1637837 - ThreadSanitizer: data race /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:1477:58 in mozilla::MediaTrackGraphImpl::ForceShutDown()::Message::Run()

Status: RESOLVED FIXED

(Core :: Audio/Video: MediaStreamGraph, defect, P2)

Description

[Karl Tomlinson (:karlt)]

https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=302076496&repo=autoland&lineNumber=2209

WARNING: ThreadSanitizer: data race (pid=2073)
Write of size 1 at 0x7b50002c7f74 by thread T36 (mutexes: write M34280):
  #0 mozilla::MediaTrackGraphImpl::ForceShutDown()::Message::Run() /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:1477:58 (libxul.so+0x3ce2396)
  #1 mozilla::MediaTrackGraphImpl::RunMessagesInQueue() /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:1156:20 (libxul.so+0x3ccdb57)
  #2 mozilla::MediaTrackGraphImpl::OneIterationImpl(long, long, mozilla::AudioMixer*) /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:1397:3 (libxul.so+0x3ccfae1)
  #3 mozilla::GraphRunner::Run() /builds/worker/checkouts/gecko/dom/media/GraphRunner.cpp:114:32 (libxul.so+0x3b751c4)
  #4 nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1211:14 (libxul.so+0xaf9748)
  #5 NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:501:10 (libxul.so+0xafe142)
  #6 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:302:20 (libxul.so+0x13ac0fe)
  #7 RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:315:10 (libxul.so+0x133b4ec)
  #8 RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:308:3 (libxul.so+0x133b4ec)
  #9 MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:290:3 (libxul.so+0x133b4ec)
  #10 nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:444:10 (libxul.so+0xaf5d65)
  #11 _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5 (libnspr4.so+0x44d8f)
Previous read of size 1 at 0x7b50002c7f74 by main thread:
  [failed to restore the stack]
Location is heap block of size 512 at 0x7b50002c7e00 allocated by main thread:
  #0 malloc /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/tsan/rtl/tsan_interceptors.cc:650:5 (firefox+0x55bf4)
  #1 moz_xmalloc /builds/worker/checkouts/gecko/memory/mozalloc/mozalloc.cpp:52:15 (firefox+0xca768)
  #2 operator new /builds/worker/workspace/obj-build/dist/include/mozilla/cxxalloc.h:33:10 (libxul.so+0x3cd6f74)
  #3 mozilla::MediaTrackGraph::GetInstance(mozilla::MediaTrackGraph::GraphDriverType, nsPIDOMWindowInner*, int, void const*) /builds/worker/checkouts/gecko/dom/media/MediaTrackGraph.cpp:3095:13 (libxul.so+0x3cd6f74)
  #4 mozilla::dom::AudioDestinationNode::AudioDestinationNode(mozilla::dom::AudioContext*, bool, bool, unsigned int, unsigned int) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioDestinationNode.cpp:329:28 (libxul.so+0x3fa33dc)
  #5 mozilla::dom::AudioContext::AudioContext(nsPIDOMWindowInner*, bool, unsigned int, unsigned int, float) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:185:22 (libxul.so+0x3f9c120)
  #6 mozilla::dom::AudioContext::Constructor(mozilla::dom::GlobalObject const&, mozilla::dom::AudioContextOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webaudio/AudioContext.cpp:275:11 (libxul.so+0x3f9d3e2)
  #7 mozilla::dom::AudioContext_Binding::_constructor(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/obj-build/dom/bindings/AudioContextBinding.cpp:845:58 (libxul.so+0x2767a62)
  #8 CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:493:13 (libxul.so+0x65768b5)
  #9 CallJSNativeConstructor /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:509:8 (libxul.so+0x65768b5)
  #10 InternalConstruct(JSContext*, js::AnyConstructArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:711:10 (libxul.so+0x65768b5)
  #11 ConstructFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:738:10 (libxul.so+0x656a089)
  #12 Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3302:16 (libxul.so+0x656a089)
  #13 js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:465:10 (libxul.so+0x655c75f)
  #14 js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:620:13 (libxul.so+0x65756e6)
  #15 InternalCall /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:648:10 (libxul.so+0x657617e)
  #16 js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:665:8 (libxul.so+0x657617e)
  #17 js::jit::InvokeFunction(JSContext*, JS::Handle<JSObject*>, bool, bool, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/VMFunctions.cpp:269:10 (libxul.so+0x6ddbd9d)

Comment 1

[Karl Tomlinson (:karlt)]

The ForceShutDown() call would be more frequent with https://hg.mozilla.org/integration/autoland/rev/d86f066bd68b

The offending read is not identified, but fixing this suspect seems to resolve the problem.

Already disabled on beta and release.

Comment 2

[Karl Tomlinson (:karlt)]

Attachment: Bug 1637837 adjust assert so as not to read mForceShutDown until it is known set r?padenot

mForceShutDownReceived is set on the graph thread and so can be safely read
once the graph has handed control to the main thread.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f30c178a40d5
adjust assert so as not to read mForceShutDown until it is known set r=padenot

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/f30c178a40d5