1036396 - GMPStorageParent uses the directory service off the main thread

Status: RESOLVED FIXED

(Core :: Audio/Video, defect)

Description

[Benjamin Smedberg]

GMPStorageParent "GetGMPStorageDir" uses the directory service off of the main thread, which is completely unsafe and will likely end up crashing with some extensions installed.

Comment 1

[Benjamin Smedberg]

Attachment: gmp-dirservice

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

Comment on attachment 8453124 [details] [diff] [review]
gmp-dirservice

Review of attachment 8453124 [details] [diff] [review]:
-----------------------------------------------------------------

SyncRunnable() can be used only if we're certain that the target (MainThread) will never block on sending an event to the source thread (which I believe should be ok; I don't think MainThread will block on the GMPThread).

::: content/media/gmp/GMPStorageParent.cpp
@@ +35,5 @@
> +
> +  nsRefPtr<GetTempDir> r = new GetTempDir();
> +  nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
> +  mozilla::SyncRunnable::DispatchToThread(mainThread, r);
> +  

ws

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

This only affects EME plugins, OpenH264 doesn't need this.

Comment 4

[Benjamin Smedberg]

cpearce this fix was based on a prototype patch which hasn't been checked in. I'd like to hand this bug to you to either fold into your existing patch queue or drop if it's no longer needed.

Comment 5

[Chris Pearce [:cpearce (Not reading bugmail)]]

Sure, I got this.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Fixed in bug 1034368.