1675061 - Crash Report [@ mozilla::MozPromise<T>::Private::Reject<T> ] in RemVidChild

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P3)

Description

[Alastor Wu [:alwu]]

https://crash-stats.mozilla.org/report/index/dee23b9d-450b-449f-893b-94b0a0201101#tab-details

0 	xul.dll 	mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaResult, 1>::Private::Reject<const mozilla::MediaResult&>(mozilla::MediaResult const&, char const*) 	xpcom/threads/MozPromise.h:1145 	context
1 	xul.dll 	std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderChild.cpp:90:26', void, const mozilla::MediaResult&>::_Do_call(mozilla::MediaResult const&) 		cfi
2 	xul.dll 	mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderChild.cpp:34:9'>::Run() 	xpcom/threads/nsThreadUtils.h:577 	cfi
3 	xul.dll 	static mozilla::RemoteDecoderManagerChild::OpenForGPUProcess(mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild>&&) 	dom/media/ipc/RemoteDecoderManagerChild.cpp:229 	cfi
4 	xul.dll 	RunnableFunction<void (*)(RefPtr<mozilla::Runnable>&&), mozilla::Tuple<RefPtr<mozilla::Runnable> > >::Run() 	ipc/chromium/src/base/task.h:324 	cfi
5 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1197 	cfi
6 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)

Comment 1

[Alastor Wu [:alwu]]

In this crash, when I checked its minidump, the rejected value in promise is NS_ERROR_DOM_MEDIA_NEED_NEW_DECODER which seems coming from [1] and this of the promise is null already. So I wonder if the RemoteDecoderChild has been freed at that time.

Jya, do you have any thought about this?

[1] https://searchfox.org/mozilla-central/rev/e75e8e5b980ef18f4596a783fbc8a36621de7d1e/dom/media/ipc/RemoteDecoderChild.cpp#40

Comment 2

[Matt Woodrow (:mattwoodrow)]

As per this [1] comment, the init promise can get shutdown and rejected while still pending.

Given that, the rejection when we fail [2] to init probably needs to be RejectIfExists, or we'll deref the nullptr promise within the MozPromiseHolder.

[1] https://searchfox.org/mozilla-central/rev/c938c7416c633639a5c8ce4412be586eefb48005/dom/media/ipc/RemoteDecoderChild.cpp#217
[2] https://searchfox.org/mozilla-central/rev/c938c7416c633639a5c8ce4412be586eefb48005/dom/media/ipc/RemoteDecoderChild.cpp#100

Comment 3

[Jean-Yves Avenard [:jya]]

I concur.

Comment 4

[Alastor Wu [:alwu]]

Those crashes which happened on Windows are related with RemoteDecoderManagerChild.

Comment 5

[Jean-Yves Avenard [:jya]]

Attachment: Bug 1675061 - Only reject promise if it hasn't already. r?alwu

With a GPU remote decoder, the rejection code will only run once the GPU process has been been restarted. It is possible that once this happens, that Shutdown has been called before which would have rejected any pending promise.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5a7f870b6db0
Only reject promise if it hasn't already. r=alwu

Comment 7

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/5a7f870b6db0