899514 - [B2G] [WebRTC] Crash in ~nsDOMCameraManager when removing gUM process in card view

Status: RESOLVED INVALID

(Firefox OS Graveyard :: General, defect)

Description

[Alfredo Yang (:alfredo)]

Crash in gUM sample.

Gecko 140205:a2c4d9491491, debug build

Reproduce step:
1. open gUM sample
2. click video
3. long press home to display card view
4. remove gUM app process in card view

#0  0x41f812f6 in mozalloc_abort (msg=<value optimized out>) at /home/mozalfredo/mozwork/mozilla-central-unagi/memory/mozalloc/mozalloc_abort.cpp:30
#1  0x40c538dc in Abort (aSeverity=<value optimized out>, aStr=0x4206a610 "You can't dereference a NULL nsCOMPtr with operator->().", aExpr=<value optimized out>, 
    aFile=<value optimized out>, aLine=819) at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/base/nsDebugImpl.cpp:430
#2  NS_DebugBreak (aSeverity=<value optimized out>, aStr=0x4206a610 "You can't dereference a NULL nsCOMPtr with operator->().", aExpr=<value optimized out>, 
    aFile=<value optimized out>, aLine=819) at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/base/nsDebugImpl.cpp:387
#3  0x407b896e in nsCOMPtr<nsIDirectoryServiceProvider>::operator-> (this=0xbebe7d70) at ../../dist/include/nsCOMPtr.h:819
#4  0x4154a486 in ~nsDOMCameraManager (this=0x441a69d0, __in_chrg=<value optimized out>) at /home/mozalfredo/mozwork/mozilla-central-unagi/dom/camera/DOMCameraManager.cpp:71
#5  0x4154a2c4 in nsDOMCameraManager::DeleteCycleCollectable (this=0x441a69d0) at /home/mozalfredo/mozwork/mozilla-central-unagi/dom/camera/DOMCameraManager.cpp:30
#6  0x41549db4 in nsDOMCameraManager::cycleCollection::DeleteCycleCollectableImpl (p=0x441a69d0) at /home/mozalfredo/mozwork/mozilla-central-unagi/dom/camera/DOMCameraManager.h:44
#7  0x40c511dc in ~SnowWhiteKiller (this=0xbebe7de4, __in_chrg=<value optimized out>) at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/base/nsCycleCollector.cpp:2247
#8  0x40c51f08 in nsCycleCollector::FreeSnowWhite (this=0x40459000, aUntilNoSWInPurpleBuffer=<value optimized out>)
    at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/base/nsCycleCollector.cpp:2356
#9  0x40c52bf0 in nsCycleCollector::Shutdown (this=0x333) at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/base/nsCycleCollector.cpp:3074
#10 0x40c52d1e in nsCycleCollector_shutdown () at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/base/nsCycleCollector.cpp:3399
#11 0x40c02020 in mozilla::ShutdownXPCOM (servMgr=0x4206a610) at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/build/nsXPComInit.cpp:684
#12 0x40c0227e in NS_ShutdownXPCOM (servMgr=0x333) at /home/mozalfredo/mozwork/mozilla-central-unagi/xpcom/build/nsXPComInit.cpp:547
#13 0x407b83ec in XRE_TermEmbedding () at /home/mozalfredo/mozwork/mozilla-central-unagi/toolkit/xre/nsEmbedFunctions.cpp:187
#14 0x40863ef8 in mozilla::ipc::ScopedXREEmbed::Stop (this=0x404406c8) at /home/mozalfredo/mozwork/mozilla-central-unagi/ipc/glue/ScopedXREEmbed.cpp:110
#15 0x4082bcee in mozilla::dom::ContentProcess::CleanUp (this=<value optimized out>) at /home/mozalfredo/mozwork/mozilla-central-unagi/dom/ipc/ContentProcess.cpp:37
#16 0x407b82ee in XRE_InitChildProcess (aArgc=2, aArgv=0xbebe8998, aProcess=1078199296) at /home/mozalfredo/mozwork/mozilla-central-unagi/toolkit/xre/nsEmbedFunctions.cpp:517
#17 0x00008786 in main (argc=7, argv=0xbebe8a24) at /home/mozalfredo/mozwork/mozilla-central-unagi/ipc/app/MozillaRuntimeMain.cpp:85

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

This looks like a bug in nsDOMCameraManager, not webrtc:
http://mxr.mozilla.org/mozilla-central/source/dom/camera/DOMCameraManager.cpp#66

 66 nsDOMCameraManager::~nsDOMCameraManager()
 67 {
 68   /* destructor code */
 69   DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
 70   nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
 71-> obs->RemoveObserver(this, "xpcom-shutdown");
 72 }

obs is used without checking for nullptr.

If GetObserverService() returns null, we must be very late in shutdown, in garbage collection, after the observer has already been called and removed in line 182.

If nsDOMCameraManager is a singleton then this code is probably redundant and can be removed (though using a boolean to check whether removal is needed may be cleaner).

Comment 2

[Alfredo Yang (:alfredo)]

nsDOMCameraManager has been changed a lot so this is invalid.

Comment 3

[Shih-Chiang Chien [:schien] (UTC+8) (use ni? plz)]

In the latest m-c, we still don't have the null check for obs in XpcomShutdown() [1]. I'll suggest to add the |if(obs)| in case we invoke this function in other place in future.

[1] http://dxr.mozilla.org/mozilla-central/source/dom/camera/DOMCameraManager.cpp#415