1248229 - "Assertion failure: !mStream->IsDestroyed() (Can't connect a destroyed stream.)" after cycle collection

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Description

[Jesse Ruderman]

Attachment: testcase (requires extension) (requires path adjustment)

1. Fix the path in the testcase to be correct on your computer
2. Create a profile with:
     e10 disabled
     https://www.squarefree.com/extensions/domFuzzLite3.xpi installed
3. Run: firefox -profile <profiledir> w.html
4. Wait one second

Assertion failure: !mStream->IsDestroyed() (Can't connect a destroyed stream.), at dom/media/mediasink/OutputStreamManager.cpp:33

Security-sensitive out of caution. Some bugs that involve cycle collection are UAFs, and I don't know whether this one is.

Comment 1

[Jesse Ruderman]

Attachment: stack

Comment 2

[Randell Jesup [:jesup] (needinfo me)]

P1/10 for evaluation.  Note: appears to be MediaSink stuff

Probably something related to how the OutputStreamManager handles the mStreams list and Disconnect() perhaps being called on it.  Wonder if it repros under rr....

Comment 3

[JW Wang [:jwwang] [:jw_wang]]

Attachment: 1248229_part1_testcase.patch

Part 1 - add test case to test if playback can work correctly after GC.

Comment 4

[JW Wang [:jwwang] [:jw_wang]]

Attachment: 1248229_part2_fix.patch

Part 2 - GC might happen in between OutputStreamManager::Disconnect() and OutputStreamManager::Connect(). We need to check if the stream is already destroyed before trying to connect it.

Comment 5

[JW Wang [:jwwang] [:jw_wang]]

try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=7c9320d4250b

Comment 6

[Andrew McCreight [:mccr8]]

Could this result in a use-after-free, or just something safer like a null deref?

Comment 7

[JW Wang [:jwwang] [:jw_wang]]

Thanks for the review!

Comment 8

[JW Wang [:jwwang] [:jw_wang]]

(In reply to Andrew McCreight [:mccr8] from comment #6)
> Could this result in a use-after-free, or just something safer like a null
> deref?

The later. Here is the try run without the fix (only part 1 is applied):
https://treeherder.mozilla.org/logviewer.html#?job_id=16885404&repo=try

Comment 9

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/85c911ca1bb8
https://hg.mozilla.org/integration/mozilla-inbound/rev/e4345d1fa465

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/85c911ca1bb8
https://hg.mozilla.org/mozilla-central/rev/e4345d1fa465