tor-browser

commit 49e3f5f68eb9f0f36cd960ed95297a485adfdf30
parent 75ecc00217ac9d9f168a4694a8e353ea8e5c2561
Author: Andrew Osmond <aosmond@gmail.com>
Date:   Mon, 20 Oct 2025 14:45:09 +0000

Bug 1951841 - Remove faulty assert triggered by race between VideoBridgeParent::ActorDestroy and ::LookupTexture. r=gfx-reviewers,lsalzman

VideoBridgeParent::LookupTexture may keep the actor alive on another
thread after ActorDestroy has been called on the compositor thread. This
means the actor may still be in the singleton map, assuming its
replacement has not been created yet, causing this assert to trip.

Differential Revision: https://phabricator.services.mozilla.com/D269216

Diffstat:
M
gfx/layers/ipc/VideoBridgeParent.cpp
 | 
6
++++--

1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/gfx/layers/ipc/VideoBridgeParent.cpp b/gfx/layers/ipc/VideoBridgeParent.cpp
@@ -91,9 +91,11 @@ already_AddRefed<TextureHost> VideoBridgeParent::LookupTextureAsync(
     const dom::ContentParentId& aContentId, uint64_t aSerial) {
   MonitorAutoLock lock(mMonitor);
 
-  // We raced shutting down the actor.
+  // We raced shutting down the actor. This can happen when another thread is
+  // keeping the VideoBridgeParent object alive, by waiting for a texture lookup
+  // to complete. While the lookup should fail quickly, it may not release the
+  // actor in time to have removed it from the singleton array.
   if (NS_WARN_IF(!mCompositorThreadHolder)) {
-    MOZ_ASSERT_UNREACHABLE("Called on destroyed VideoBridgeParent actor!");
     return nullptr;
   }