1225643 - After cycle collection, mozilla::MediaInputPort::Disconnect hits an assertion about being on the wrong thread

Status: RESOLVED DUPLICATE of bug 1223670

(Core :: Web Audio, defect)

Description

[Jesse Ruderman]

Attachment: testcase

1. Load the testcase
2. Use the "CC" button in about:memory to force cycle collection

or

1. Install https://github.com/MozillaSecurity/funfuzz/tree/master/dom/extension
2. Load the testcase

About 60% of the time, it hits:

Assertion failure: lock->locked && pthread_equal(lock->owner, pthread_self()), at nsprpub/pr/src/pthreads/ptsynch.c:226

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Karl Tomlinson (:karlt)]

This assertion failure also sometimes happens with the testcase for bug 1223670.

Comment 3

[Karl Tomlinson (:karlt)]

I'm not reproducing with the 2015-10-01 nightly debug build, so this seems a more recent regression than bug 1223670.

Comment 4

[Karl Tomlinson (:karlt)]

The assertion was added in bug 1219403.  The fault probably existed before then.

Comment 5

[Karl Tomlinson (:karlt)]

Adding the assertion to the revision prior to landing bug 1189506 (and
applying the fix for bug 1205016) still reproduces this bug, so this is not a
regression from bug 1189506 or anything that landed more recently.
Bug 1223670 comment 3 may hold some clues.

Comment 6

[Karl Tomlinson (:karlt)]

All sorts of security problems are possible, I expect.  Not sure how many require races to run the right way.

Comment 7

[Karl Tomlinson (:karlt)]

Same root problem as bug 1223670.  No need to keep this open now that the other is m-c-s.