Intermittent Main app process exited normally | application crashed [@ mozilla::MediaFormatReader::DemuxerProxy::Wrapper::~Wrapper()]

RESOLVED FIXED in Firefox 54

Status

()

P1
critical
RESOLVED FIXED
2 years ago
2 years ago

People

(Reporter: intermittent-bug-filer, Assigned: jwwang)

Tracking

(Blocks: 1 bug, {intermittent-failure, regression})

unspecified
mozilla55
intermittent-failure, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox52 unaffected, firefox-esr52 unaffected, firefox53 wontfix, firefox54 fixed, firefox55 fixed)

Details

Attachments

(2 attachments, 1 obsolete attachment)

(Assignee)

Comment 1

2 years ago
https://treeherder.mozilla.org/logviewer.html#?job_id=86693803&repo=autoland&lineNumber=19318

Assertion failure: !mOwningThread (destroying a still-owned lock!), at /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Mutex.h:57

It looks like a memory corruption to me because mOwningThread is initialized to nullptr and never modified again.

http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/xpcom/threads/Mutex.h#49

Hi Nathan,
Do you have any idea about what this assertion is used for?
Flags: needinfo?(nfroyd)
(In reply to JW Wang [:jwwang] [:jw_wang] from comment #1)
> It looks like a memory corruption to me because mOwningThread is initialized
> to nullptr and never modified again.
> 
> http://searchfox.org/mozilla-central/rev/
> 7419b368156a6efa24777b21b0e5706be89a9c2f/xpcom/threads/Mutex.h#49

Sure it's modified:

http://searchfox.org/mozilla-central/source/xpcom/threads/BlockingResourceBase.cpp#383

and several other places in that file.

> Do you have any idea about what this assertion is used for?

Just what it sounds like, ensuring that you don't destroy the mutex while somebody owns the lock.
Flags: needinfo?(nfroyd)
Component: Audio/Video → Audio/Video: Playback
(Assignee)

Comment 3

2 years ago
This still looks like a memory corruption to me:
1. mMutex is always used with MutexAutoLock in the member functions of MediaFormatReader::DemuxerProxy::Wrapper. There is no way for the lock is still held while ~Wrapper() is happening.
2. From the stack trace [2], I can't find any thread that is calling member functions of Wrapper expect Thread 31 which is in the destructor. So there is no way for the lock to be held by any thread.

[1] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/dom/media/MediaFormatReader.cpp#954
[2] https://archive.mozilla.org/pub/firefox/tinderbox-builds/autoland-macosx64-debug/autoland_yosemite_r7-debug_test-mochitest-e10s-browser-chrome-4-bm132-tests1-macosx-build199.txt.gz
Comment hidden (Intermittent Failures Robot)
Comment hidden (mozreview-request)

Comment 6

2 years ago
mozreview-review
Comment on attachment 8854753 [details]
Bug 1351053. P1 - add some assertions to debug who is holding the lock.

https://reviewboard.mozilla.org/r/126728/#review129404
Attachment #8854753 - Flags: review?(jyavenard) → review+
(Assignee)

Comment 7

2 years ago
Thanks!
Keywords: leave-open

Comment 8

2 years ago
Pushed by jwwang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/da84999fd0b2
P1 - add some assertions to debug who is holding the lock. r=jya
(Assignee)

Comment 10

2 years ago
This bug is regressed by bug 1319992.
Assignee: nobody → jwwang
Blocks: 1319992
Keywords: leave-open → regression
Priority: -- → P5
(Assignee)

Updated

2 years ago
Severity: normal → critical
Priority: P5 → P1
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)
(Assignee)

Updated

2 years ago
Attachment #8854753 - Attachment is obsolete: true
(Assignee)

Updated

2 years ago
Attachment #8858206 - Flags: review?(jyavenard)
Attachment #8858207 - Flags: review?(jyavenard)

Comment 13

2 years ago
mozreview-review
Comment on attachment 8858206 [details]
Bug 1351053. P1 - Backed out changeset da84999fd0b2.

https://reviewboard.mozilla.org/r/130156/#review132826
Attachment #8858206 - Flags: review?(jyavenard) → review+

Comment 14

2 years ago
mozreview-review
Comment on attachment 8858207 [details]
Bug 1351053. P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer.

https://reviewboard.mozilla.org/r/130158/#review132828

good catch
Attachment #8858207 - Flags: review?(jyavenard) → review+
(Assignee)

Comment 15

2 years ago
Thanks for the review!

Comment 16

2 years ago
Pushed by jwwang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/712f722c8b3c
P1 - Backed out changeset da84999fd0b2. r=jya
https://hg.mozilla.org/integration/autoland/rev/c557507c83a1
P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer. r=jya
(Assignee)

Updated

2 years ago
Blocks: 1257921
https://hg.mozilla.org/mozilla-central/rev/712f722c8b3c
https://hg.mozilla.org/mozilla-central/rev/c557507c83a1
Status: NEW → RESOLVED
Last Resolved: 2 years ago
status-firefox55: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
(Assignee)

Comment 18

2 years ago
Comment on attachment 8858207 [details]
Bug 1351053. P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer.

Approval Request Comment
[Feature/Bug causing the regression]:1319992
[User impact if declined]:crash
[Is this code covered by automated tests?]:yes
[Has the fix been verified in Nightly?]:yes
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]:none
[Is the change risky?]:low
[Why is the change risky/not risky?]:the change is simple.
[String changes made/needed]:none
Attachment #8858207 - Flags: approval-mozilla-aurora?
Comment on attachment 8858207 [details]
Bug 1351053. P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer.

fix a race, aurora54+
Attachment #8858207 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
status-firefox52: --- → unaffected
status-firefox53: --- → wontfix
status-firefox-esr52: --- → unaffected
You need to log in before you can comment on or make changes to this bug.