It first showed up in 22.0a1/20130318. The regression range might be (discontinuous across builds): http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=0b052daa913c&tochange=b03bb3ce8cee Signature moz_abort | je_free | mozilla::MediaResource::`vector deleting destructor''(unsigned int) More Reports Search UUID 60883227-943b-4947-ad7a-77de32130325 Date Processed 2013-03-25 05:34:52 Uptime 24 Last Crash 26 seconds before submission Install Age 3.3 minutes since version was first installed. Install Time 2013-03-25 05:31:29 Product Firefox Version 22.0a1 Build ID 20130324031024 Release Channel nightly OS Windows NT OS Version 6.1.7601 Service Pack 1 Build Architecture x86 Build Architecture Info GenuineIntel family 6 model 15 stepping 13 Crash Reason EXCEPTION_BREAKPOINT Crash Address 0x73e81bbf App Notes AdapterVendorID: 0x1002, AdapterDeviceID: 0x9589, AdapterSubsysID: 200217af, AdapterDriverVersion: 8.632.1.2000 D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ Processor Notes sp-processor02.phx1.mozilla.com_32486:2008 EMCheckCompatibility True Adapter Vendor ID 0x1002 Adapter Device ID 0x9589 Total Virtual Memory 4294836224 Available Virtual Memory 3644788736 System Memory Use Percentage 57 Available Page File 2802237440 Available Physical Memory 905871360 Frame Module Signature Source 0 mozglue.dll moz_abort memory/build/jemalloc_config.c:33 1 mozglue.dll je_free memory/mozjemalloc/jemalloc.c:6589 2 xul.dll mozilla::MediaResource::`vector deleting destructor' 3 xul.dll mozilla::MediaResource::Release obj-firefox/dist/include/MediaStreamGraph.h:93 4 xul.dll nsRefPtr<mozilla::MediaStreamListener>::assign_assuming_AddRef obj-firefox/dist/include/nsAutoPtr.h:868 5 xul.dll mozilla::ReleaseWMFByteStreamResourcesEvent::Run content/media/wmf/WMFByteStream.cpp:78 6 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:627 7 xul.dll NS_ProcessNextEvent_P obj-firefox/xpcom/build/nsThreadUtils.cpp:238 8 xul.dll mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:82 9 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:209 10 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:183 11 xul.dll nsBaseAppShell::Run widget/xpwidgets/nsBaseAppShell.cpp:163 12 xul.dll nsAppShell::Run widget/windows/nsAppShell.cpp:113 13 xul.dll nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:288 14 xul.dll XREMain::XRE_mainRun toolkit/xre/nsAppRunner.cpp:3880 15 xul.dll XREMain::XRE_main toolkit/xre/nsAppRunner.cpp:3947 16 xul.dll XRE_main toolkit/xre/nsAppRunner.cpp:4161 17 firefox.exe do_main browser/app/nsBrowserApp.cpp:228 18 firefox.exe wmain toolkit/xre/nsWindowsWMain.cpp:105 19 firefox.exe __tmainCRTStartup crtexe.c:552 20 kernel32.dll BaseThreadInitThunk 21 ntdll.dll __RtlUserThreadStart 22 ntdll.dll _RtlUserThreadStart More reports at: https://crash-stats.mozilla.com/report/list?signature=moz_abort+|+je_free+|+mozilla%3A%3AMediaResource%3A%3A%60vector+deleting+destructor%27%27%28unsigned+int%29 https://crash-stats.mozilla.com/report/list?signature=moz_abort+|+je_free+|+mozilla%3A%3AMediaResource%3A%3A%60scalar+deleting+destructor%27%27%28unsigned+int%29

Windows media foundation code in the stacktrace but I couldn't see any relevant patches in the regression range.

I just hit this trying the "Deleting Borders" Chrome Experiment at http://deletingborders.com/: bp-32cacfa7-e285-4bfe-8c63-1f1ef2130410

While loading Deleting Borders, I hit this bug (more often) or bug 683664 or indefinitely hangs.

Regression window(m-i) Good: http://hg.mozilla.org/integration/mozilla-inbound/rev/4a54cc0f7c36 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130315 Firefox/22.0 ID:20130315211034 Bad: http://hg.mozilla.org/integration/mozilla-inbound/rev/6922ed98876a Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20130315 Firefox/22.0 ID:20130315223532 Pushlog: http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b9fb91275c69&tochange=6922ed98876a Triggered by 6922ed98876a Ehsan Akhgari — Bug 851603 - Enable Web Audio in Nightly; r=roc

This prevents a fatal MOZ_ASSERT.

Comment on attachment 737763 [details] [diff] [review] Part 2: Fix the crash Review of attachment 737763 [details] [diff] [review]: ----------------------------------------------------------------- Thanks!

https://hg.mozilla.org/integration/mozilla-inbound/rev/7a0eb8b304eb https://hg.mozilla.org/integration/mozilla-inbound/rev/ee39d8eb931f

https://hg.mozilla.org/mozilla-central/rev/7a0eb8b304eb https://hg.mozilla.org/mozilla-central/rev/ee39d8eb931f

Comment on attachment 737762 [details] [diff] [review] Part 1: Call BeginDecoding before OnDecodeThreadStart (Note that I'm applying for Aurora 22, which will be Beta 22 soon.) [Approval Request Comment] Bug caused by (feature/regressing bug #): Web Audio. User impact if declined: This is a crash fix for people who have enabled Web Audio. Should not affect the usual release population. Testing completed (on m-c, etc.): it has baked for a while. Risk to taking this patch (and alternatives if risky): Should be fairly low risk. String or IDL/UUID changes made by this patch: none.

Comment on attachment 737762 [details] [diff] [review] Part 1: Call BeginDecoding before OnDecodeThreadStart Given the risk evaluation that this should not impact normal release users, approving for Beta 22.

Mass moving Web Audio bugs to the Web Audio component. Filter on duckityduck.

No crash reports found in Socorro, for neither one of the 4 signatures of this bug, regarding last month. Marking this verified on Fx 22, based on the above statement.

Verified fixed on Fx 23. No crash reports found in Socorro, for neither one of the 4 signatures of this bug, regarding last month. Also, http://www.deletingborders.com/ seems to be working ok with Fx 23 beta 1 (build ID: 20130625125232) on a Win 7 machine.