949907 - webrtcUI.jsm (handleRequest): can't access dead object

Status: RESOLVED FIXED

(Core :: WebRTC, defect)

Description

[Jesse Ruderman]

Attachment: testcase

JavaScript error: resource://app/modules/webrtcUI.jsm, line 73: can't access dead object

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Note that when I run the testcase, I get a different result: NS_ERROR_FAILURE: Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIURI.host] , so it looks like there's a race here.

But going by your findings:

Looks like your testcase changes window.location to something
 nonsensical, and this asynchronous callback in webrtcUI.jsm uses the aSubject.windowId that was originally passed in in line 67, in line 73 which is a callback that happens later after the window is gone because of your location change:

67> function handleRequest(aSubject, aTopic, aData) {
68    let constraints = aSubject.getConstraints();
69 
70    Services.wm.getMostRecentWindow(null).navigator.mozGetUserMediaDevices(
71      constraints,
72      function (devices) {
73>       prompt(aSubject.windowID, aSubject.callID, constraints.audio,
74               constraints.video || constraints.picture, devices);

While we could patch the code to check for this http://stackoverflow.com/questions/18401890/know-if-an-object-is-dead I suppose the question is if there's a larger problem here of all our asynchronous callbacks being vulnerable to DOM changes in a way that could cause misbehavior or mischief.

Perhaps there's a more general fix possible to somehow make our asynchronous callbacks fall to the floor when the window is torn down. E.g. make a callback-class that checks synchronously for teardown right before calling the callback.

Comment 2

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

I suppose this problem is limited to browser-chome callbacks, since all content callbacks are gone with the old window, so perhaps checking just this instance is sufficient.

Comment 3

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

This turned out to be unrelated to Bug 919244 in the end.

Comment 4

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: GetUserMediaDevices cleanup + untie GetUserMediaRequest obj from DOM

Cleanup that avoids the dead object situation.

Comment 5

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: GetUserMediaDevices cleanup + untie GetUserMediaRequest obj from DOM. r=jesup

Updated commit message. Carrying forward r+ from jesup.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e1d1542ff35c

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Backed out for Android 4.0 robocop failures.
https://hg.mozilla.org/integration/mozilla-inbound/rev/4609a7efae47

https://tbpl.mozilla.org/php/getParsedLog.php?id=34691480&tree=Mozilla-Inbound

Comment 8

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: GetUserMediaDevices cleanup + untie GetUserMediaRequest obj from DOM (2). r=jesup

Fixes android bustage. Carrying forward r+ from jesup.

Try - https://tbpl.mozilla.org/?tree=Try&rev=c9faa100481d

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3576a62195ec

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3576a62195ec

Comment 11

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Comment on attachment 8376483 [details] [diff] [review]
GetUserMediaDevices cleanup + untie GetUserMediaRequest obj from DOM (2). r=jesup

[Approval Request Comment]
Bug caused by (feature/regressing bug #): gUM permission prompt
User impact if declined: Dead object.

Testing completed (on m-c, etc.): 
Fix verified by schien (b2g) and myself (desktop) independently. Landed on m-c a week ago.

Risk to taking this patch (and alternatives if risky): Low

String or IDL/UUID changes made by this patch: none

Comment 12

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: GetUserMediaDevices cleanup + untie GetUserMediaRequest obj from DOM (3). r=jesup, a=abillings

Rebased for aurora.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/53b26d3251dd

Comment 14

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Comment on attachment 8376483 [details] [diff] [review]
GetUserMediaDevices cleanup + untie GetUserMediaRequest obj from DOM (2). r=jesup

[Approval Request Comment]
Bug caused by (feature/regressing bug #): gUM permission prompt
User impact if declined: Dead object.

Testing completed (on m-c, etc.): 
Fix verified by schien (b2g) and myself (desktop) independently. Landed on m-c a week ago, aurora this morning.

Risk to taking this patch (and alternatives if risky): Low

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/f988a03ddc6d

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g28_v1_3/rev/f988a03ddc6d