1676409 - Crash in [@ mozilla::MozPromise<T>::ThenValueBase::AssertIsDead]

Status: RESOLVED FIXED

(Core :: Printing: Output, defect, P2)

Description

[Catalin Sasca, Desktop QA [:csasca]]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/302024aa-ca97-43a1-8bfb-dc4f40201110

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(Request::mDisconnected)

Top 10 frames of crashing thread:

0 xul.dll mozilla::MozPromise<CopyableTArray<bool>, bool, 0>::ThenValueBase::AssertIsDead xpcom/threads/MozPromise.h:447
1 xul.dll mozilla::MozPromise<long long, mozilla::dom::IOUtils::IOError, 1>::AssertIsDead xpcom/threads/MozPromise.h:1036
2 xul.dll mozilla::MozPromise<nsRefPtrHashtable<nsUint64HashKey, mozilla::gfx::RecordedDependentSurface>, nsresult, 1>::~MozPromise xpcom/threads/MozPromise.h:1077
3 xul.dll mozilla::MozPromise<nsRefPtrHashtable<nsUint64HashKey, mozilla::gfx::RecordedDependentSurface>, nsresult, 1>::Private::~Private xpcom/threads/MozPromise.h:1075
4 xul.dll mozilla::layout::RemotePrintJobParent::RecvProcessPage layout/printing/ipc/RemotePrintJobParent.cpp:130
5 xul.dll mozilla::layout::PRemotePrintJobParent::OnMessageReceived ipc/ipdl/PRemotePrintJobParent.cpp:295
6 xul.dll mozilla::dom::PContentParent::OnMessageReceived ipc/ipdl/PContentParent.cpp:6606
7 xul.dll mozilla::ipc::MessageChannel::DispatchMessage ipc/glue/MessageChannel.cpp:2074
8 xul.dll mozilla::ipc::MessageChannel::MessageTask::Run ipc/glue/MessageChannel.cpp:1953
9 xul.dll mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:720

Preconditions

• Have Fission and Webrender active

STR

1. Launch Firefox
2. Access main page for AOL.com
3. Print preview the page, select the settings for the printer
4. Click Print

Notes

• After selecting print (wireless printing), I just got this crash report.
• Model of printer: HP OfficeJet 6500 E710n-z, Windows 7 and 84.0a1 (2020-11-10)

Comment 1

[Sean Voisen (:svoisen)]

Setting to S3 given volume and that it's Fission-only. But will need to investigate, so putting this on the Fission M7 milestone for now.

Comment 2

[Nika Layzell [:nika] (ni? for response)]

It sounds like a promise is being destroyed without being rejected, resolved or disconnected. I think the parameters of the AssertIsDead calls are probably misleading, as the code is probably being deduplicated between these various instantiations, so the promise being rejected is probably the MozPromise<nsRefPtrHashtable<nsUint64HashKey, mozilla::gfx::RecordedDependentSurface>, nsresult, 1>, returned from CrossProcessPaint::Start.

I'm guessing that there is a rare scenario where the call to CrossProcessPaint::QueueDependencies ends up queuing no dependencies (e.g. due to aDependencies being empty or all dependencies having no wgp instance), where we end up never resolving the returned promise before it's dropped on the floor. The CrossProcessPaint code probably needs to be updated to fix this edgecase, even if it's fixed by making ~CrossProcessPaint() call Clear(NS_ERROR_FAILURE) or something like that (I don't know how this edge case should be handled, so...)

ni? :mattwoodrow, as IIRC you did the initial implementation here

Comment 3

[Matt Woodrow (:mattwoodrow)]

Attachment: Bug 1676409 - Attempt to resolve CrossProcessPaint objects for printing immediately, in case we didn't queue any dependencies. r?emilio

Depends on D104781

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2d92a6ed94ec
Attempt to resolve CrossProcessPaint objects for printing immediately, in case we didn't queue any dependencies. r=emilio

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/2d92a6ed94ec