Bug 1792636 - Make Utility process crash a non fatal error r=alwu,nika

Differential Revision: https://phabricator.services.mozilla.com/D160268

dom/media/MediaFormatReader.h

@@ -376,6 +376,9 @@ class MediaFormatReader final
           mNumOfConsecutiveRDDOrGPUCrashes(0),
           mMaxConsecutiveRDDOrGPUCrashes(
               StaticPrefs::media_rdd_process_max_crashes()),
+          mNumOfConsecutiveUtilityCrashes(0),
+          mMaxConsecutiveUtilityCrashes(
+              StaticPrefs::media_utility_process_max_crashes()),
           mFirstFrameTime(Some(media::TimeUnit::Zero())),
           mNumSamplesInput(0),
           mNumSamplesOutput(0),
@@ -467,10 +470,14 @@ class MediaFormatReader final
     uint32_t mNumOfConsecutiveDecodingError;
     uint32_t mMaxConsecutiveDecodingError;
 
-    // Track RDD process crashes and fail when we hit the limit.
+    // Track RDD or GPU process crashes and fail when we hit the limit.
     uint32_t mNumOfConsecutiveRDDOrGPUCrashes;
     uint32_t mMaxConsecutiveRDDOrGPUCrashes;
 
+    // Track Utility process crashes and fail when we hit the limit.
+    uint32_t mNumOfConsecutiveUtilityCrashes;
+    uint32_t mMaxConsecutiveUtilityCrashes;
+
     // Set when we haven't yet decoded the first frame.
     // Cleared once the first frame has been decoded.
     // This is used to determine, upon error, if we should try again to decode
@@ -498,6 +505,13 @@ class MediaFormatReader final
         return mNumOfConsecutiveRDDOrGPUCrashes >
                    mMaxConsecutiveRDDOrGPUCrashes ||
                StaticPrefs::media_playback_warnings_as_errors();
+      } else if (mError.ref() ==
+                 NS_ERROR_DOM_MEDIA_REMOTE_DECODER_CRASHED_UTILITY_ERR) {
+        bool tooManyConsecutiveCrashes =
+            mNumOfConsecutiveUtilityCrashes > mMaxConsecutiveUtilityCrashes;
+        // TODO: Telemetry?
+        return tooManyConsecutiveCrashes ||
+               StaticPrefs::media_playback_warnings_as_errors();
       } else {
         // All other error types are fatal
         return true;

ipc/glue/UtilityProcessManager.cpp

@@ -231,6 +231,11 @@ RefPtr<GenericNonExclusivePromise> UtilityProcessManager::StartUtility(
       [self, aActor, aSandbox]() {
         RefPtr<UtilityProcessParent> utilityParent =
             self->GetProcessParent(aSandbox);
+        if (!utilityParent) {
+          NS_WARNING("Missing parent in StartUtility");
+          return GenericNonExclusivePromise::CreateAndReject(NS_ERROR_FAILURE,
+                                                             __func__);
+        }
 
         // It is possible if multiple processes concurrently request a utility
         // actor that the previous CanSend() check returned false for both but
@@ -288,15 +293,22 @@ UtilityProcessManager::StartProcessForRemoteMediaDecoding(
       ->Then(
           GetMainThreadSerialEventTarget(), __func__,
           [self, uadc, aOtherProcess, aSandbox]() {
-            base::ProcessId process =
-                self->GetProcessParent(aSandbox)->OtherPid();
-
-            if (!uadc->CanSend()) {
-              MOZ_ASSERT(false, "UtilityAudioDecoderChild lost in the middle");
+            RefPtr<UtilityProcessParent> parent =
+                self->GetProcessParent(aSandbox);
+            if (!parent) {
+              NS_WARNING("UtilityAudioDecoderParent lost in the middle");
               return StartRemoteDecodingUtilityPromise::CreateAndReject(
                   NS_ERROR_FAILURE, __func__);
             }
 
+            if (!uadc->CanSend()) {
+              NS_WARNING("UtilityAudioDecoderChild lost in the middle");
+              return StartRemoteDecodingUtilityPromise::CreateAndReject(
+                  NS_ERROR_FAILURE, __func__);
+            }
+
+            base::ProcessId process = parent->OtherPid();
+
             Endpoint<PRemoteDecoderManagerChild> childPipe;
             Endpoint<PRemoteDecoderManagerParent> parentPipe;
             nsresult rv = PRemoteDecoderManager::CreateEndpoints(

modules/libpref/init/StaticPrefList.yaml

@@ -9613,6 +9613,13 @@
 #endif
   mirror: always
 
+# Specifies how many times we restart Utility process after crash till we give
+# up.
+- name: media.utility-process.max-crashes
+  type: RelaxedAtomicInt32
+  value: 2
+  mirror: always
+
 #ifdef MOZ_FFMPEG
 - name: media.utility-ffmpeg.enabled
   type: RelaxedAtomicBool