Media Foundation core deadlock around IMFPresentationClock::GetCorrelatedTime

It looks like as primitive call as IMFPresentationClock::GetCorrelatedTime can deadlock entire pipeline due to an issue in Media Foundation core. There are no symbols available for mfcore.dll so I would assume they have a global critical section there which is inaccurately used.

In any event the problem looks like an API bug, and severe one (given that it blows things up in UWP XAML MediaPlayerElement control and IMFMediaEngine::GetCurrentTime call!), because IMFPresentationClock::GetCorrelatedTime is too widely used to be banned even for RTWQ thread.

The two threads are locking two critical sections in the opposite order, a classic deadlock with two concurrent threads cross-locking one another. I would presume one of them is a global critical section – this would explain why such simple API participates in the deadlock.

Thread A:

 ntdll.dll!NtWaitForAlertByThreadId()    Unknown
 ntdll.dll!RtlpWaitOnAddressWithTimeout()    Unknown
 ntdll.dll!RtlpWaitOnAddress()    Unknown
 ntdll.dll!RtlpWaitOnCriticalSection()    Unknown
 ntdll.dll!RtlpEnterCriticalSectionContended()    Unknown
 ntdll.dll!RtlEnterCriticalSection()    Unknown
 mfcore.dll!00007ffadb1479e8()    Unknown
 mfcore.dll!00007ffadb147832()    Unknown
 mfcore.dll!00007ffadb147758()    Unknown
 mfcore.dll!00007ffadb14732e()    Unknown
 mfcore.dll!00007ffadb17ddb1()    Unknown
 mfcore.dll!00007ffadb17dcfe()    Unknown
 MFMediaEngine.dll!CMFPInnerPlayer::GetPosition()    Unknown
 MFMediaEngine.dll!CMFPOuterPlayer::GetPosition()    Unknown
 MFMediaEngine.dll!CMediaEngine::GetCurrentTimeInternal()    Unknown
 MFMediaEngine.dll!CMediaEngine::GetCurrentTime()    Unknown
 Windows.Media.Playback.MediaPlayer.dll!MediaPlayerImpl::get_Position(struct Windows::Foundation::TimeSpan *)    Unknown
 Windows.Media.Playback.MediaPlayer.dll!MediaPlaybackSessionImpl::get_Position(struct Windows::Foundation::TimeSpan *)    Unknown
 Windows.UI.Xaml.dll!DirectUI::MediaTransportControls::GetPosition(Windows::Foundation::TimeSpan * value) Line 7165    C++
 Windows.UI.Xaml.dll!DirectUI::MediaTransportControls::UpdatePositionUI() Line 3742    C++
 Windows.UI.Xaml.dll!DirectUI::MediaTransportControls::OnPositionUpdateTimerTick() Line 2598    C++
 Windows.UI.Xaml.dll!std::Func_class::operator()(IInspectable * <_Args_0>, IInspectable * <_Args_1>)    C++ Windows.UI.Xaml.dll!ctl::event_handler_base,IInspectable,IInspectable,DirectUI::FlyoutBaseOpenedTraits>::Invoke(IInspectable * pSender, IInspectable * pArgs) Line 38    C++ Windows.UI.Xaml.dll!DirectUI::CEventSourceBase,IInspectable,IInspectable>::Raise(IInspectable * pSource, IInspectable * pArgs) Line 275    C++ Windows.UI.Xaml.dll!DirectUI::CEventSourceBase,IInspectable,IInspectable>::UntypedRaise(IInspectable * pSource, IInspectable * pArgs) Line 248    C++ Windows.UI.Xaml.dll!DirectUI::DependencyObject::FireEvent(KnownEventIndex nEventId, IInspectable * pSender, IInspectable * pArgs) Line 3475    C++ [Inline Frame] Windows.UI.Xaml.dll!DirectUI::DXamlCore::FireEvent(CDependencyObject *) Line 1962    C++ [Inline Frame] Windows.UI.Xaml.dll!AgCoreCallbacks::FireEvent(CDependencyObject *) Line 91    C++ [Inline Frame] Windows.UI.Xaml.dll!CFxCallbacks::JoltHelper_FireEvent(CDependencyObject *) Line 1035    C++ Windows.UI.Xaml.dll!CCoreServices::CLR_FireEvent(CDependencyObject * pListener, EventHandle hEvent, CDependencyObject * pSender, CEventArgs * pArgs, unsigned int flags) Line 3224    C++ Windows.UI.Xaml.dll!CommonBrowserHost::CLR_FireEvent(CDependencyObject * pListener, EventHandle hEvent, CDependencyObject * pSender, CEventArgs * pArgs, unsigned int flags) Line 771    C++ Windows.UI.Xaml.dll!CControlBase::ScriptCallback(void * pControl, CDependencyObject * pListener, EventHandle hEvent, CDependencyObject * pSender, CEventArgs * pArgs, int flags, IScriptObject * pScriptObject, HRESULT(*)(CDependencyObject *, CEventArgs *) pInternalHandler) Line 267    C++ [Inline Frame] Windows.UI.Xaml.dll!CXcpDispatcher::OnScriptCallback(CEventInfo *) Line 1336    C++ Windows.UI.Xaml.dll!CXcpDispatcher::OnWindowMessage(HWND_ * msg, unsigned int wParam, unsigned int64 lParam, _int64) Line 1090    C++ [Inline Frame] Windows.UI.Xaml.dll!CXcpDispatcher::ProcessMessage(HWND *) Line 909    C++
 Windows.UI.Xaml.dll!CXcpDispatcher::WindowProc(HWND_ * hwnd, unsigned int msg, unsigned __int64 wParam, __int64 lParam) Line 840    C++
 Windows.UI.Xaml.dll!CDeferredInvoke::DispatchQueuedMessage(bool * dispatchedWork, bool * hasMoreWork) Line 299    C++
 [Inline Frame] Windows.UI.Xaml.dll!CXcpDispatcher::MessageTimerCallback() Line 1532    C++
 Windows.UI.Xaml.dll!CXcpDispatcher::MessageTimerCallbackStatic(void * myUserData) Line 1524    C++
 CoreMessaging.dll!00007ffb172fbd46()    Unknown
 CoreMessaging.dll!00007ffb17329b8d()    Unknown
 CoreMessaging.dll!00007ffb17301108()    Unknown
 CoreMessaging.dll!00007ffb17300491()    Unknown
 CoreMessaging.dll!00007ffb172ffd99()    Unknown
 CoreMessaging.dll!00007ffb172ffbcb()    Unknown
 user32.dll!00007ffb1c3163ed()    Unknown
 user32.dll!00007ffb1c315de2()    Unknown
 Windows.UI.dll!00007ffafdfd92b7()    Unknown
 Windows.UI.dll!00007ffafdfd8fee()    Unknown
 Windows.UI.dll!00007ffafdfd8e9d()    Unknown
 Windows.UI.Xaml.dll!CJupiterWindow::RunCoreWindowMessageLoop() Line 1233    C++
 [Inline Frame] Windows.UI.Xaml.dll!CJupiterControl::RunMessageLoop() Line 1065    C++
 Windows.UI.Xaml.dll!DirectUI::DXamlCore::RunMessageLoop() Line 2453    C++
 twinapi.appcore.dll!00007ffb17a944aa()    Unknown
 twinapi.appcore.dll!00007ffb17a6a564()    Unknown
 SHCore.dll!00007ffb1aefdce5()    Unknown
 kernel32.dll!BaseThreadInitThunk()    Unknown
 ntdll.dll!RtlUserThreadStart()    Unknown

Thread B:

 ntdll.dll!NtWaitForAlertByThreadId()    Unknown
 ntdll.dll!RtlpWaitOnAddressWithTimeout()    Unknown
 ntdll.dll!RtlpWaitOnAddress()    Unknown
 ntdll.dll!RtlpWaitOnCriticalSection()    Unknown
 ntdll.dll!RtlpEnterCriticalSectionContended()    Unknown
 ntdll.dll!RtlEnterCriticalSection()    Unknown
 mfcore.dll!00007ffadb1476a4()    Unknown
 Media.dll!MF::GetPresentationClockSourceTime(IMFPresentationClock * PresentationClock, __int64 & Time) Line 2826    C++
 Media.dll!LiveTransformBase::Track::Terminate() Line 60    C++
 Media.dll!LiveTransformBase::Track::SetAvailable() Line 94    C++
 Media.dll!Pool::ElementT::HandleRelease() Line 41    C++
 Media.dll!LiveTransformBase::Track::Release() Line 73    C++
 oleaut32.dll!VariantClearWorker()    Unknown
 oleaut32.dll!VariantClear()    Unknown
 combase.dll!00007ffb1bbf148d()    Unknown
 mfplat.dll!CMFSample::DeleteAllItems()    Unknown
 mfplat.dll!CPooledSample::_FinalRelease()    Unknown
 mfplat.dll!CMFSample::Release(void)    Unknown
 Media.dll!Microsoft::WRL::ComPtr::InternalRelease() Line 176    C++
 Media.dll!Microsoft::WRL::ComPtr::Reset() Line 369    C++
 Media.dll!LiveTransformBase::WrapSample::SetAvailable() Line 200    C++
 Media.dll!Pool::ElementT::HandleRelease() Line 41    C++
 Media.dll!LiveTransformBase::WrapSample::Release() Line 178    C++
 mfcore.dll!00007ffadb147e29()    Unknown
 mfcore.dll!00007ffadb147fad()    Unknown
 mfcore.dll!00007ffadb14a090()    Unknown
 mfcore.dll!00007ffadb148dcf()    Unknown
 mfcore.dll!00007ffadb1489a6()    Unknown
 mfcore.dll!00007ffadb14833d()    Unknown
 mfcore.dll!00007ffadb148211()    Unknown
 mfcore.dll!00007ffadb160937()    Unknown
 mfcore.dll!00007ffadb1604b1()    Unknown
 mfcore.dll!00007ffadb16038a()    Unknown
 mfcore.dll!00007ffadb1602b0()    Unknown
 RTWorkQ.dll!CSerialWorkQueue::ProcessNextItem()    Unknown
 RTWorkQ.dll!CSerialWorkQueue::QueueItem::OnWorkItemAsyncCallback::Invoke()    Unknown
 RTWorkQ.dll!ThreadPoolWorkCallback()    Unknown
 ntdll.dll!TppWorkpExecuteCallback()    Unknown
 ntdll.dll!TppWorkerThread()    Unknown
 kernel32.dll!BaseThreadInitThunk()    Unknown
 ntdll.dll!RtlUserThreadStart()    Unknown

Leave a Reply