1712615 - Crash in [@ nsTArray_Impl<T>::ClearAndRetainStorage | nsTArray_Impl<T>::~nsTArray_Impl | mozilla::MozPromise<T>::~MozPromise]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Kevin Brosnan [Ex-Mozilla]]

Crash report: https://crash-stats.mozilla.org/report/index/e3144853-c29f-45a9-89a4-8d90b0210523

Reason: SIGSEGV /SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so nsTArray_Impl<RefPtr<mozilla::MediaData>, nsTArrayInfallibleAllocator>::ClearAndRetainStorage xpcom/ds/nsTArray.h:1483
1 libxul.so nsTArray_Impl<RefPtr<mozilla::MediaData>, nsTArrayInfallibleAllocator>::~nsTArray_Impl xpcom/ds/nsTArray.h:1037
2 libxul.so mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>::~MozPromise xpcom/threads/MozPromise.h:1168
3 libxul.so mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>::Private::~Private xpcom/threads/MozPromise.h:256
4 libxul.so mozilla::MozPromiseRefcountable::Release xpcom/threads/MozPromise.h:151
5 libxul.so mozilla::RemoteDataDecoder::ReturnDecodedData dom/media/platforms/android/RemoteDataDecoder.cpp:806
6 libxul.so mozilla::detail::RunnableMethodImpl<mozilla::RemoteDataDecoder*, void  xpcom/threads/nsThreadUtils.h:1201
7 libxul.so mozilla::TaskQueue::Runner::Run xpcom/threads/TaskQueue.cpp:158
8 libxul.so nsThreadPool::Run xpcom/threads/nsThreadPool.cpp:303
9 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1200

Android crash with most of the crash addresses pointing to the poison address.

Comment 1

[Andrew McCreight [:mccr8]]

This looks related to the Android RemoteDataDecoder code. I'm not sure what is going wrong here, but it looks like CallbacksSupport has a raw pointer to a RemoteDataDecoder which could be bad.

It looks like this is happening for this runnable: https://searchfox.org/mozilla-central/rev/16388511162ac6bbf5399e69e500e174a2f3972c/dom/media/platforms/android/RemoteDataDecoder.cpp#466-470

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

Might be a variant of bug 1689329?

Comment 3

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

(In reply to Andrew McCreight [:mccr8] from comment #1)

This looks related to the Android RemoteDataDecoder code. I'm not sure what is going wrong here, but it looks like CallbacksSupport has a raw pointer to a RemoteDataDecoder which could be bad.

It looks like this is happening for this runnable: https://searchfox.org/mozilla-central/rev/16388511162ac6bbf5399e69e500e174a2f3972c/dom/media/platforms/android/RemoteDataDecoder.cpp#466-470

John, do you have any insight into what could be going on here, given the Android code?

Comment 4

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

We don't have any crashes against this signature before 2021-01-30. At that time crashes start in release (I'm not as familiar with Android's reporting, I assume it's the same as desktop). Figured it's worth noting as we're about to lose that start time as we drop 6+ month old reports.

Comment 5

[Jim Mathies [:jimm]]

Waiting to see if bug 1725470 helps.

Comment 6

[Jim Mathies [:jimm]]

Looks like this might be fixed, waiting a bit to see.

Comment 7

[John Lin [:jhlin][:jolin]]

No occurrence since 93. It's indeed fixed by bug 1725470. Closing this bug.