Bug 1937908 - Block shutdown in GMPProcessParent. r=aosmond,media-playback-reviewers

There is a shutdown race that can happen in GMPParent.
On ActorDestroy(NormalShutdown), if the GMP process is backlogged with work, it
may not yet have shut down. At the same time, ActorDestroy(NormalShutdown)
happens after xpcom-shutdown-threads, which has made sure to shut down the GMP
event target in GMPService. The graceful shutdown of the GMP process requires
dispatching tasks to the GMP event target (see GMPParent::DeleteProcess), which,
if the target has been shut down, will result in the GMP process leaking because
the SendShutdown Then handler could not be dispatched. If it even gets that far.

Differential Revision: https://phabricator.services.mozilla.com/D234856

Author: Pehrsons

dom/media/gmp/GMPParent.cpp

@@ -814,7 +814,8 @@ static void GMPNotifyObservers(const uint32_t aPluginID,
 
 void GMPParent::ActorDestroy(ActorDestroyReason aWhy) {
   MOZ_ASSERT(GMPEventTarget()->IsOnCurrentThread());
-  GMP_PARENT_LOG_DEBUG("%s: (%d)", __FUNCTION__, (int)aWhy);
+  GMP_PARENT_LOG_DEBUG("%s: (%d), state=%u", __FUNCTION__, (int)aWhy,
+                       static_cast<GMPState>(mState));
 
   if (AbnormalShutdown == aWhy) {
     Telemetry::Accumulate(Telemetry::SUBPROCESS_ABNORMAL_ABORT, "gmplugin"_ns,
@@ -839,7 +840,8 @@ void GMPParent::ActorDestroy(ActorDestroyReason aWhy) {
   mAbnormalShutdownInProgress = true;
   CloseActive(false);
 
-  // Normal Shutdown() will delete the process on unwind.
+  // Normal Shutdown() will delete the process on unwind. GMPProcessParent
+  // blocks shutdown to avoid races.
   if (AbnormalShutdown == aWhy) {
     RefPtr<GMPParent> self(this);
     // Must not call Close() again in DeleteProcess(), as we'll recurse

dom/media/gmp/GMPProcessParent.cpp

@@ -15,6 +15,7 @@
 #include "mozilla/ipc/ProcessChild.h"
 #include "mozilla/ipc/ProcessUtils.h"
 #include "mozilla/StaticPrefs_media.h"
+#include "nsFmtString.h"
 
 #include "base/string_util.h"
 #include "base/process_util.h"
@@ -232,7 +233,14 @@ bool GMPProcessParent::Launch(int32_t aTimeoutMs) {
   // We need to wait until OnChannelConnected to clear the pref serializer, but
   // SyncLaunch will block until that is called, so we don't actually need to do
   // any overriding, and it only lives on the stack.
-  return SyncLaunch(std::move(args), aTimeoutMs);
+  bool launched = SyncLaunch(std::move(args), aTimeoutMs);
+  if (launched) {
+    nsFmtString name{FMT_STRING(u"GMPProcessParent {}"),
+                     static_cast<void*>(this)};
+    mShutdownBlocker = media::ShutdownBlockingTicket::Create(
+        name, NS_LITERAL_STRING_FROM_CSTRING(__FILE__), __LINE__);
+  }
+  return launched;
 }
 
 void GMPProcessParent::Delete(nsCOMPtr<nsIRunnable> aCallback) {

dom/media/gmp/GMPProcessParent.h

@@ -12,6 +12,7 @@
 #include "base/file_path.h"
 #include "base/thread.h"
 #include "mozilla/ipc/GeckoChildProcessHost.h"
+#include "mozilla/media/MediaUtils.h"
 #include "nsIFile.h"
 
 class nsIRunnable;
@@ -89,6 +90,9 @@ class GMPProcessParent final : public mozilla::ipc::GeckoChildProcessHost {
 #  endif
 #endif
 
+  // Ticket for blocking shutdown while the process is live.
+  UniquePtr<media::ShutdownBlockingTicket> mShutdownBlocker;
+
   // For normalizing paths to be compatible with sandboxing.
   // We use normalized paths to generate the sandbox ruleset. Once
   // the sandbox has been started, resolving symlinks that point to