1677817 - GMPParent::Init() crash due to Preferences::GetBool() call off main thread

Status: VERIFIED FIXED

(Core :: Audio/Video: GMP, defect, P1)

Description

[Haik Aftandilian [:haik]]

GMPParent::Init() calls Preferences::GetBool() call off main thread which causes the assertion failure below and is likely to be causing _pthread_join crashes: https://crash-stats.mozilla.org/report/index/ee5b5933-e37e-4ccb-971e-1d0d60201117

Assertion failure: sInServoTraversal || NS_IsMainThread(), at /Users/haftandilian/r/mc/obj-db.noindex/dist/include/mozilla/ServoUtils.h:33
#01: mozilla::IsInServoTraversal() (.cold.1)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x83740e0]
#02: AddAccessCount(nsTSubstring<char> const&)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x272a40]
#03: mozilla::ServoStyleSet::IsInServoTraversal()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x21d698]
#04: mozilla::Preferences::InitStaticMembers()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x224fd8]
#05: nsresult mozilla::Internals::GetPrefValue<bool*>(char const*, bool*&&, mozilla::PrefValueKind)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x27e9f0]
#06: bool mozilla::Internals::GetPref<bool>(char const*, bool, mozilla::PrefValueKind)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x26a264]
#07: mozilla::Preferences::GetBool(char const*, bool, mozilla::PrefValueKind)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x26a22c]
#08: mozilla::gmp::GMPParent::Init(mozilla::gmp::GeckoMediaPluginServiceParent*, nsIFile*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x2f32238]
#09: mozilla::gmp::GeckoMediaPluginServiceParent::AddOnGMPThread(nsTString<char16_t>)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x2f6b28c]
#10: decltype(*(fp).*fp0(Get<0ul>(fp1).PassAsParameter())) mozilla::detail::RunnableMethodArguments<StoreCopyPassByRRef<nsTString<char16_t> > >::applyImpl<mozilla::gmp::GeckoMediaPluginServiceParent, RefPtr<mozilla::MozPromise<bool, nsresult, true> > (mozilla:[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x2f8e86c]
#11: _ZN7mozilla6detail23RunnableMethodArgumentsIJ19StoreCopyPassByRRefI9nsTStringIDsEEEE5applyINS_3gmp29GeckoMediaPluginServiceParentEMS9_F6RefPtrINS_10MozPromiseIb8nsresultLb1EEEES4_EEEDTcl9applyImplfp_fp0_dtdefpT10mArgumentstlNSt3__116integer_sequenceImJLm0[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x2f8e800]
#12: mozilla::detail::MethodCall<mozilla::MozPromise<bool, nsresult, true>, RefPtr<mozilla::MozPromise<bool, nsresult, true> > (mozilla::gmp::GeckoMediaPluginServiceParent::*)(nsTString<char16_t>), mozilla::gmp::GeckoMediaPluginServiceParent, StoreCopyPassByRR[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x2f8e778]
#13: mozilla::detail::ProxyRunnable<mozilla::MozPromise<bool, nsresult, true>, RefPtr<mozilla::MozPromise<bool, nsresult, true> > (mozilla::gmp::GeckoMediaPluginServiceParent::*)(nsTString<char16_t>), mozilla::gmp::GeckoMediaPluginServiceParent, StoreCopyPassB[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x2f8e584]
#14: nsThread::ProcessNextEvent(bool, bool*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1c59cc]
#15: NS_ProcessNextEvent(nsIThread*, bool)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1ca3b0]
#16: mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0xa229b0]
#17: MessageLoop::RunInternal()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x9a9464]
#18: MessageLoop::RunHandler()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x9a93e0]
#19: MessageLoop::Run()[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x9a938c]
#20: nsThread::ThreadFunc(void*)[/Users/haftandilian/r/mc/obj-db.noindex/toolkit/library/build/XUL +0x1c31b4]
#21: _pt_root[/Users/haftandilian/r/mc/obj-db.noindex/dist/NightlyDebug.app/Contents/MacOS/libnss3.dylib +0xd70f4]
#22: _pthread_start[/usr/lib/system/libsystem_pthread.dylib +0x706c]
[RDD 57523, Main Thread] WARNING: Shutting down RDD process early due to a crash!: file /Users/haftandilian/r/mc/dom/media/ipc/RDDParent.cpp:236
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=101.531) [Socket 57512, Main Thread] WARNING: Shutting down Socket process early due to a crash!: file /Users/haftandilian/r/mc/netwerk/ipc/SocketProcessChild.cpp:158
Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=104.026) [GFX1-]: Receive IPC close with reason=AbnormalShutdown
Exiting due to channel error.

Comment 1

[Haik Aftandilian [:haik]]

Attachment: Bug 1677817 - GMPParent::Init() crash due to Preferences::GetBool() call off main thread r?spohl!,bryce!

Use static prefs for the Rosetta GMP plugin checks to allow them to be safely accessed off the main thread.

Comment 2

[Gian-Carlo Pascutto [:gcp]]

[Tracking Requested - why for this release]: Crash when disabling autoplay.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4881cfa8b043
GMPParent::Init() crash due to Preferences::GetBool() call off main thread r=spohl,bryce

Comment 4

[Haik Aftandilian [:haik]]

Comment on attachment 9188420 [details]
Bug 1677817 - GMPParent::Init() crash due to Preferences::GetBool() call off main thread r?spohl!,bryce!

Beta/Release Uplift Approval Request

• User impact if declined: Users running Beta 84 on Apple Silicon devices may experience crashes while watching video.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Test videos such as https://edition.cnn.com/videos and ensure the browser does not crash or have unexpected behavior.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The changes only apply to the new Apple Silicon machines which are shipping this week which will make up a very small percentage of users.
• String changes made/needed:

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4881cfa8b043

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9188420 [details]
Bug 1677817 - GMPParent::Init() crash due to Preferences::GetBool() call off main thread r?spohl!,bryce!

Approved for 84.0b3.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/c7379be599b0

Comment 8

[Hani Yacoub, Desktop QA]

I tried to reproduce this bug in order to verify it, but I couldn't manage to reproduce it. I tested this on Windows 10 x64, Ubunutu 20.04 and on MacOS 10.15 on Firefox Nightly 85.0a1 (2020-11-17) I did't encounter any crash or have unexpected behavior.
How often did it occur? On what OS should we focus on?
Thanks.

Comment 9

[Hani Yacoub, Desktop QA]

Oh i just saw that this was happening on Apple Silicon devices.
My bad.

Comment 10

[Timea Cernea [:tbabos][inactive]]

Verified-fixed on the latest Firefox Beta 84.0 RC and Nightly (2020-12-10) on miniMac: MacOS Big Sur 11.0.1, Mac mini (M1, 2020), Chip: Apple M1, display 27-inch (2560x1440), with Rosetta installed. There were no crashes encountered during exploratory testing on audio/video sites.