1246051 - MediaQueue<T>::Peek/PeekFront are not thread-safe

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[JW Wang [:jwwang] [:jw_wang]]

Considering the following code:
RefPtr<T> foo = queue.PeekFront();

It is possible for the foo constructor to receive a dangling pointer if queue.Reset() is called on another thread in the mean time.

Comment 1

[Jean-Yves Avenard [:jya]]

the only place doing so is MediaDecoderStateMachine::SeekCompleted()

But isn't queue.Reset() only ever called on the MDSM thread?

Comment 2

[JW Wang [:jwwang] [:jw_wang]]

We either need to document this pitfall or make it thread-safe to be usable outside the context of MDSM.

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

(In reply to Jean-Yves Avenard [:jya] from comment #1)
> the only place doing so is MediaDecoderStateMachine::SeekCompleted()
> 
> But isn't queue.Reset() only ever called on the MDSM thread?

https://hg.mozilla.org/mozilla-central/file/584870f1cbc5d060a57e147ce249f736956e2b62/dom/media/mediasink/DecodedAudioDataSink.cpp#l221

We have such usages in DecodedAudioDataSink::PopFrames() which is called from libcubeb callback threads.

Comment 4

[Jean-Yves Avenard [:jya]]

I believe this issue is one of the reason for crashes seen in the Android emulator as seen in bug 1264199

Comment 5

[JW Wang [:jwwang] [:jw_wang]]

Attachment: MozReview Request: Bug 1246051 - have MediaQueue<T>::Peek/PeekFront return a RefPtr<> to avoid dangling pointers per comment 0. r=gerald.

Review commit: https://reviewboard.mozilla.org/r/48675/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/48675/

Comment 6

[JW Wang [:jwwang] [:jw_wang]]

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=52bfd78ab8e6

Comment 7

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Comment on attachment 8744793 [details]
MozReview Request: Bug 1246051 - have MediaQueue<T>::Peek/PeekFront return a RefPtr<> to avoid dangling pointers per comment 0. r=gerald.

https://reviewboard.mozilla.org/r/48675/#review45437

Comment 8

[JW Wang [:jwwang] [:jw_wang]]

Thanks for the review!

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2dbdefa829d1

Comment 10

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/2dbdefa829d1