1897631 - Crash in [@ JS::AutoGCRooter::AutoGCRooter ] on refreshing a Webcodec demo while it is processing videos

Status: RESOLVED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Mayank Bansal]

STR:

1. Go to https://vjeux.github.io/mp4-h264-re-encode/mp4box.html
2. Select the attached sample video file as the input (Or use the video from https://bugzilla.mozilla.org/attachment.cgi?id=9402645)
3. The video will start processing . Wait for 4-5 seconds
4. Click on the browsers "Reload" button

AR: Crash
ER: Not so

Crash : https://crash-stats.mozilla.org/report/index/3bc26c56-70f1-4c18-8f09-bca690240519

Comment 1

[Mayank Bansal]

Attachment: about:support

Comment 2

[Mayank Bansal]

Bisection:
Bug 1881647, 1892747: apply code formatting via Lando

ignore-this-changeset

2024-05-19T09:40:46.876000: DEBUG : Did not find a branch, checking all integration branches
2024-05-19T09:40:46.878000: INFO : The bisection is done.

Comment 3

[Mayank Bansal]

Attachment: sample video.MP4

Comment 4

[C.M.Chang[:chunmin]]

The stack in the crash report is not informative enough, but I believe it's about the AutoJSAPI usage. I can reproduce it locally. I'll take a look tomorrow. Keep the NI for now.

Comment 5

[C.M.Chang[:chunmin]]

Here is the first 10 frames on the crash stack:

Thread 1 "Isolated Web Co" received signal SIGSEGV, Segmentation fault.
mozilla::dom::AutoJSAPI::cx (this=0x7ffd0949fac0) at /home/cm/Work/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/dom/ScriptSettings.h:241
241	    MOZ_ASSERT(mCx, "Must call Init before using an AutoJSAPI");
(gdb) bt
#0  mozilla::dom::AutoJSAPI::cx() const (this=0x7ffd0949fac0)
    at /home/cm/Work/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/mozilla/dom/ScriptSettings.h:241
#1  mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::OutputEncodedVideoData(nsTArray<RefPtr<mozilla::MediaRawData> > const&&) (this=this@entry=0x71de9d26e300, aData=...) at /home/cm/Work/gecko-dev/dom/media/webcodecs/EncoderTemplate.cpp:342
#2  0x000071dea7c3746b in mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::OutputEncodedData(nsTArray<RefPtr<mozilla::MediaRawData> > const&&) (this=0x71de9d26e300, aData=...)
    at /home/cm/Work/gecko-dev/dom/media/webcodecs/EncoderTemplate.cpp:678
#3  mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ProcessEncodeMessage(RefPtr<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::EncodeMessage>)::{lambda(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaRawData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&)#1}::operator()(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaRawData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&) const::{lambda()#2}::operator()() const (this=<optimized out>)
    at /home/cm/Work/gecko-dev/dom/media/webcodecs/EncoderTemplate.cpp:985
#4  mozilla::detail::RunnableFunction<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ProcessEncodeMessage(RefPtr<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::EncodeMessage>)::{lambda(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaRawData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&)#1}::operator()(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaRawData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&) const::{lambda()#2}>::Run() (this=<optimized out>)
    at /home/cm/Work/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsThreadUtils.h:548
#5  0x000071dea3ecaf48 in mozilla::RunnableTask::Run() (this=0x71de54ff0d80)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:580
#6  0x000071dea3ebd207 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=this@entry=0x71deb3c20300, aProofOfLock=...)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:907
#7  0x000071dea3ebb9c8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=this@entry=0x71deb3c20300, aProofOfLock=...) at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:730
#8  0x000071dea3ebbe46 in mozilla::TaskController::ProcessPendingMTTask(bool) (this=0x71deb3c20300, aMayWait=false)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:516
#9  0x000071dea3ec1ac7 in mozilla::TaskController::TaskController()::$_0::operator()() const (this=<optimized out>)

It looks like the AutoJSAPI initialization is failed so there is no valid JSContext.

Comment 6

[C.M.Chang[:chunmin]]

Here is another stack. It seems like the nsIGlobalObject / GetOwnerGlobal() / ParentObject in the page can be gone while there are decoder or encoder output in flight.

Thread 1 "Isolated Web Co" received signal SIGSEGV, Segmentation fault.
mozilla::dom::CreateVideoFrame (aGlobalObject=0x0, aData=0x7544c42bb2a0, aTimestamp=22233333, aDuration=<optimized out>, aDisplayAspectWidth=..., aDisplayAspectHeight=..., aColorSpace=...) at /home/cm/Work/gecko-dev/dom/media/webcodecs/VideoDecoder.cpp:553
553	  MOZ_ASSERT(aGlobalObject);
(gdb) bt
#0  mozilla::dom::CreateVideoFrame(nsIGlobalObject*, mozilla::VideoData const*, long, unsigned long, mozilla::Maybe<unsigned int>, mozilla::Maybe<unsigned int>, mozilla::dom::VideoColorSpaceInternal const&)
    (aGlobalObject=0x0, aData=0x7544c42bb2a0, aTimestamp=22233333, aDuration=<optimized out>, aDisplayAspectWidth=..., aDisplayAspectHeight=..., aColorSpace=<optimized out>) at /home/cm/Work/gecko-dev/dom/media/webcodecs/VideoDecoder.cpp:553
#1  mozilla::dom::VideoDecoder::DecodedDataToOutputType(nsIGlobalObject*, nsTArray<RefPtr<mozilla::MediaData> > const&&, mozilla::dom::VideoDecoderConfigInternal const&) (this=<optimized out>, aGlobalObject=0x0, aData=..., aConfig=...)
    at /home/cm/Work/gecko-dev/dom/media/webcodecs/VideoDecoder.cpp:926
#2  0x00007545279fe4a5 in mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::OutputDecodedData(nsTArray<RefPtr<mozilla::MediaData> > const&&, mozilla::dom::VideoDecoderConfigInternal const&) (this=0x75451d168000, aData=..., aConfig=...)
    at /home/cm/Work/gecko-dev/dom/media/webcodecs/DecoderTemplate.cpp:329
#3  0x0000754527a2e35d in mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::ProcessDecodeMessage(mozilla::UniquePtr<mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::ControlMessage, mozilla::DefaultDelete<mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::ControlMessage> >&)::{lambda(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&)#1}::operator()(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&) const::{lambda()#2}::operator()() const (this=<optimized out>)
    at /home/cm/Work/gecko-dev/dom/media/webcodecs/DecoderTemplate.cpp:643
#4  mozilla::detail::RunnableFunction<mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::ProcessDecodeMessage(mozilla::UniquePtr<mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::ControlMessage, mozilla::DefaultDelete<mozilla::dom::DecoderTemplate<mozilla::dom::VideoDecoderTraits>::ControlMessage> >&)::{lambda(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&)#1}::operator()(mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true>::ResolveOrRejectValue&&) const::{lambda()#2}>::Run() (this=<optimized out>)
    at /home/cm/Work/gecko-dev/obj-x86_64-pc-linux-gnu/dist/include/nsThreadUtils.h:548
#5  0x0000754523ccaf08 in mozilla::RunnableTask::Run() (this=0x7544c8ec9680)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:580
#6  0x0000754523cbd1c7 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=this@entry=0x754533a20300, aProofOfLock=...)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:907
--Type <RET> for more, q to quit, c to continue without paging--
#7  0x0000754523cbb988 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) (this=this@entry=0x754533a20300, aProofOfLock=...) at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:730
#8  0x0000754523cbbe06 in mozilla::TaskController::ProcessPendingMTTask(bool) (this=0x754533a20300, aMayWait=false)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:516
#9  0x0000754523cc1a87 in mozilla::TaskController::TaskController()::$_0::operator()() const (this=<optimized out>)
    at /home/cm/Work/gecko-dev/xpcom/threads/TaskController.cpp:234
#10 mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() (this=<optimized out>)
    at /home/cm/Work/gecko-dev/xpcom/threads/nsThreadUtils.h:548
#11 0x0000754523ce219e in nsThread::ProcessNextEvent(bool, bool*)
    (this=0x754533a72200, aMayWait=<optimized out>, aResult=0x7ffe4a71c1df)
    at /home/cm/Work/gecko-dev/xpcom/threads/nsThread.cpp:1199
#12 0x0000754523ce85b0 in NS_ProcessNextEvent(nsIThread*, bool) (aThread=0x754533e1ca60 <_IO_stdfile_2_lock>, 
    aThread@entry=0x754533a72200, aMayWait=false) at /home/cm/Work/gecko-dev/xpcom/threads/nsThreadUtils.cpp:480
#13 0x000075452483f227 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)
     (this=0x754533aa58d0, aDelegate=0x7ffe4a71c3c0) at /home/cm/Work/gecko-dev/ipc/glue/MessagePump.cpp:85
#14 0x0000754524779db2 in MessageLoop::RunHandler() (this=0x754533e1ca60 <_IO_stdfile_2_lock>)
    at /home/cm/Work/gecko-dev/ipc/chromium/src/base/message_loop.cc:363
#15 MessageLoop::Run() (this=0x754533e1ca60 <_IO_stdfile_2_lock>)
    at /home/cm/Work/gecko-dev/ipc/chromium/src/base/message_loop.cc:345
#16 0x00007545289d97c9 in nsBaseAppShell::Run() (this=0x75451ee71880) at /home/cm/Work/gecko-dev/widget/nsBaseAppShell.cpp:148
#17 0x0000754528a9bb39 in nsAppShell::Run() (this=0x75451ee71880) at /home/cm/Work/gecko-dev/widget/gtk/nsAppShell.cpp:469
#18 0x000075452a85093c in XRE_RunAppShell() () at /home/cm/Work/gecko-dev/toolkit/xre/nsEmbedFunctions.cpp:712
#19 0x000075452483fc0d in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)
    (this=0x754533e1ca60 <_IO_stdfile_2_lock>, aDelegate=0x7ffe4a71c3c0) at /home/cm/Work/gecko-dev/ipc/glue/MessagePump.cpp:235
#20 0x0000754524779db2 in MessageLoop::RunHandler() (this=0x754533e1ca60 <_IO_stdfile_2_lock>)
    at /home/cm/Work/gecko-dev/ipc/chromium/src/base/message_loop.cc:363

Comment 7

[C.M.Chang[:chunmin]]

Attachment: Bug 1897631 - Skip OutputEncoded*Data if AutoJSAPI init fails

This patch ensures that OutputEncoded*Data does nothing if AutoJSAPI
initialization fails due to the absence of a parent object. As a result,
all encoder output will be dropped in such cases.

Comment 8

[C.M.Chang[:chunmin]]

Attachment: Bug 1897631 - Cancel OutputDecodedData after parent-object goes away

The parent global object of a webpage utilizing the WebCodecs API can go
away while WebCodec decoder (or encoder) output is in flight. If the
parent object is no longer available, all subsequent output callbacks
must be canceled.

Depends on D211447

Comment 9

[C.M.Chang[:chunmin]]

Attachment: Bug 1897631 - Add testcase

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8b5508e4c2ab
Add testcase r=media-playback-reviewers,padenot
https://hg.mozilla.org/integration/autoland/rev/b13dc891727c
Skip OutputEncoded*Data if AutoJSAPI init fails r=media-playback-reviewers,padenot
https://hg.mozilla.org/integration/autoland/rev/c8422c47699f
Cancel OutputDecodedData after parent-object goes away r=media-playback-reviewers,padenot

Comment 11

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/8b5508e4c2ab
https://hg.mozilla.org/mozilla-central/rev/b13dc891727c
https://hg.mozilla.org/mozilla-central/rev/c8422c47699f