1256064 - crash in mozilla::MozPromise<T>::Private::Resolve<T> (called from MediaTimer::UpdateLocked)

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Mats Palmgren (inactive)]

This bug was filed from the Socorro interface and is 
report bp-62d4edd9-0ebd-4f79-8a00-2cea52160311.
=============================================================

722 reported crashes in the past 28 days, all on 32-bit Windows.
It looks like it's spiking in v46.

Stack:

mozilla::MozPromise<bool, bool, 1>::Private::Resolve<bool const&>(bool const&, char const*)
mozilla::MozPromise<bool, bool, 1>::ForwardTo(mozilla::MozPromise<bool, bool, 1>::Private*)
mozilla::MozPromise<bool, bool, 1>::DispatchAll()
mozilla::MozPromise<bool, bool, 1>::Private::Resolve<bool>(bool&&, char const*)
mozilla::MediaTimer::UpdateLocked()
mozilla::MediaTimer::TimerFired()
nsTimerImpl::Fire()
PR_WaitCondVar
nsThreadPool::Run()
PR_EnterMonitor
NS_ProcessNextEvent(nsIThread*, bool)
mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)
MessageLoop::RunHandler()
[...]

Comment 1

[Mats Palmgren (inactive)]

[Tracking Requested - why for this release]:
possible crash regression in v46

Comment 2

[Mats Palmgren (inactive)]

Fwiw, it's quite high in the Top Crashers for Firefox 46.0b ranking, at #3 currently.

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3AMozPromise%3CT%3E%3A%3APrivate%3A%3AResolve%3CT%3E#tab-reports

Some of them are due to bug 1242774 like:
https://crash-stats.mozilla.com/report/index/21d24213-3bef-4ec9-916b-056762160313

which was fixed in 47 and not uplifted to 46.

I will uplift bug 1242774 to 46.

Comment 4

[JW Wang [:jwwang] [:jw_wang]]

https://crash-stats.mozilla.com/report/list?signature=mozilla%3A%3AMozPromise%3CT%3E%3A%3APrivate%3A%3AResolve%3CT%3E#tab-reports

Some of them crashed in GMPVideoDecoder like:
https://crash-stats.mozilla.com/report/index/4e0a69ee-d1a0-4a1e-bdb3-296622160313

Comment 8

[Chris Pearce [:cpearce (Not reading bugmail)]]

(In reply to Mats Palmgren (:mats) from comment #2)
> Fwiw, it's quite high in the Top Crashers for Firefox 46.0b ranking, at #3
> currently.

I think this must be a regression in enabling decoding unencrypted MP4/AAC/H.264 files with the Adobe EME plugin on WinXP and Windows without system decoders.

Comment 9

[Robert Kaiser]

This is 3.4% of all Firefox 46.0b1 crashes, and therefore by far a topcrash.

Comment 10

[Maire Reavy [:mreavy]]

Hi Chris -- This is a regression and blocking fx46 release; so this needs an owner.  You're the most logical choice.  Thanks!

Comment 11

[Liz Henry (:lizzard)]

Tracking, recent regression and topcrash.

Comment 13

[Chris Pearce [:cpearce (Not reading bugmail)]]

Let's address the MediaTimer::UpdateLocked instances in this bug, and the others in other bugs.

MediaTimer::UpdateLocked seems to be low volume compared to the others.

Comment 14

[Liz Henry (:lizzard)]

Still the #2 top crash in beta 2, with 3.55% of total crashes.

Comment 15

[Liz Henry (:lizzard)]

At that volume this should probably block release.

Comment 16

[Chris Pearce [:cpearce (Not reading bugmail)]]

There are at least two crashes being caught by the signature mozilla::MozPromise<T>::Private::Resolve<T> that can be distinguished between by looking further up the stack:

1. bug 1256065 - GMPVideoDecoder::GMPInitDone
2. bug 1256064 - MediaTimer::UpdateLocked (*this bug*)

I don't know how to make Socorro distinguish the two signatures. That would be most useful.

However based on manual inspection the GMPVideoDecoder::GMPInitDone crash appears to be the most frequent, and the cause of the topcrash. The fix has been uplifted and the crashes appear to have abated since the fix landed.

This bug's signature, MediaTimer::UpdateLocked, seems much less frequent. We should still fix and uplift the fix, but I don't think it should be considered a top crash.

Comment 17

[Chris Pearce [:cpearce (Not reading bugmail)]]

jwwang: do you have any ideas about the crashing path being called from MediaTimer::UpdateLocked?

Comment 18

[JW Wang [:jwwang] [:jw_wang]]

No idea yet...

The crash address is 0xc at http://hg.mozilla.org/releases/mozilla-release/annotate/60e96806ff1c/xpcom/threads/MozPromise.h#l676 which looks like |this| is a null pointer.

However, it is called from http://hg.mozilla.org/releases/mozilla-release/annotate/60e96806ff1c/xpcom/threads/MozPromise.h#l644 where aOther is passed from mChainedPromises[i] at http://hg.mozilla.org/releases/mozilla-release/annotate/60e96806ff1c/xpcom/threads/MozPromise.h#l635 which shouldn't be null.

I will wait for more crash reports to see if I can find any clues.

Comment 19

[Chris Pearce [:cpearce (Not reading bugmail)]]

[Tracking Requested - why for this release]:

Reseting blocking-46, ni? to ensure that's noticed.

Liz: I wrote a python script to pull the mozilla::MozPromise<T>::Private::Resolve<T> crashes in the period 2016-03-01 -> 2016-03-24 in 46 beta out of socorro. I used these to count the distinct call paths that crashed in mozilla::MozPromise<T>::Private::Resolve<T> signature, and the call site that's tracked in this bug (called from MediaTimer::UpdateLocked) appeared 0 times out of 4941 crashes the in that period in that signature.

So I don't think this case of crash in mozilla::MozPromise<T>::Private::Resolve<T> (called from MediaTimer::UpdateLocked) is a top crash, so I am removing release blocking status.

Also, the other paths that were frequently crashing in mozilla::MozPromise<T>::Private::Resolve<T> are fixed too. Will comment elsewhere.

The MediaTimer::UpdateLocked case may not be fixed yet, so I'm leaving this bug open, but it's not a frequent crash.

Comment 20

[Liz Henry (:lizzard)]

Chris, thanks very much for digging into that.  Which other bugs have the fixes for the crash we're worrying about?

Comment 21

[Liz Henry (:lizzard)]

Maybe this, which is fixed in 46? https://bugzilla.mozilla.org/show_bug.cgi?id=1242774

Comment 22

[Chris Pearce [:cpearce (Not reading bugmail)]]

Yep. The frequent cases are:

Bug 1259397 - crash in mozilla::MozPromise<T>::Private::Resolve<T> (called from GMPAudioDecoder::GMPInitDone or GMPVideoDecoder::GMPInitDone)
(fixed by bug 1256065)

Bug 1242774 - crash in mozilla::MozPromise<T>::Private::Resolve<T> (called from mozilla::media::DecodedAudioDataSink::Drained())

Comment 23

[Liz Henry (:lizzard)]

Chris, I think we can mark this fixed based on the fix in https://bugzilla.mozilla.org/show_bug.cgi?id=1242774#c47.

Comment 24

[Chris Pearce [:cpearce (Not reading bugmail)]]

Attachment: Counts of mozilla::MozPromise<T>::Private::Resolve<T> crashes in last 90 days

I've attached my counts of the mozilla::MozPromise<T>::Private::Resolve<T> crashes that occurred in the period 2016-01-1 to 2016-03-29.

The crashes that happened more than about 200 times or so are all fixed. These are the top crashes.

The MediaTimer crashes (which this bug is filed for) hasn't had any crashes in the past 15 days.

I don't know what fixed this, but I think we can close the bug and move on.

Comment 25

[Liz Henry (:lizzard)]

Resetting flags to fit with platform triage process. 
Chris would you also consider this fixed for 47?

Comment 26

[Chris Pearce [:cpearce (Not reading bugmail)]]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #25)
> Resetting flags to fit with platform triage process. 
> Chris would you also consider this fixed for 47?

No crash reports in 47. I'd call this fixed.