1540434 - Crash in [@ mozilla::GetUserMediaWindowListener::Remove]

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect, P2)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-21f24066-8c6c-46e1-9ec1-597480190330.

Top 10 frames of crashing thread:

0 XUL mozilla::GetUserMediaWindowListener::Remove mfbt/RefPtr.h:267
1 XUL mozilla::SourceListener::Stop dom/media/MediaManager.cpp:4249
2 XUL void mozilla::MediaManager::IterateWindowListeners<mozilla::MediaManager::OnDeviceChange dom/media/MediaManager.cpp:4635
3 XUL mozilla::MozPromise<bool, RefPtr<mozilla::MediaMgrError>, true>::ThenValue<mozilla::MediaManager::OnDeviceChange dom/media/MediaManager.cpp:2219
4 XUL mozilla::MozPromise<bool, RefPtr<mozilla::MediaMgrError>, true>::ThenValueBase::ResolveOrRejectRunnable::Run xpcom/threads/MozPromise.h:392
5 XUL nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1180
6 XUL NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:482
7 XUL mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:110
8 XUL nsBaseAppShell::Run ipc/chromium/src/base/message_loop.cc:315
9 XUL nsAppShell::Run widget/cocoa/nsAppShell.mm:702

There are 2 crashes (from 1 installation) in nightly 68 with buildid 20190330093331. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1494675.

[1] https://hg.mozilla.org/mozilla-central/rev?node=be0fbe76851f

Comment 1

[Marcia Knous [:marcia]]

Adjusting platform since this affects all three. In the last 7 days we have 18 crashes, 16 installs. Here are a few URLs:

• https://www.onlinemictest.com/webcam-test/
• https://webcammictest.com/check-microphone.html
• https://www.webrtc-experiment.com/getDisplayMedia/

Comment 2

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1540434 - Convert a bunch of rawptrs related to MediaManager to RefPtr. r?jib

We see a crash due to a local rawptr that's we remove from an nsRefPtrHashTable.
As that removal also removed the last reference to the object, the local rawptr
now points to a destroyed object. Forcing the method in question to take a
RefPtr instead of a rawptr solves this issue. I'm also converting other similar
rawptrs for good measure.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/904d371bd450
Convert a bunch of rawptrs related to MediaManager to RefPtr. r=jib

Comment 4

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/904d371bd450