Open Bug 1701023 Opened 4 years ago Updated 3 years ago

Hit MOZ_CRASH() at src/memory/mozalloc/mozalloc_abort.cpp:33

Categories

(Core :: Audio/Video: GMP, defect, P3)

Product:
Core
Component:
Audio/Video: GMP
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox89 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion)

I found this while trying to reproduce another issue. I was running under rr at the time. I will add a Pernosco session shortly.

[Parent 1937, Main Thread] ###!!! ABORT: file src/dom/media/gmp/GMPServiceParent.cpp:1529

Hit MOZ_CRASH() at src/memory/mozalloc/mozalloc_abort.cpp:33

#0 0x55e7e01e4590 in mozalloc_abort src/memory/mozalloc/mozalloc_abort.cpp:33:3
#1 0x7cc10115921 in Abort(char const*) src/xpcom/base/nsDebugImpl.cpp:452:3
#2 0x7cc1011540a in NS_DebugBreak src/xpcom/base/nsDebugImpl.cpp:409:7
#3 0x7cc10115686 in nsDebugImpl::Abort(char const*, int) src/xpcom/base/nsDebugImpl.cpp:134:3
#4 0x7cc103cc909 in NS_InvokeByIndex src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101
#5 0x7cc125e093c in CallMethodHelper::Invoke() src/js/xpconnect/src/XPCWrappedNative.cpp:1623:10
#6 0x7cc125d808f in CallMethodHelper::Call() src/js/xpconnect/src/XPCWrappedNative.cpp:1176:19
#7 0x7cc125bbae5 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) src/js/xpconnect/src/XPCWrappedNative.cpp:1142:23
#8 0x7cc125bd80c in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:925:10
#9 0x7cc1b1a98e4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:435:13
#10 0x7cc1b196ba0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:520:12
#11 0x7cc1b1973be in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:580:10
#12 0x7cc1b197181 in js::CallFromStack(JSContext*, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:584:10
#13 0x7cc1b18ab75 in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:3244:16
#14 0x7cc1b17f9ac in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:405:13
#15 0x7cc1b196dc9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:552:13
#16 0x7cc1b1973be in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:580:10
#17 0x7cc1b197466 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:597:8
#18 0x7cc1b2fa2ab in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.h:106:10
#19 0x7cc1b4fdb91 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) src/js/src/builtin/Promise.cpp:1905:10
#20 0x7cc1b1a98e4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) src/js/src/vm/Interpreter.cpp:435:13
#21 0x7cc1b196ba0 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:520:12
#22 0x7cc1b1973be in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) src/js/src/vm/Interpreter.cpp:580:10
#23 0x7cc1b197466 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:597:8
#24 0x7cc1b9e33de in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/jsapi.cpp:2856:10
#25 0x7cc14386e21 in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) src/objdir-ff-debug/dom/bindings/PromiseBinding.cpp:31:8
#26 0x7cc1015713c in mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) src/objdir-ff-debug/dist/include/mozilla/dom/PromiseBinding.h:89:12
#27 0x7cc10156b1d in mozilla::dom::PromiseJobCallback::Call(char const*) src/objdir-ff-debug/dist/include/mozilla/dom/PromiseBinding.h:102:12
#28 0x7cc10154e50 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) src/xpcom/base/CycleCollectedJSContext.cpp:212:18
#29 0x7cc1011de7d in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) src/xpcom/base/CycleCollectedJSContext.cpp:647:17
#30 0x7cc1011e4e5 in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) src/xpcom/base/CycleCollectedJSContext.cpp:462:3
#31 0x7cc12544724 in XPCJSContext::AfterProcessTask(unsigned int) src/js/xpconnect/src/XPCJSContext.cpp:1462:28
#32 0x7cc1036ea2a in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1192:24
#33 0x7cc103cc909 in NS_InvokeByIndex src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101
#34 0x7cc125e093c in CallMethodHelper::Invoke() src/js/xpconnect/src/XPCWrappedNative.cpp:1623:10
#35 0x7cc125d808f in CallMethodHelper::Call() src/js/xpconnect/src/XPCWrappedNative.cpp:1176:19
#36 0x7cc125bbae5 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) src/js/xpconnect/src/XPCWrappedNative.cpp:1142:23
#37 0x7cc125bd80c in XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:925:10
#38 0x39e663ebebfe  (<unknown module>)

A Pernosco session is available here: https://pernos.co/debug/Dh1ZngPckd1HPlCqS06lag/index.html

See Also: → 1701074

Looks like us blocking shutdown based on the log in the recording. The crash string appears to be an attribution to what added the blocker, we do not seem to be crashing when executing that line itself.

My guess would be that the problem is being caused by us not shutting down other GMP machinery correctly so that we never remove the blocker. These kinds of issues can be pretty gnarly to track, I don't think I'll have time to do so here in the immediate future.

Severity: -- → S3
Priority: -- → P3

I think I see the same on Solaris SPARC:

DISPLAY=:1 /builds2/psumbera/mozilla-central-build/INSTALLED/bin/firefox -P
[Parent 11073, Main Thread] WARNING: dependent window created without a parent: file /builds2/psumbera/mozilla-central-build/toolkit/components/startup/nsAppStartup.cpp:654 Crash Annotation GraphicsCriticalError: |[0][GFX1-]: glxtest: libpci missing (t=8.07348) [GFX1-]: glxtest: libpci missing
Crash Annotation GraphicsCriticalError: |[0][GFX1-]: glxtest: libpci missing (t=8.07348) |[1][GFX1-]: No GPUs detected via PCI (t=8.07389) [GFX1-]: No GPUs detected via PCI [Socket 11075, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds2/psumbera/mozilla-central-build/netwerk/protocol/http/nsHttpHandler.cpp:401
[Socket 11075, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, kKnownEsrVersion) failed with result 0x80004002 (NS_NOINTERFACE): file /builds2/psumbera/mozilla-central-build/to3[Parent 11073, Main Thread] WARNING: NS_ENSURE_TRUE(rootFrame) failed: file /builds2/psumbera/mozilla-central-build/dom/base/nsGlobalWindowOuter.cpp:4241
[Parent 11073, Main Thread] WARNING: NS_ENSURE_TRUE(root) failed: file /builds2/psumbera/mozilla-central-build/layout/base/nsDocumentViewer.cpp:2604
Warning: asking to enable_gpu_markers but no supporting extension was found
out of memory: 0x0033640D7675E080 bytes requested
Hit MOZ_CRASH() at /builds2/psumbera/mozilla-central-build/memory/mozalloc/mozalloc_abort.cpp:33
#01: mozalloc_abort[/builds2/psumbera/mozilla-central-build/INSTALLED/lib/firefox/firefox +0xde604]
#02: mozalloc_handle_oom(unsigned long)[/builds2/psumbera/mozilla-central-build/INSTALLED/lib/firefox/firefox +0xdef70]
#03: GeckoHandleOOM[/builds2/psumbera/mozilla-central-build/INSTALLED/lib/firefox/libxul.so +0x1aa6fea8]
#04: gkrust_shared::oom_hook::hook::ha7b9bf0c96935d7f[/builds2/psumbera/mozilla-central-build/INSTALLED/lib/firefox/libxul.so +0x1fcb2ea4]
[Socket 11075, Main Thread] WARNING: Shutting down Socket process early due to a crash!: file /builds2/psumbera/mozilla-central-build/netwerk/ipc/SocketProcessChild.cpp:160 Segmentation Fault (core dumped)

I can always reproduce it (with -P). Not sure when the problem started...

You need to log in before you can comment on or make changes to this bug.