1258604 - crash in mozilla::MozPromise<T>::Private::Reject<T> (called from GMP{Audio,Video}Decoder::GMPInitDone)

Status: RESOLVED DUPLICATE of bug 1256065

(Core :: Audio/Video: Playback, defect)

Description

[Kan-Ru Chen [:kanru] (UTC+9)]

This bug was filed from the Socorro interface and is 
report bp-e06665c3-314b-4753-977e-2cb602160321.
=============================================================

Currently #30 in the beta 46 e10s experiment. Crashes occur in the content process. Probably related to bug 1256064

Stack:
mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaDataDecoder::DecoderFailureReason, 1>::Private::Reject<mozilla::MediaDataDecoder::DecoderFailureReason>(mozilla::MediaDataDecoder::DecoderFailureReason&&, char const*)
mozilla::MozPromiseHolder<mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaDataDecoder::DecoderFailureReason, 1> >::Reject(mozilla::MediaDataDecoder::DecoderFailureReason, char const*)
mozilla::GMPVideoDecoder::GMPInitDone(GMPVideoDecoderProxy*, GMPVideoHost*)
mozilla::gmp::GetGMPContentParentForVideoDecoderDone::Done(mozilla::gmp::GMPContentParent*)
mozilla::gmp::GetContentParentFromDone::Done(mozilla::gmp::GMPServiceChild*)
mozilla::gmp::GeckoMediaPluginServiceChild::SetServiceChild(mozilla::UniquePtr<mozilla::gmp::GMPServiceChild, mozilla::DefaultDelete<mozilla::gmp::GMPServiceChild> >&&)
mozilla::gmp::OpenPGMPServiceChild::Run()

Comment 1

[Brad Lassey [:blassey] (use needinfo?)]

Chris, will bug 1256064 fix this?

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

(In reply to Brad Lassey [:blassey] (use needinfo?) from comment #1)
> Chris, will bug 1256064 fix this?

No, the crash reported in comment 0 is unrelated to the crash in bug 1256064.

The crash reported in comment 0 is fixed in bug 1256065.

There are a number of crashes in media at the moment where the last frame on the crashing thread are the same but further up the stack the entry point of the crashing paths differ. The crashes should be treated as distinct, but our crash reporting infrastructure can't do that (as far as I know, we group crashes by the last frame on the crashing thread) so the crashes are being coalesced into a smaller number of signatures, making it hard to distinguish between the distinct paths crashing, fixed, and not fixed.

Comment 3

[Chris Pearce [:cpearce (Not reading bugmail)]]

This crash accounted for 3305 of 4941 of crashes recorded under signature mozilla::MozPromise<T>::Private::Resolve<T> in the period 2016-03-01 -> 2016-03-24 in 46 beta.

Comment 4

[Chris Pearce [:cpearce (Not reading bugmail)]]

(In reply to Chris Pearce (:cpearce) from comment #3)
> This crash accounted for 3305 of 4941 of crashes recorded under signature
> mozilla::MozPromise<T>::Private::Resolve<T> in the period 2016-03-01 ->
> 2016-03-24 in 46 beta.

Wrong bug; the above is for the Resolve() case, the Reject() case actually occurred 57 times in the period 2016-03-01 -> 2016-03-24 in 46 beta.