Closed Bug 1351053 Opened 3 years ago Closed 3 years ago

Intermittent Main app process exited normally | application crashed [@ mozilla::MediaFormatReader::DemuxerProxy::Wrapper::~Wrapper()]

Categories

(Core :: Audio/Video: Playback, defect, P1, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla55
Tracking Status
firefox52 --- unaffected
firefox-esr52 --- unaffected
firefox53 --- wontfix
firefox54 --- fixed
firefox55 --- fixed

People

(Reporter: intermittent-bug-filer, Assigned: jwwang)

References

(Blocks 1 open bug)

Details

(Keywords: intermittent-failure, regression)

Attachments

(2 files, 1 obsolete file)

https://treeherder.mozilla.org/logviewer.html#?job_id=86693803&repo=autoland&lineNumber=19318

Assertion failure: !mOwningThread (destroying a still-owned lock!), at /home/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Mutex.h:57

It looks like a memory corruption to me because mOwningThread is initialized to nullptr and never modified again.

http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/xpcom/threads/Mutex.h#49

Hi Nathan,
Do you have any idea about what this assertion is used for?
Flags: needinfo?(nfroyd)
(In reply to JW Wang [:jwwang] [:jw_wang] from comment #1)
> It looks like a memory corruption to me because mOwningThread is initialized
> to nullptr and never modified again.
> 
> http://searchfox.org/mozilla-central/rev/
> 7419b368156a6efa24777b21b0e5706be89a9c2f/xpcom/threads/Mutex.h#49

Sure it's modified:

http://searchfox.org/mozilla-central/source/xpcom/threads/BlockingResourceBase.cpp#383

and several other places in that file.

> Do you have any idea about what this assertion is used for?

Just what it sounds like, ensuring that you don't destroy the mutex while somebody owns the lock.
Flags: needinfo?(nfroyd)
Component: Audio/Video → Audio/Video: Playback
This still looks like a memory corruption to me:
1. mMutex is always used with MutexAutoLock in the member functions of MediaFormatReader::DemuxerProxy::Wrapper. There is no way for the lock is still held while ~Wrapper() is happening.
2. From the stack trace [2], I can't find any thread that is calling member functions of Wrapper expect Thread 31 which is in the destructor. So there is no way for the lock to be held by any thread.

[1] http://searchfox.org/mozilla-central/rev/7419b368156a6efa24777b21b0e5706be89a9c2f/dom/media/MediaFormatReader.cpp#954
[2] https://archive.mozilla.org/pub/firefox/tinderbox-builds/autoland-macosx64-debug/autoland_yosemite_r7-debug_test-mochitest-e10s-browser-chrome-4-bm132-tests1-macosx-build199.txt.gz
Comment on attachment 8854753 [details]
Bug 1351053. P1 - add some assertions to debug who is holding the lock.

https://reviewboard.mozilla.org/r/126728/#review129404
Attachment #8854753 - Flags: review?(jyavenard) → review+
Thanks!
Keywords: leave-open
Pushed by jwwang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/da84999fd0b2
P1 - add some assertions to debug who is holding the lock. r=jya
This bug is regressed by bug 1319992.
Assignee: nobody → jwwang
Blocks: 1319992
Keywords: leave-openregression
Priority: -- → P5
Severity: normal → critical
Priority: P5 → P1
Attachment #8854753 - Attachment is obsolete: true
Attachment #8858206 - Flags: review?(jyavenard)
Attachment #8858207 - Flags: review?(jyavenard)
Comment on attachment 8858206 [details]
Bug 1351053. P1 - Backed out changeset da84999fd0b2.

https://reviewboard.mozilla.org/r/130156/#review132826
Attachment #8858206 - Flags: review?(jyavenard) → review+
Comment on attachment 8858207 [details]
Bug 1351053. P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer.

https://reviewboard.mozilla.org/r/130158/#review132828

good catch
Attachment #8858207 - Flags: review?(jyavenard) → review+
Thanks for the review!
Pushed by jwwang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/712f722c8b3c
P1 - Backed out changeset da84999fd0b2. r=jya
https://hg.mozilla.org/integration/autoland/rev/c557507c83a1
P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer. r=jya
Blocks: 1257921
https://hg.mozilla.org/mozilla-central/rev/712f722c8b3c
https://hg.mozilla.org/mozilla-central/rev/c557507c83a1
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla55
Comment on attachment 8858207 [details]
Bug 1351053. P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer.

Approval Request Comment
[Feature/Bug causing the regression]:1319992
[User impact if declined]:crash
[Is this code covered by automated tests?]:yes
[Has the fix been verified in Nightly?]:yes
[Needs manual test from QE? If yes, steps to reproduce]: no
[List of other uplifts needed for the feature/fix]:none
[Is the change risky?]:low
[Why is the change risky/not risky?]:the change is simple.
[String changes made/needed]:none
Attachment #8858207 - Flags: approval-mozilla-aurora?
Comment on attachment 8858207 [details]
Bug 1351053. P2 - fix data race in accessing mAudioDemuxer/mVideoDemuxer.

fix a race, aurora54+
Attachment #8858207 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
You need to log in before you can comment on or make changes to this bug.