1479218 - Assertion failure: !mRequestDispatched, at src/dom/html/AutoplayPermissionManager.cpp:70

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith] (PTO)]

Attachment: testcase.html

I'm guessing this is related to (if not a dup of) bug 1477767

It takes a minute or so to repro and using the attached prefs.js seems to be required.

Reduced using m-c:
BuildID=20180728094641
SourceStamp=0e816b4f580a6ccdae161c80f57f51128b98f021

Assertion failure: !mRequestDispatched, at src/dom/html/AutoplayPermissionManager.cpp:70

#0 mozilla::AutoplayPermissionManager::~AutoplayPermissionManager() src/dom/html/AutoplayPermissionManager.cpp:70:3
#1 mozilla::AutoplayPermissionManager::Release() src/obj-firefox/dist/include/mozilla/AutoplayPermissionManager.h:33:3
#2 nsPIDOMWindowInner::~nsPIDOMWindowInner() src/dom/base/nsGlobalWindowInner.cpp:8234:44
#3 nsGlobalWindowInner::~nsGlobalWindowInner() src/dom/base/nsGlobalWindowInner.cpp:1125:1
#4 nsGlobalWindowInner::~nsGlobalWindowInner() src/dom/base/nsGlobalWindowInner.cpp:1048:1
#5 SnowWhiteKiller::~SnowWhiteKiller() src/xpcom/base/nsCycleCollector.cpp:2736:25
#6 nsCycleCollector::FreeSnowWhite(bool) src/xpcom/base/nsCycleCollector.cpp:2924:3
#7 nsCycleCollector::Collect(ccType, js::SliceBudget&, nsICycleCollectorListener*, bool) src/xpcom/base/nsCycleCollector.cpp:3740:5
#8 nsCycleCollector_collectSlice(js::SliceBudget&, bool) src/xpcom/base/nsCycleCollector.cpp:4349:21
#9 nsJSContext::RunCycleCollectorSlice(mozilla::TimeStamp) src/dom/base/nsJSEnvironment.cpp:1566:3
#10 ICCRunnerFired(mozilla::TimeStamp) src/dom/base/nsJSEnvironment.cpp:1625:3
#11 std::_Function_handler<bool (mozilla::TimeStamp), bool (*)(mozilla::TimeStamp)>::_M_invoke(std::_Any_data const&, mozilla::TimeStamp) src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2024:9
#12 std::function<bool (mozilla::TimeStamp)>::operator()(mozilla::TimeStamp) const src/clang/bin/../lib/gcc/x86_64-unknown-linux-gnu/4.9.4/../../../../include/c++/4.9.4/functional:2440:14
#13 mozilla::IdleTaskRunner::Run() src/xpcom/threads/IdleTaskRunner.cpp:63:14
#14 mozilla::TimedOut(nsITimer*, void*) src/xpcom/threads/IdleTaskRunner.cpp:85:13
#15 nsTimerImpl::Fire(int) src/xpcom/threads/nsTimerImpl.cpp:701:7
#16 nsTimerEvent::Run() src/xpcom/threads/TimerThread.cpp:297:11
#17 nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1205:14
#18 NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#19 mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:97:21
#20 MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:325:10
#21 MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298:3
#22 nsBaseAppShell::Run() src/widget/nsBaseAppShell.cpp:158:27
#23 nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290:30
#24 XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:4764:22
#25 XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:4909:8
#26 XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5001:21
#27 do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:233:22
#28 main src/browser/app/nsBrowserApp.cpp:311:16
#29 __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#30 _start (firefox+0x423d04)

Comment 1

[Tyson Smith [:tsmith] (PTO)]

Attachment: prefs.js

Comment 2

[Alastor Wu [:alwu]]

Hi, Tyson,

I don't understand how do you reproduce this crash? could you explain more details?

I can't even open your testcase.html, it always shows "Locate attachment" page.

Thank you.

Comment 3

[Tyson Smith [:tsmith] (PTO)]

To download the testcase right click the link and click save link as... (do the same from prefs.js).

STR - In a debug build:
0) put attached prefs.js in profile directory (helps with repro)
1) launch the browser
2) open downloaded testcase
3) wait a minute or so

Comment 4

[Alastor Wu [:alwu]]

Hi, Tyson,

Are you still able to reproduce this issue? I was running the testcase on 9/6's m-c [1], and I can't reproduce this issue.

Thank you.

[1] https://hg.mozilla.org/mozilla-central/rev/7569b575ea25

Comment 5

[Alastor Wu [:alwu]]

Attachment: Bug 1479218 - deny request when inner window is destroyed.

The AutoplayPermissionManager might be destroyed before the AutoplayPermissionRequest, so we can't
get the response from request before AutoplayPermissionManager is destroyed.

Therefore, we should manually reject the promise when the inner window is going to be destroyed.

Comment 6

[Chris Pearce [:cpearce (Not reading bugmail)]]

Comment on attachment 9009260 [details]
Bug 1479218 - deny request when inner window is destroyed.

Chris Pearce (:cpearce) has approved the revision.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d706e4a7016f
deny request when inner window is destroyed. r=cpearce

Comment 8

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/d706e4a7016f

Comment 9

[Pascal Chevrel:pascalc]

Alastor, I see that 3 is marked as affected, can you request an uplift for beta, please? Thanks

Comment 10

[Alastor Wu [:alwu]]

Sure, but let's wait for fews day to ensure there is no any regression caused by my patch. 
Keep NI as a reminder.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Is this testcase landable as an automated test?

Comment 12

[Alastor Wu [:alwu]]

No, because I can't reproduce this issue by using that testcase.

Comment 13

[Alastor Wu [:alwu]]

uplift reminder.

Comment 14

[Alastor Wu [:alwu]]

Comment on attachment 9009260 [details]
Bug 1479218 - deny request when inner window is destroyed.

Approval Request Comment
[Feature/Bug causing the regression]: Bug 1463919 
[User impact if declined]: maybe cause some unexpected crash or side effect
[Is this code covered by automated tests?]: No
[Has the fix been verified in Nightly?]: No
[Needs manual test from QE? If yes, steps to reproduce]: No
[List of other uplifts needed for the feature/fix]: No
[Is the change risky?]: No
[Why is the change risky/not risky?]: This change is to cancel request early before GC happens.
[String changes made/needed]: No

Comment 15

[Pascal Chevrel:pascalc]

Comment on attachment 9009260 [details]
Bug 1479218 - deny request when inner window is destroyed.

Assertion fix on nightly for several days and no regression reported, uplift approved for 63 beta 9, thanks.

Comment 16

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/releases/mozilla-beta/rev/d0e8aadd8323