1037911 - Assert in GMP

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect)

Description

[Eric Rescorla (:ekr)]

I ran into the following crash while running under the debugger. I haven't tried to
repro.

Assertion failure: (mVideoEncoders.RemoveElement(aEncoder)), at /Users/ekr/dev/gecko/gmp/content/media/gmp/GMPParent.cpp:142
mozilla::gmp::GMPParent::VideoEncoderDestroyed(mozilla::gmp::GMPVideoEncoderParent*)+0x000000D6 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x01FE8796]
mozilla::gmp::GMPVideoEncoderParent::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)+0x00000035 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x01FF0D15]
non-virtual thunk to mozilla::gmp::GMPVideoEncoderParent::ActorDestroy(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)+0x00000022 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x01FF0D72]
mozilla::gmp::PGMPVideoEncoderParent::DestroySubtree(mozilla::ipc::IProtocolManager<mozilla::ipc::IProtocol>::ActorDestroyReason)+0x0000004B [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x0099033B]
mozilla::gmp::PGMPParent::SendPGMPVideoEncoderConstructor(mozilla::gmp::PGMPVideoEncoderParent*)+0x00000237 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x009901B7]
mozilla::gmp::PGMPParent::SendPGMPVideoEncoderConstructor()+0x00000029 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x0098FF79]
mozilla::gmp::GMPParent::GetGMPVideoEncoder(mozilla::gmp::GMPVideoEncoderParent**)+0x000000AF [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x01FE8BCF]
mozilla::gmp::GeckoMediaPluginService::GetGMPVideoEncoder(nsTArray<nsCString>*, nsAString_internal const&, GMPVideoHost**, GMPVideoEncoderProxy**)+0x00000273 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x01FEBA53]
mozilla::WebrtcGmpVideoEncoder::InitEncode_g(webrtc::VideoCodec const*, int, unsigned int)+0x000000FF [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x00F6EC0F]
mozilla::runnable_args_m_3_ret<mozilla::WebrtcGmpVideoEncoder*, int (mozilla::WebrtcGmpVideoEncoder::*)(webrtc::VideoCodec const*, int, unsigned int), webrtc::VideoCodec const*, int, unsigned int, int>::Run()+0x0000008D [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x00F72EFD]
nsThreadSyncDispatch::Run()+0x00000062 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x00154912]
nsThread::ProcessNextEvent(bool, bool*)+0x00000622 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x00153A92]
NS_ProcessNextEvent(nsIThread*, bool)+0x000000A8 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x0003E018]
mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)+0x000003A7 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x00784657]
MessageLoop::RunInternal()+0x00000076 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x007054D6]
MessageLoop::RunHandler()+0x00000015 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x007053E5]
MessageLoop::Run()+0x0000002D [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x0070538D]
nsThread::ThreadFunc(void*)+0x00000166 [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/XUL +0x001520E6]
_pt_root+0x000001CE [/Users/ekr/dev/gecko/gmp/obj-x86_64-apple-darwin12.5.0/dist/NightlyDebug.app/Contents/MacOS/libnss3.dylib +0x0023F69E]
_pthread_start+0x00000147 [/usr/lib/system/libsystem_c.dylib +0x00014772]

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
[Switching to process 97957 thread 0x1450b]
mozilla::gmp::GMPParent::VideoEncoderDestroyed (this=0x10087c200, aEncoder=0x13332d710) at GMPParent.cpp:142

Comment 1

[Randell Jesup [:jesup] (needinfo me)]

The assertion is probably incorrect; if SendPGMPVideoEncoderConstructor() fails in send, it will call DestroySubtree.  This will end up VideoEncoderDestroyed() before we've added the encoder, so the assert fires.

Solution is to not assert in this case, and downgrade it to a warning.

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

Attachment: Downgrade assertion on GMP codec destruction since an edge case triggers it

Comment 3

[Randell Jesup [:jesup] (needinfo me)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/89c48a61137e

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Looks like this caused a Werror failure on B2G OSX builds: https://tbpl.mozilla.org/php/getParsedLog.php?id=43700777&tree=Mozilla-Inbound

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/58d9f861d2b4

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

(In reply to Randell Jesup [:jesup] from comment #5)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/58d9f861d2b4

That fixed one instance of the Werror, but it looks like there's still one more happening: https://tbpl.mozilla.org/php/getParsedLog.php?id=43709913&tree=Mozilla-Inbound

Comment 7

[Randell Jesup [:jesup] (needinfo me)]

Not sure what rev that came from, but the log cited clearly doesn't have the bustage fix:
/builds/slave/m-in-osx64_g-00000000000000000/build/content/media/gmp/GMPParent.cpp:145:14: error: expression result unused [-Werror,-Wunused-value]
  NS_WARN_IF(!mVideoEncoders.RemoveElement(aEncoder));


The line is now "unused << NS_WARN_IF(...)"

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

Bustage fix rs=bustage
https://hg.mozilla.org/integration/mozilla-inbound/rev/2c95fdd24a27

Apologies: I kept thinking of it as a "one-liner" patch, and when I fixed the bustage I stopped there.

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/89c48a61137e
https://hg.mozilla.org/mozilla-central/rev/58d9f861d2b4
https://hg.mozilla.org/mozilla-central/rev/2c95fdd24a27