Open Bug 1701074 Opened 3 years ago Updated 3 years ago

Assertion failure: Request::mDisconnected, at src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:524

Categories

(Core :: WebRTC: Audio/Video, defect, P3)

defect

Tracking

()

Tracking Status
firefox89 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, crash)

This was found running the unreduced test case as bug 1701023.

WARNING: YOU ARE LEAKING THE WORLD (at least one JSRuntime and everything alive inside it, that is) AT JS_ShutDown TIME. FIX THIS!
Assertion failure: Request::mDisconnected, at src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:524

#0 0x22bd62f47e9c in mozilla::MozPromise<bool, RefPtr<mozilla::MediaMgrError>, true>::ThenValueBase::AssertIsDead() src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:524:9
#1 0x22bd62f46059 in mozilla::MozPromise<bool, RefPtr<mozilla::MediaMgrError>, true>::AssertIsDead() src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:1113:13
#2 0x22bd62f4614e in mozilla::MozPromise<bool, RefPtr<mozilla::MediaMgrError>, true>::AssertIsDead() src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:1116:16
#3 0x22bd5dc9b2f6 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::AssertIsDead() src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:522:12
#4 0x22bd5dc9a512 in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:481:23
#5 0x22bd5dc9a5ab in mozilla::MozPromise<bool, nsresult, false>::ThenValueBase::ResolveOrRejectRunnable::~ResolveOrRejectRunnable() src/objdir-ff-debug/dist/include/mozilla/MozPromise.h:479:34
#6 0x22bd5d0a691b in mozilla::Runnable::Release() src/xpcom/threads/nsThreadUtils.cpp:68:1
#7 0x22bd5d0bd185 in mozilla::DiscardableRunnable::Release() src/xpcom/threads/nsThreadUtils.cpp:90:1
#8 0x22bd5d0bd415 in mozilla::CancelableRunnable::Release() src/xpcom/threads/nsThreadUtils.cpp:93:1
#9 0x22bd5d08f45b in mozilla::RefPtrTraits<nsIRunnable>::Release(nsIRunnable*) src/objdir-ff-debug/dist/include/mozilla/RefPtr.h:50:40
#10 0x22bd5d08f434 in RefPtr<nsIRunnable>::ConstRemovingRefPtrTraits<nsIRunnable>::Release(nsIRunnable*) src/objdir-ff-debug/dist/include/mozilla/RefPtr.h:381:36
#11 0x22bd5d08f0b9 in RefPtr<nsIRunnable>::~RefPtr() src/objdir-ff-debug/dist/include/mozilla/RefPtr.h:81:7
#12 0x22bd5d08ec24 in mozilla::RunnableTask::~RunnableTask() src/xpcom/threads/TaskController.cpp:440:7
#13 0x22bd5d08ec5b in mozilla::RunnableTask::~RunnableTask() src/xpcom/threads/TaskController.cpp:440:7
#14 0x22bd5d0713f1 in mozilla::Task::Release() src/objdir-ff-debug/dist/include/mozilla/TaskController.h:120:3
#15 0x22bd5d071304 in mozilla::RefPtrTraits<mozilla::Task>::Release(mozilla::Task*) src/objdir-ff-debug/dist/include/mozilla/RefPtr.h:50:40
#16 0x22bd5d0712e4 in RefPtr<mozilla::Task>::ConstRemovingRefPtrTraits<mozilla::Task>::Release(mozilla::Task*) src/objdir-ff-debug/dist/include/mozilla/RefPtr.h:381:36
#17 0x22bd5d070119 in RefPtr<mozilla::Task>::~RefPtr() src/objdir-ff-debug/dist/include/mozilla/RefPtr.h:81:7
#18 0x22bd5d070ff8 in void __gnu_cxx::new_allocator<std::_Rb_tree_node<RefPtr<mozilla::Task> > >::destroy<RefPtr<mozilla::Task> >(RefPtr<mozilla::Task>*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/ext/new_allocator.h:140:28
#19 0x22bd5d070f8f in void std::allocator_traits<std::allocator<std::_Rb_tree_node<RefPtr<mozilla::Task> > > >::destroy<RefPtr<mozilla::Task> >(std::allocator<std::_Rb_tree_node<RefPtr<mozilla::Task> > >&, RefPtr<mozilla::Task>*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/alloc_traits.h:487:8
#20 0x22bd5d070f31 in std::_Rb_tree<RefPtr<mozilla::Task>, RefPtr<mozilla::Task>, std::_Identity<RefPtr<mozilla::Task> >, mozilla::Task::PriorityCompare, std::allocator<RefPtr<mozilla::Task> > >::_M_destroy_node(std::_Rb_tree_node<RefPtr<mozilla::Task> >*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:650:2
#21 0x22bd5d070ee3 in std::_Rb_tree<RefPtr<mozilla::Task>, RefPtr<mozilla::Task>, std::_Identity<RefPtr<mozilla::Task> >, mozilla::Task::PriorityCompare, std::allocator<RefPtr<mozilla::Task> > >::_M_drop_node(std::_Rb_tree_node<RefPtr<mozilla::Task> >*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:658:2
#22 0x22bd5d070e25 in std::_Rb_tree<RefPtr<mozilla::Task>, RefPtr<mozilla::Task>, std::_Identity<RefPtr<mozilla::Task> >, mozilla::Task::PriorityCompare, std::allocator<RefPtr<mozilla::Task> > >::_M_erase(std::_Rb_tree_node<RefPtr<mozilla::Task> >*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:1858:4
#23 0x22bd5d070da7 in std::_Rb_tree<RefPtr<mozilla::Task>, RefPtr<mozilla::Task>, std::_Identity<RefPtr<mozilla::Task> >, mozilla::Task::PriorityCompare, std::allocator<RefPtr<mozilla::Task> > >::~_Rb_tree() /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_tree.h:949:9
#24 0x22bd5d070c34 in std::set<RefPtr<mozilla::Task>, mozilla::Task::PriorityCompare, std::allocator<RefPtr<mozilla::Task> > >::~set() /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/stl_set.h:271:22
#25 0x22bd5d09d2cd in mozilla::TaskController::~TaskController() src/xpcom/threads/TaskController.h:268:7
#26 0x22bd5d09d13a in std::default_delete<mozilla::TaskController>::operator()(mozilla::TaskController*) const /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/unique_ptr.h:78:2
#27 0x22bd5d09eec8 in std::unique_ptr<mozilla::TaskController, std::default_delete<mozilla::TaskController> >::reset(mozilla::TaskController*) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/unique_ptr.h:371:4
#28 0x22bd5d08ad66 in std::unique_ptr<mozilla::TaskController, std::default_delete<mozilla::TaskController> >::operator=(std::nullptr_t) /usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/unique_ptr.h:307:2
#29 0x22bd5d07ec1e in mozilla::TaskController::ShutdownInternal() src/xpcom/threads/TaskController.cpp:194:54
#30 0x22bd5d07ea72 in mozilla::TaskController::Shutdown() src/xpcom/threads/TaskController.cpp:176:17
#31 0x22bd5d1381d2 in mozilla::ShutdownXPCOM(nsIServiceManager*) src/xpcom/build/XPCOMInit.cpp:796:3
#32 0x22bd5d1379a4 in NS_ShutdownXPCOM src/xpcom/build/XPCOMInit.cpp:565:10
#33 0x22bd67c95e9b in XRE_TermEmbedding() src/toolkit/xre/nsEmbedFunctions.cpp:212:3
#34 0x22bd5e2c4642 in mozilla::ipc::ScopedXREEmbed::Stop() src/ipc/glue/ScopedXREEmbed.cpp:90:5
#35 0x22bd641b8f6e in mozilla::dom::ContentProcess::CleanUp() src/dom/ipc/ContentProcess.cpp:202:44
#36 0x22bd67c96b8e in XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/nsEmbedFunctions.cpp:737:16
#37 0x22bd67ca73e6 in mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*) src/toolkit/xre/Bootstrap.cpp:67:12
#38 0x562d2de4b357 in content_process_main(mozilla::Bootstrap*, int, char**) src/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#39 0x562d2de4b565 in main src/browser/app/nsBrowserApp.cpp:309:18
#40 0x4d6033103bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#41 0x562d2de29529 in _start (src/objdir-ff-debug/dist/bin/firefox+0xcc529)

A Pernosco session is available here: https://pernos.co/debug/B6mV0uDG5q8pZeWgbN0D3Q/index.html

This promise seems like this MgrPromise [1], and we use it in MediaManager. I guess that we forget to disconnent the Then() for this kind of promise?

[1] https://searchfox.org/mozilla-central/rev/d58860eb739af613774c942c3bb61754123e449b/dom/media/MediaManager.h#224

--

Hi, Karl,
I saw you worked on MediaManager recently, could you help to take a look on this?
Thank you.

Component: Audio/Video → WebRTC: Audio/Video
Flags: needinfo?(karlt)

A gmplugin process has received a fatal SIGTERM.

A MediaEngineRemoteVideoSource in a content process is destroyed during nsCycleCollector_shutdown() and rejects its mFirstFramePromiseHolder, on which a GetUserMediaTask had queued a handler (before the SIGTERM), but the main thread event queue has already been shut down before cycle collector shutdown.

In a release version, the content process would exit before nsCycleCollector_shutdown().

Severity: -- → S4
Flags: needinfo?(karlt)
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.