Closed Bug 1425904 Opened 2 years ago Closed 2 years ago

Crash in RtlRaiseStatus | RtlpUnWaitCriticalSection | RtlLeaveCriticalSection | <T>::operator() | mozilla::MozPromise<T>::InvokeCallbackMethod<T>

Categories

(Core :: WebRTC: Audio/Video, defect, P1, critical)

59 Branch
Unspecified
Windows 10
defect

Tracking

()

RESOLVED FIXED
mozilla59
Tracking Status
firefox-esr52 --- unaffected
firefox57 --- unaffected
firefox58 --- unaffected
firefox59 --- fixed

People

(Reporter: calixte, Assigned: jya)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, Whiteboard: [clouseau])

Crash Data

Attachments

(1 file)

This bug was filed from the Socorro interface and is
report bp-2be89ba5-f7ce-4ee3-a430-104f70171218.
=============================================================

Top 10 frames of crashing thread:

0 ntdll.dll RtlRaiseStatus 
1 ntdll.dll RtlpUnWaitCriticalSection 
2 ntdll.dll RtlLeaveCriticalSection 
3 xul.dll <lambda_c8dabf1cb80c640a218fff76e1820481>::operator dom/media/systemservices/MediaUtils.h:484
4 xul.dll mozilla::MozPromise<nsTArray<bool>, bool, 1>::InvokeCallbackMethod<0, <lambda_c8dabf1cb80c640a218fff76e1820481>, void const __ptr64, nsTArray<bool>, RefPtr<mozilla::MozPromise<nsTArray<bool>, bool, 1>::Private> > xpcom/threads/MozPromise.h:566
5 xul.dll mozilla::MozPromise<nsTArray<bool>, bool, 1>::ThenValue<<lambda_c8dabf1cb80c640a218fff76e1820481>, <lambda_2173e2def9cfd347573d19d6f205125c> >::DoResolveOrRejectInternal xpcom/threads/MozPromise.h:766
6 xul.dll mozilla::MozPromise<mozilla::ipc::Endpoint<mozilla::extensions::PStreamFilterChild>, mozilla::ipc::ResponseRejectReason, 1>::ThenValueBase::DoResolveOrReject xpcom/threads/MozPromise.h:498
7 xul.dll mozilla::MozPromise<mozilla::dom::U2FRegisterResult, nsresult, 1>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:403
8 xul.dll mozilla::TaskQueue::Runner::Run xpcom/threads/TaskQueue.cpp:243
9 xul.dll nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:228

=============================================================

There are 5 crashes in nightly 59 starting with buildid 20171217220404. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1404997.

[1] https://hg.mozilla.org/mozilla-central/rev/737f227413b7
Flags: needinfo?(jyavenard)
interesting one !!!
Assignee: nobody → jyavenard
Flags: needinfo?(jyavenard)
See Also: → 1426067
Comment on attachment 8937670 [details]
Bug 1425904 - Make the monitor refcounted.

https://reviewboard.mozilla.org/r/208380/#review214128

::: dom/media/systemservices/MediaUtils.h:427
(Diff revision 1)
> + * Await() can *NOT* be called from a task queue/nsISerialEventTarget used for
> + * resolving/rejecting aPromise, otherwise things will deadlock.

It sounds a bit too easy to trigger; any way you could check for that?
Attachment #8937670 - Flags: review?(gsquelart) → review+
Comment on attachment 8937670 [details]
Bug 1425904 - Make the monitor refcounted.

https://reviewboard.mozilla.org/r/208380/#review214128

> It sounds a bit too easy to trigger; any way you could check for that?

with bug 1425092 we could narrow the chance of this happening.

but still, it's almost impossible to know which thread will be used to resolve the promise (like what was passed to InvokeAsync and so forth)...

basically, we don't want to be in the case where Await() is blocked on a thread/taskqueue waiting for a promise to be resolved on that taskqueue, that will never be possible.
Pushed by jyavenard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a99c668ce262
Make the monitor refcounted. r=gerald
Rank: 10
Priority: -- → P1
Crash Signature: [@ RtlRaiseStatus | RtlpUnWaitCriticalSection | RtlLeaveCriticalSection | <T>::operator() | mozilla::MozPromise<T>::InvokeCallbackMethod<T>] → [@ RtlRaiseStatus | RtlpUnWaitCriticalSection | RtlLeaveCriticalSection | <T>::operator() | mozilla::MozPromise<T>::InvokeCallbackMethod<T>] [@ NtSetEvent]
https://hg.mozilla.org/mozilla-central/rev/a99c668ce262
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla59
Crash Signature: [@ RtlRaiseStatus | RtlpUnWaitCriticalSection | RtlLeaveCriticalSection | <T>::operator() | mozilla::MozPromise<T>::InvokeCallbackMethod<T>] [@ NtSetEvent] → [@ RtlRaiseStatus | RtlpUnWaitCriticalSection | RtlLeaveCriticalSection | <T>::operator() | mozilla::MozPromise<T>::InvokeCallbackMethod<T>] [@ NtSetEvent] [@ KiRaiseUserExceptionDispatcher]
that [@ KiRaiseUserExceptionDispatcher ]  signature is way too broad... it includes any crashes really.
You need to log in before you can comment on or make changes to this bug.