thomas, is your local fix ready to land? Thanks

(In reply to Pascal Chevrel:pascalc from comment #18)

Thomas, is your local fix ready to land? Thanks

Almost--It is in CR. Sorry that the bug didn't get updated (I guess arc/phab can't handle more than one bug at a time?)
Here is the CR link: https://phabricator.services.mozilla.com/D40681

Should be fixed now: https://hg.mozilla.org/mozilla-central/rev/6ed00c66b890