Closed Bug 1675061 Opened 4 years ago Closed 4 years ago

Crash Report [@ mozilla::MozPromise<T>::Private::Reject<T> ] in RemVidChild

Categories

(Core :: Audio/Video: Playback, defect, P3)

defect

Tracking

()

RESOLVED FIXED
84 Branch
Tracking Status
firefox84 --- fixed

People

(Reporter: alwu, Assigned: jya)

Details

Crash Data

Attachments

(1 file)

https://crash-stats.mozilla.org/report/index/dee23b9d-450b-449f-893b-94b0a0201101#tab-details

0 	xul.dll 	mozilla::MozPromise<mozilla::TrackInfo::TrackType, mozilla::MediaResult, 1>::Private::Reject<const mozilla::MediaResult&>(mozilla::MediaResult const&, char const*) 	xpcom/threads/MozPromise.h:1145 	context
1 	xul.dll 	std::_Func_impl_no_alloc<`lambda at /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderChild.cpp:90:26', void, const mozilla::MediaResult&>::_Do_call(mozilla::MediaResult const&) 		cfi
2 	xul.dll 	mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/dom/media/ipc/RemoteDecoderChild.cpp:34:9'>::Run() 	xpcom/threads/nsThreadUtils.h:577 	cfi
3 	xul.dll 	static mozilla::RemoteDecoderManagerChild::OpenForGPUProcess(mozilla::ipc::Endpoint<mozilla::PRemoteDecoderManagerChild>&&) 	dom/media/ipc/RemoteDecoderManagerChild.cpp:229 	cfi
4 	xul.dll 	RunnableFunction<void (*)(RefPtr<mozilla::Runnable>&&), mozilla::Tuple<RefPtr<mozilla::Runnable> > >::Run() 	ipc/chromium/src/base/task.h:324 	cfi
5 	xul.dll 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1197 	cfi
6 	xul.dll 	mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)

In this crash, when I checked its minidump, the rejected value in promise is NS_ERROR_DOM_MEDIA_NEED_NEW_DECODER which seems coming from [1] and this of the promise is null already. So I wonder if the RemoteDecoderChild has been freed at that time.

Jya, do you have any thought about this?

[1] https://searchfox.org/mozilla-central/rev/e75e8e5b980ef18f4596a783fbc8a36621de7d1e/dom/media/ipc/RemoteDecoderChild.cpp#40

Flags: needinfo?(jyavenard)

As per this [1] comment, the init promise can get shutdown and rejected while still pending.

Given that, the rejection when we fail [2] to init probably needs to be RejectIfExists, or we'll deref the nullptr promise within the MozPromiseHolder.

[1] https://searchfox.org/mozilla-central/rev/c938c7416c633639a5c8ce4412be586eefb48005/dom/media/ipc/RemoteDecoderChild.cpp#217
[2] https://searchfox.org/mozilla-central/rev/c938c7416c633639a5c8ce4412be586eefb48005/dom/media/ipc/RemoteDecoderChild.cpp#100

I concur.

Flags: needinfo?(jyavenard)

Those crashes which happened on Windows are related with RemoteDecoderManagerChild.

Crash Signature: mozilla::MozPromise<T>::Private::Reject<T>
Crash Signature: mozilla::MozPromise<T>::Private::Reject<T> → [@ mozilla::MozPromise<T>::Private::Reject<T>]
Crash Signature: [@ mozilla::MozPromise<T>::Private::Reject<T>] → [@ mozilla::MozPromise<T>::Private::Reject<T>] [@ RtlAcquireSRWLockExclusive | mozilla::detail::MutexImpl::lock | mozilla::MozPromise<T>::Private::Reject<T>] [@ RtlAcquireSRWLockExclusive | mozilla::detail::MutexImpl::MutexImpl | mozilla::MozPromiseHold…
Severity: S3 → S2
Assignee: nobody → jyavenard

With a GPU remote decoder, the rejection code will only run once the GPU process has been been restarted. It is possible that once this happens, that Shutdown has been called before which would have rejected any pending promise.

Pushed by jyavenard@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5a7f870b6db0
Only reject promise if it hasn't already. r=alwu
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 84 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: