Closed Bug 1477767 Opened 6 years ago Closed 6 years ago

Assertion failure: Request::mDisconnected, at src/obj-firefox/dist/include/mozilla/MozPromise.h:456

Categories

(Core :: Audio/Video: Playback, defect, P2)

Product:
Core
Component:
Audio/Video: Playback
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla64
Tracking Flags:
Tracking Status
firefox-esr60 --- wontfix
firefox62 --- wontfix
firefox63 --- fixed
firefox64 --- fixed

People

(Reporter: tsmith, Assigned: alwu)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash, testcase)

Attachments

(2 files)

testcase.html
703 bytes, text/html
Details
Bug 1477767 - disconnect request when XPCOM is going to shutdown.
46 bytes, text/x-phabricator-request
cpearce
: review+
pascalc
: approval-mozilla-beta+
Details | Review
Attached file testcase.html — 
Reduced with m-c:
BuildID=20180723154916
SourceStamp=ff3fab43d24dfdaa8971d92cc4caaf4dc9f54dba

I am seeing this crash fairly frequently and I was able to reduce a testcase but I cannot reproduce the crash with only the testcase. I will attach the testcase hoping it helps point to the problem since it is simple.

Assertion failure: Request::mDisconnected, at src/obj-firefox/dist/include/mozilla/MozPromise.h:456

==96522==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f2e111278b1 bp 0x7ffe105d7f00 sp 0x7ffe105d7ef0 T0)
==96522==The signal is caused by a WRITE memory access.
==96522==Hint: address points to the zero page.
    #0 0x7f2e111278b0 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::AssertIsDead() src/obj-firefox/dist/include/mozilla/MozPromise.h:456:9
    #1 0x7f2e11126eaa in ~ResolveOrRejectRunnable src/obj-firefox/dist/include/mozilla/MozPromise.h:404:23
    #2 0x7f2e11126eaa in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() src/obj-firefox/dist/include/mozilla/MozPromise.h:402
    #3 0x7f2e1057a05c in mozilla::CancelableRunnable::Release() src/xpcom/threads/nsThreadUtils.cpp:50:1
    #4 0x7f2e10546c1d in Release src/obj-firefox/dist/include/mozilla/RefPtr.h:42:11
    #5 0x7f2e10546c1d in Release src/obj-firefox/dist/include/mozilla/RefPtr.h:407
    #6 0x7f2e10546c1d in ~RefPtr src/obj-firefox/dist/include/mozilla/RefPtr.h:80
    #7 0x7f2e10546c1d in ~Runner src/xpcom/threads/AbstractThread.cpp:114
    #8 0x7f2e10546c1d in mozilla::EventTargetWrapper::Runner::~Runner() src/xpcom/threads/AbstractThread.cpp:114
    #9 0x7f2e1057a05c in mozilla::CancelableRunnable::Release() src/xpcom/threads/nsThreadUtils.cpp:50:1
    #10 0x7f2e1057b535 in NS_DispatchToCurrentThread(already_AddRefed<nsIRunnable>&&) src/obj-firefox/dist/include/nsCOMPtr.h
    #11 0x7f2e1053ed9c in UnlabeledDispatch src/xpcom/threads/SchedulerGroup.cpp:104:12
    #12 0x7f2e1053ed9c in mozilla::SchedulerGroup::LabeledDispatch(mozilla::TaskCategory, already_AddRefed<nsIRunnable>&&, mozilla::dom::DocGroup*) src/xpcom/threads/SchedulerGroup.cpp:248
    #13 0x7f2e1054c040 in (anonymous namespace)::SchedulerEventTarget::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) src/xpcom/threads/SchedulerGroup.cpp:77:23
    #14 0x7f2e11126019 in mozilla::MozPromise<bool, nsresult, false>::DispatchAll() src/obj-firefox/dist/include/mozilla/MozPromise.h:1047:18
    #15 0x7f2e11125d9e in void mozilla::MozPromise<bool, nsresult, false>::Private::Reject<nsresult const&>(nsresult const&, char const*) src/obj-firefox/dist/include/mozilla/MozPromise.h:1142:5
    #16 0x7f2e166f1307 in Reject src/obj-firefox/dist/include/mozilla/MozPromise.h:1262:15
    #17 0x7f2e166f1307 in RejectIfExists src/obj-firefox/dist/include/mozilla/MozPromise.h:1280
    #18 0x7f2e166f1307 in mozilla::AutoplayPermissionManager::DenyPlayRequest() src/dom/html/AutoplayPermissionManager.cpp:78
    #19 0x7f2e166f2121 in mozilla::AutoplayPermissionRequest::Cancel() src/dom/html/AutoplayPermissionRequest.cpp:98:15
    #20 0x7f2e166f1d8e in mozilla::AutoplayPermissionRequest::~AutoplayPermissionRequest() src/dom/html/AutoplayPermissionRequest.cpp:37:3
    #21 0x7f2e166f1a01 in mozilla::AutoplayPermissionRequest::Release() src/dom/html/AutoplayPermissionRequest.cpp:19:1
    #22 0x7f2e103d62ac in ~nsCOMPtr_base src/xpcom/base/nsCOMPtr.h:313:7
    #23 0x7f2e103d62ac in ~SegmentImpl src/obj-firefox/dist/include/mozilla/SegmentedVector.h:76
    #24 0x7f2e103d62ac in mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) src/obj-firefox/dist/include/mozilla/SegmentedVector.h:253
    #25 0x7f2e103bd97b in mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:2891:15
    #26 0x7f2e103be934 in mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) src/xpcom/base/CycleCollectedJSRuntime.cpp:1391:17
    #27 0x7f2e103bf320 in mozilla::CycleCollectedJSRuntime::FinalizeDeferredThings(mozilla::CycleCollectedJSContext::DeferredFinalizeType) src/xpcom/base/CycleCollectedJSRuntime.cpp:1464:24
    #28 0x7f2e103ba136 in mozilla::CycleCollectedJSRuntime::OnGC(JSContext*, JSGCStatus) src/xpcom/base/CycleCollectedJSRuntime.cpp:1510:7
    #29 0x7f2e1d9780dc in callGCCallback src/js/src/gc/GC.cpp:1782:5
    #30 0x7f2e1d9780dc in js::gc::GCRuntime::maybeCallGCCallback(JSGCStatus) src/js/src/gc/GC.cpp:7430
    #31 0x7f2e1d978c3e in ~AutoCallGCCallbacks src/js/src/gc/GC.cpp:7409:13
    #32 0x7f2e1d978c3e in js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) src/js/src/gc/GC.cpp:7518
    #33 0x7f2e1d97c42e in js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) src/js/src/gc/GC.cpp:7680:41
    #34 0x7f2e1d989427 in gc src/js/src/gc/GC.cpp:7755:5
    #35 0x7f2e1d989427 in JS::NonIncrementalGC(JSContext*, JSGCInvocationKind, JS::gcreason::Reason) src/js/src/gc/GC.cpp:8604
    #36 0x7f2e103ed949 in nsCycleCollector::FixGrayBits(bool, TimeLog&) src/xpcom/base/nsCycleCollector.cpp:3614:19
    #37 0x7f2e103ef194 in nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) src/xpcom/base/nsCycleCollector.cpp:3929:3
    #38 0x7f2e103ee7c4 in nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) src/xpcom/base/nsCycleCollector.cpp:3755:9
    #39 0x7f2e103ee144 in nsCycleCollector::ShutdownCollect() src/xpcom/base/nsCycleCollector.cpp:3696:10
    #40 0x7f2e103f0567 in nsCycleCollector::Shutdown(bool) src/xpcom/base/nsCycleCollector.cpp:3999:5
    #41 0x7f2e103f36ff in nsCycleCollector_shutdown(bool) src/xpcom/base/nsCycleCollector.cpp:4386:23
    #42 0x7f2e105c8a7d in mozilla::ShutdownXPCOM(nsIServiceManager*) src/xpcom/build/XPCOMInit.cpp:1010:3
    #43 0x7f2e1be129a9 in ScopedXPCOMStartup::~ScopedXPCOMStartup() src/toolkit/xre/nsAppRunner.cpp:1404:5
    #44 0x7f2e1be2c604 in operator() src/obj-firefox/dist/include/mozilla/UniquePtr.h:528:5
    #45 0x7f2e1be2c604 in reset src/obj-firefox/dist/include/mozilla/UniquePtr.h:343
    #46 0x7f2e1be2c604 in operator= src/obj-firefox/dist/include/mozilla/UniquePtr.h:313
    #47 0x7f2e1be2c604 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4934
    #48 0x7f2e1be2d9d8 in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4998:21
    #49 0x4f209c in do_main src/browser/app/nsBrowserApp.cpp:233:22
    #50 0x4f209c in main src/browser/app/nsBrowserApp.cpp:311
    #51 0x7f2e2faed82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #52 0x4216b8 in _start (firefox+0x4216b8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV src/obj-firefox/dist/include/mozilla/MozPromise.h:456:9 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::AssertIsDead()
==96522==ABORTING
Flags: in-testsuite?
Component: DOM → Audio/Video
Flags: needinfo?(cpearce)
I can't repro locally. Does the patch in Bug 1477881 help prevent this?
Flags: needinfo?(cpearce) → needinfo?(twsmith)
Rank: 12
Priority: -- → P2
Component: Audio/Video → Audio/Video: Playback
See Also: → 1478523
See Also: 1478523 → 
Yes, the fuzzers are still hitting it on m-c version 20180727-87bcafe428a4.

#0 mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::AssertIsDead() src/obj-firefox/dist/include/mozilla/MozPromise.h:456:9
#1 ~ResolveOrRejectRunnable src/obj-firefox/dist/include/mozilla/MozPromise.h:404:23
#2 mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() src/obj-firefox/dist/include/mozilla/MozPromise.h:402
#3 Release src/xpcom/threads/nsThreadUtils.cpp:50:1
#4 mozilla::CancelableRunnable::Release() src/xpcom/threads/nsThreadUtils.cpp:74
#5 Release src/obj-firefox/dist/include/mozilla/RefPtr.h:42:11
#6 Release src/obj-firefox/dist/include/mozilla/RefPtr.h:407
#7 ~RefPtr src/obj-firefox/dist/include/mozilla/RefPtr.h:80
#8 ~Runner src/xpcom/threads/AbstractThread.cpp:114
#9 mozilla::EventTargetWrapper::Runner::~Runner() src/xpcom/threads/AbstractThread.cpp:114
#10 Release src/xpcom/threads/nsThreadUtils.cpp:50:1
#11 mozilla::CancelableRunnable::Release() src/xpcom/threads/nsThreadUtils.cpp:74
#12 ~nsCOMPtr_base src/obj-firefox/dist/include/nsCOMPtr.h:313:7
#13 NS_DispatchToCurrentThread(already_AddRefed<nsIRunnable>&&) src/xpcom/threads/nsThreadUtils.cpp:237
#14 UnlabeledDispatch src/xpcom/threads/SchedulerGroup.cpp:104:12
#15 mozilla::SchedulerGroup::LabeledDispatch(mozilla::TaskCategory, already_AddRefed<nsIRunnable>&&, mozilla::dom::DocGroup*) src/xpcom/threads/SchedulerGroup.cpp:248
#16 (anonymous namespace)::SchedulerEventTarget::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) src/xpcom/threads/SchedulerGroup.cpp:77:23
#17 mozilla::MozPromise<bool, nsresult, false>::DispatchAll() src/obj-firefox/dist/include/mozilla/MozPromise.h:1047:18
#18 void mozilla::MozPromise<bool, nsresult, false>::Private::Reject<nsresult const&>(nsresult const&, char const*) src/obj-firefox/dist/include/mozilla/MozPromise.h:1142:5
#19 Reject src/obj-firefox/dist/include/mozilla/MozPromise.h:1262:15
#20 RejectIfExists src/obj-firefox/dist/include/mozilla/MozPromise.h:1280
#21 mozilla::AutoplayPermissionManager::DenyPlayRequest() src/dom/html/AutoplayPermissionManager.cpp:78
#22 mozilla::AutoplayPermissionRequest::Cancel() src/dom/html/AutoplayPermissionRequest.cpp:98:15
#23 mozilla::AutoplayPermissionRequest::~AutoplayPermissionRequest() src/dom/html/AutoplayPermissionRequest.cpp:37:3
#24 mozilla::AutoplayPermissionRequest::Release() src/dom/html/AutoplayPermissionRequest.cpp:19:1
#25 ~nsCOMPtr_base src/xpcom/base/nsCOMPtr.h:313:7
#26 ~SegmentImpl src/obj-firefox/dist/include/mozilla/SegmentedVector.h:76
#27 mozilla::SegmentedVector<nsCOMPtr<nsISupports>, 4096ul, mozilla::MallocAllocPolicy>::PopLastN(unsigned int) src/obj-firefox/dist/include/mozilla/SegmentedVector.h:253
#28 mozilla::dom::DeferredFinalizerImpl<nsISupports>::DeferredFinalize(unsigned int, void*) src/obj-firefox/dist/include/mozilla/dom/BindingUtils.h:2899:15
#29 mozilla::IncrementalFinalizeRunnable::ReleaseNow(bool) src/xpcom/base/CycleCollectedJSRuntime.cpp:1413:17
#30 mozilla::CycleCollectedJSRuntime::FinalizeDeferredThings(mozilla::CycleCollectedJSContext::DeferredFinalizeType) src/xpcom/base/CycleCollectedJSRuntime.cpp:1486:24
#31 mozilla::CycleCollectedJSRuntime::OnGC(JSContext*, JSGCStatus) src/xpcom/base/CycleCollectedJSRuntime.cpp:1537:9
#32 callGCCallback src/js/src/gc/GC.cpp:1783:5
#33 js::gc::GCRuntime::maybeCallGCCallback(JSGCStatus) src/js/src/gc/GC.cpp:7443
#34 ~AutoCallGCCallbacks src/js/src/gc/GC.cpp:7422:13
#35 js::gc::GCRuntime::gcCycle(bool, js::SliceBudget&, JS::gcreason::Reason) src/js/src/gc/GC.cpp:7531
#36 js::gc::GCRuntime::collect(bool, js::SliceBudget, JS::gcreason::Reason) src/js/src/gc/GC.cpp:7693:41
#37 gc src/js/src/gc/GC.cpp:7772:5
#38 JS::NonIncrementalGC(JSContext*, JSGCInvocationKind, JS::gcreason::Reason) src/js/src/gc/GC.cpp:8621
#39 nsCycleCollector::FixGrayBits(bool, TimeLog&) src/xpcom/base/nsCycleCollector.cpp:3614:19
#40 nsCycleCollector::BeginCollection(ccType, nsICycleCollectorListener*) src/xpcom/base/nsCycleCollector.cpp:3929:3
#41 nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) src/xpcom/base/nsCycleCollector.cpp:3755:9
#42 nsCycleCollector::ShutdownCollect() src/xpcom/base/nsCycleCollector.cpp:3696:10
#43 nsCycleCollector::Shutdown(bool) src/xpcom/base/nsCycleCollector.cpp:4005:5
#44 nsCycleCollector_shutdown(bool) src/xpcom/base/nsCycleCollector.cpp:4392:23
#45 mozilla::ShutdownXPCOM(nsIServiceManager*) src/xpcom/build/XPCOMInit.cpp:1010:3
#46 ScopedXPCOMStartup::~ScopedXPCOMStartup() src/toolkit/xre/nsAppRunner.cpp:1406:5
#47 operator() src/obj-firefox/dist/include/mozilla/UniquePtr.h:528:5
#48 reset src/obj-firefox/dist/include/mozilla/UniquePtr.h:343
#49 operator= src/obj-firefox/dist/include/mozilla/UniquePtr.h:313
#50 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4937
#51 XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5001:21
#52 do_main src/browser/app/nsBrowserApp.cpp:233:22
#53 main src/browser/app/nsBrowserApp.cpp:311
#54 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#55 _start (firefox+0x424e7c)
Flags: needinfo?(twsmith)
See Also: → 1479218
Assignee: nobody → alwu
The reason we hit this assertion is that we still connected to Then() and waited for its result when the resolve or reject
runnable which dispatched by ThenValue can't be executed because the target thread had been shutdown.

Therefore, when XPCOM is going to shutdown, we should disconnect the Then() because it might not have a chance to execute
its resolve/reject method.
Comment on attachment 9009216 [details]
Bug 1477767 - disconnect request when XPCOM is going to shutdown.

Chris Pearce (:cpearce) has approved the revision.
Attachment #9009216 - Flags: review+
Pushed by alwu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/02bd8c7d626e
disconnect request when XPCOM is going to shutdown. r=cpearce
https://hg.mozilla.org/mozilla-central/rev/02bd8c7d626e
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox64: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Alastor, 63 is marked as affected, could you uplift your patch to beta? Thanks
Flags: needinfo?(alwu)
Sure, but let's wait for fews day to ensure there is no any regression caused by my patch. 
Keep NI as a reminder.
Should we land this testcase as a crashtest also?
status-firefox62: --- → wontfix
status-firefox-esr60: --- → wontfix
No, because I can't reproduce this issue with that testcase.
Comment on attachment 9009216 [details]
Bug 1477767 - disconnect request when XPCOM is going to shutdown.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1463919 
[User impact if declined]: maybe cause some unexpected crash or side effect
[Is this code covered by automated tests?]: No
[Has the fix been verified in Nightly?]: No
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: No
[Is the change risky?]: No
[Why is the change risky/not risky?]: This change is to disconnect promise holder before shutdown, it doesn't introduce any new behavior.
[String changes made/needed]: No
Flags: needinfo?(alwu)
Attachment #9009216 - Flags: approval-mozilla-beta?
Comment on attachment 9009216 [details]
Bug 1477767 - disconnect request when XPCOM is going to shutdown.

Minimal patch fixing a well defined bug and a potential crasher, uplift approved for 63 beta 9, thanks.
Attachment #9009216 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: