1618444 - Crash in EnsureNextIteration() from SourceMediaTrack::AppendData() due to race with MediaTrackGraphShutDownRunnable

Status: RESOLVED FIXED

(Core :: Audio/Video: MediaStreamGraph, defect, P2)

Description

[Karl Tomlinson (:karlt)]

This was caught with ./mach mochitest --keep-open=false --debugger=rr dom/media/tests/mochitest/test_getUserMedia_audioCapture.html
https://pernos.co/debug/TBL9mENXKG17AXYB84fcLA/index.html

I did have some patches for bug 1596655 applied, but I'm not aware of contributing effects from them.

Graph shutdown is apparently triggered on "xpcom-will-shutdown", which leads to clearing of mDriver on the main thread.

SourceMediaTrack::AppendData(), called on the MediaDecoderStateMachine thread, acquires the track mutex and checks for GraphImpl() as well as mUpdateTrack->mEnded.

It then acquires the graph mutex and calls graph->EnsureNextIteration(), which crashes on null mDriver.

Comment 1

[Karl Tomlinson (:karlt)]

This is probably triggered by https://hg.mozilla.org/integration/autoland/rev/2523464caf47#l4.36
because previously mGraphDriverAsleep would have been false when the graph driver handed control from graph thread to main thread.

It doesn't affect release builds because their content processes don't go through XPCOM shutdown.

Comment 2

[Karl Tomlinson (:karlt)]

I first looked into calling End() from SourceMediaTrack::NotifyForcedShutdown(), but I don't know that we can rule out a new SourceMediaTrack being added after those calls.

Comment 3

[Karl Tomlinson (:karlt)]

Attachment: Bug 1618444 don't EnsureNextIteration() in AppendData() after forced shutdown r?padenot

The driver can be safely checked and used with the monitor held, because the
driver is changed only while the monitor is held.

Comment 4

[Karl Tomlinson (:karlt)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7b8c02c92fc72bf47567caf5701b560e3a2d0312&selectedJob=290892813

Comment 5

[Karl Tomlinson (:karlt)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=7b8c02c92fc72bf47567caf5701b560e3a2d0312

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fccd2c39ce30
don't EnsureNextIteration() in AppendData() after forced shutdown r=padenot

Comment 7

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/fccd2c39ce30