1951841 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Called on destroyed VideoBridgeParent actor!), at /builds/worker/checkouts/gecko/gfx/layers/ipc/VideoBridgeParent.cpp:96

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20250304-291b8d26dbbb (--enable-debug)

This was found by visiting a live website with a debug build.

STR:

• Launch browser and visit site

This issue was triggered by visiting http://marinaelsyarmor.com/.

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: Called on destroyed VideoBridgeParent actor!), at /builds/worker/checkouts/gecko/gfx/layers/ipc/VideoBridgeParent.cpp:96

36|0|libxul.so|mozilla::layers::VideoBridgeParent::LookupTextureAsync(mozilla::dom::IdType<mozilla::dom::ContentParent> const&, unsigned long)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/VideoBridgeParent.cpp:73340dad529243c691d0896cac80527bea1a98aa|96|0x145
36|1|libxul.so|mozilla::layers::GPUVideoTextureHost::EnsureWrappedTextureHost()|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/GPUVideoTextureHost.cpp:73340dad529243c691d0896cac80527bea1a98aa|53|0x99
36|2|libxul.so|mozilla::layers::GPUVideoTextureHost::IsWrappingSurfaceTextureHost()|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/GPUVideoTextureHost.cpp:73340dad529243c691d0896cac80527bea1a98aa|227|0xd
36|3|libxul.so|mozilla::layers::WebRenderTextureHost::PrepareForUse()|hg:hg.mozilla.org/mozilla-central:gfx/layers/wr/WebRenderTextureHost.cpp:73340dad529243c691d0896cac80527bea1a98aa|143|0x23
36|4|libxul.so|mozilla::layers::CompositableTextureRef<mozilla::layers::TextureHost>::operator=(mozilla::layers::TextureHost*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/composite/TextureHost.h:73340dad529243c691d0896cac80527bea1a98aa|265|0x2f
36|5|libxul.so|mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperationDetail const&, mozilla::NotNull<mozilla::layers::CompositableHost*>, mozilla::layers::CompositableHandle const&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositableTransactionParent.cpp:73340dad529243c691d0896cac80527bea1a98aa|60|0x1c1
36|6|libxul.so|mozilla::layers::ImageBridgeParent::RecvUpdate(nsTArray<mozilla::layers::CompositableOperation>&&, nsTArray<mozilla::layers::OpDestroy>&&, unsigned long const&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/ImageBridgeParent.cpp:73340dad529243c691d0896cac80527bea1a98aa|213|0x20b
36|7|libxul.so|mozilla::layers::PImageBridgeParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:1874db5463db097a7da8d5e7d48e5d59d679779612fc512a57a23049bfb2969fac461bdb10ceeccc11aa605098ed741859a48fa9791f47a7b076bdd6534e4a0d/ipc/ipdl/PImageBridgeParent.cpp:|385|0x3d6
36|8|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:73340dad529243c691d0896cac80527bea1a98aa|1789|0x127
36|9|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:73340dad529243c691d0896cac80527bea1a98aa|1716|0x27a
36|10|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:73340dad529243c691d0896cac80527bea1a98aa|1507|0x178
36|11|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:73340dad529243c691d0896cac80527bea1a98aa|1607|0xcd
36|12|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:73340dad529243c691d0896cac80527bea1a98aa|1153|0x77c
36|13|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:73340dad529243c691d0896cac80527bea1a98aa|480|0x4f
36|14|libxul.so|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:73340dad529243c691d0896cac80527bea1a98aa|299|0xc6
36|15|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:73340dad529243c691d0896cac80527bea1a98aa|344|0x61
36|16|libxul.so|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:73340dad529243c691d0896cac80527bea1a98aa|366|0x1c7
36|17|libnspr4.so|_pt_root|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:73340dad529243c691d0896cac80527bea1a98aa|191|0x18f
36|18|firefox-bin|set_alt_signal_stack_and_start(PthreadCreateParams*)|hg:hg.mozilla.org/mozilla-central:mozglue/interposers/pthread_create_interposer.cpp:73340dad529243c691d0896cac80527bea1a98aa|81|0x10c

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/7BucUrTeDv7jTq8M6bSxpg/index.html

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

Attachment: Bug 1951841 - Remove faulty assert triggered by race between VideoBridgeParent::ActorDestroy and ::LookupTexture.

VideoBridgeParent::LookupTexture may keep the actor alive on another
thread after ActorDestroy has been called on the compositor thread. This
means the actor may still be in the singleton map, assuming its
replacement has not been created yet, causing this assert to trip.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/49e3f5f68eb9
https://hg.mozilla.org/integration/autoland/rev/8929bc73b43d
Remove faulty assert triggered by race between VideoBridgeParent::ActorDestroy and ::LookupTexture. r=gfx-reviewers,lsalzman

Comment 4

[amarc]

https://hg.mozilla.org/mozilla-central/rev/8929bc73b43d