Closed Bug 1479218 Opened 2 years ago Closed 2 years ago

Assertion failure: !mRequestDispatched, at src/dom/html/AutoplayPermissionManager.cpp:70

Categories

(Core :: Audio/Video: Playback, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla64
Tracking Status
firefox-esr60 --- unaffected
firefox62 --- unaffected
firefox63 --- fixed
firefox64 --- fixed

People

(Reporter: tsmith, Assigned: alwu)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase.html
I'm guessing this is related to (if not a dup of) bug 1477767

It takes a minute or so to repro and using the attached prefs.js seems to be required.

Reduced using m-c:
BuildID=20180728094641
SourceStamp=0e816b4f580a6ccdae161c80f57f51128b98f021

Assertion failure: !mRequestDispatched, at src/dom/html/AutoplayPermissionManager.cpp:70

#0 mozilla::AutoplayPermissionManager::~AutoplayPermissionManager() src/dom/html/AutoplayPermissionManager.cpp:70:3
#1 mozilla::AutoplayPermissionManager::Release() src/obj-firefox/dist/include/mozilla/AutoplayPermissionManager.h:33:3
#2 nsPIDOMWindowInner::~nsPIDOMWindowInner() src/dom/base/nsGlobalWindowInner.cpp:8234:44
#3 nsGlobalWindowInner::~nsGlobalWindowInner() src/dom/base/nsGlobalWindowInner.cpp:1125:1
#4 nsGlobalWindowInner::~nsGlobalWindowInner() src/dom/base/nsGlobalWindowInner.cpp:1048:1
#5 SnowWhiteKiller::~SnowWhiteKiller() src/xpcom/base/nsCycleCollector.cpp:2736:25
#6 nsCycleCollector::FreeSnowWhite(bool) src/xpcom/base/nsCycleCollector.cpp:2924:3
#7 nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) src/xpcom/base/nsCycleCollector.cpp:3740:5
#8 nsCycleCollector_collectSlice(js::SliceBudget&, bool) src/xpcom/base/nsCycleCollector.cpp:4349:21
#9 nsJSContext::RunCycleCollectorSlice(mozilla::TimeStamp) src/dom/base/nsJSEnvironment.cpp:1566:3
#10 ICCRunnerFired(mozilla::TimeStamp) src/dom/base/nsJSEnvironment.cpp:1625:3
#11 std::_Function_handler<bool (mozilla::TimeStamp), bool (*)(mozilla::TimeStamp)>::_M_invoke(std::_Any_data const&, mozilla::TimeStamp) src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2024:9
#12 std::function<bool (mozilla::TimeStamp)>::operator()(mozilla::TimeStamp) const src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2440:14
#13 mozilla::IdleTaskRunner::Run() src/xpcom/threads/IdleTaskRunner.cpp:63:14
#14 mozilla::TimedOut(nsITimer*, void*) src/xpcom/threads/IdleTaskRunner.cpp:85:13
#15 nsTimerImpl::Fire(int) src/xpcom/threads/nsTimerImpl.cpp:701:7
#16 nsTimerEvent::Run() src/xpcom/threads/TimerThread.cpp:297:11
#17 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1205:14
#18 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#19 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#20 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#21 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#22 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#23 nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290:30
#24 XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4764:22
#25 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4909:8
#26 XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5001:21
#27 do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:233:22
#28 main src/browser/app/nsBrowserApp.cpp:311:16
#29 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#30 _start (firefox+0x423d04)
Flags: in-testsuite?
Attached file prefs.js
Rank: 15
Priority: -- → P2
Hi, Tyson,

I don't understand how do you reproduce this crash? could you explain more details?

I can't even open your testcase.html, it always shows "Locate attachment" page.

Thank you.
Flags: needinfo?(twsmith)
To download the testcase right click the link and click save link as... (do the same from prefs.js).

STR - In a debug build:
0) put attached prefs.js in profile directory (helps with repro)
1) launch the browser
2) open downloaded testcase
3) wait a minute or so
Flags: needinfo?(twsmith)
Hi, Tyson,

Are you still able to reproduce this issue? I was running the testcase on 9/6's m-c [1], and I can't reproduce this issue.

Thank you.

[1] https://hg.mozilla.org/mozilla-central/rev/7569b575ea25
Flags: needinfo?(twsmith)
Assignee: nobody → alwu
The AutoplayPermissionManager might be destroyed before the AutoplayPermissionRequest, so we can't
get the response from request before AutoplayPermissionManager is destroyed.

Therefore, we should manually reject the promise when the inner window is going to be destroyed.
Comment on attachment 9009260 [details]
Bug 1479218 - deny request when inner window is destroyed.

Chris Pearce (:cpearce) has approved the revision.
Attachment #9009260 - Flags: review+
Pushed by alwu@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d706e4a7016f
deny request when inner window is destroyed. r=cpearce
https://hg.mozilla.org/mozilla-central/rev/d706e4a7016f
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Alastor, I see that 3 is marked as affected, can you request an uplift for beta, please? Thanks
Flags: needinfo?(alwu)
Sure, but let's wait for fews day to ensure there is no any regression caused by my patch. 
Keep NI as a reminder.
Is this testcase landable as an automated test?
Flags: needinfo?(twsmith)
No, because I can't reproduce this issue by using that testcase.
Flags: needinfo?(alwu)
uplift reminder.
Flags: needinfo?(alwu)
Comment on attachment 9009260 [details]
Bug 1479218 - deny request when inner window is destroyed.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1463919 
[User impact if declined]: maybe cause some unexpected crash or side effect
[Is this code covered by automated tests?]: No
[Has the fix been verified in Nightly?]: No
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: No
[Is the change risky?]: No
[Why is the change risky/not risky?]: This change is to cancel request early before GC happens.
[String changes made/needed]: No
Flags: needinfo?(alwu)
Attachment #9009260 - Flags: approval-mozilla-beta?
Comment on attachment 9009260 [details]
Bug 1479218 - deny request when inner window is destroyed.

Assertion fix on nightly for several days and no regression reported, uplift approved for 63 beta 9, thanks.
Attachment #9009260 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.