Closed Bug 1489160 Opened 6 years ago Closed 3 years ago

Assertion failure: false, at /builds/worker/workspace/build/src/dom/media/webaudio/AudioContext.cpp:926

Categories

(Core :: Web Audio, defect, P3)

Product:
Core
Component:
Web Audio
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
85 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- wontfix
firefox64 --- wontfix
firefox83 --- wontfix
firefox84 --- wontfix
firefox85 --- fixed

People

(Reporter: jkratzer, Assigned: pehrsons)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files, 1 obsolete file)

testcase.html
574 bytes, text/html
Details
Bug 1489160 - Add crashtest. r?karlt
47 bytes, text/x-phabricator-request
Details | Review
Bug 1489160 - Check mCloseCalled instead of mAudioContextState when checking for a closed AudioContext. r?karlt!
47 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html — 
Testcase found while fuzzing mozilla-central rev 0c947d96e8f3.

Assertion failure: false, at /builds/worker/workspace/build/src/dom/media/webaudio/AudioContext.cpp:926

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f6ac2f71ac0
rsi = 0x00007f6ada79b8b0   rdi = 0x00007f6ada79a680
rbp = 0x00007ffc7e70a190   rsp = 0x00007ffc7e70a150
r8 = 0x00007f6ada79b8b0    r9 = 0x00007f6adb913740
r10 = 0x00000000ffffffc7   r11 = 0x0000000000000000
r12 = 0x00000000cd1e4b01   r13 = 0x00007f6ac08bae20
r14 = 0x0000000000000000   r15 = 0x00007ffc7e70a7df
rip = 0x00007f6acaba910b
OS|Linux|0.0.0 Linux 4.15.0-33-generic #36-Ubuntu SMP Wed Aug 15 16:00:05 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::dom::AudioContext::OnStateChanged(void*, mozilla::dom::AudioContextState)|hg:hg.mozilla.org/mozilla-central:dom/media/webaudio/AudioContext.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|926|0x18
0|1|libxul.so|mozilla::dom::StateChangeTask::Run()|hg:hg.mozilla.org/mozilla-central:dom/media/webaudio/AudioContext.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|830|0x1f
0|2|libxul.so|mozilla::EventTargetWrapper::Runner::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/AbstractThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|150|0x6
0|3|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|337|0x15
0|4|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1161|0x15
0|5|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|519|0x11
0|6|libxul.so|mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|334|0x11
0|7|libxul.so|mozilla::dom::XMLHttpRequestMainThread::Send(JSContext*, mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/xhr/XMLHttpRequestMainThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2768|0x8
0|8|libxul.so|mozilla::dom::XMLHttpRequest_Binding::send|s3:gecko-generated-sources:e3b868314679b42dd3a09d144bd253108da5bedb13966ce276efac5ec4730aea644579d6d1218a669dff41788cd5a7f305b436ba302cf802bfc76d926c804fb1/dom/bindings/XMLHttpRequestBinding.cpp:|1275|0x20
0|9|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|3296|0x9
0|10|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|449|0x3
0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|537|0xf
0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|588|0xd
0|13|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|594|0xf
0|14|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|429|0xb
0|15|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|561|0xf
0|16|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|588|0xd
0|17|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|607|0x5
0|18|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2867|0x1c
0|19|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:ccbadb8791154c00d5d9f3f34300a418cdfa4b3b0b60424e60394883162a95118b3edbfce81cbc7a5b48193d5a2618fc449143e250bd5c61dd1340709a3af189/dom/bindings/EventListenerBinding.cpp:|51|0x5
0|20|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|21|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1108|0x26
0|22|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1342|0x19
0|23|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|391|0x6
0|24|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|637|0x12
0|25|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1113|0xb
0|26|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1168|0x2c
0|27|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|7094|0x18
0|28|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|6887|0x18
0|29|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1313|0x2b
0|30|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|856|0x22
0|31|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|745|0xf
0|32|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|631|0x16
0|33|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|629|0x1f
0|34|libxul.so|nsIDocument::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|8305|0x20
0|35|libxul.so|nsDocument::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|8227|0x5
0|36|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|5099|0x11
0|37|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1178|0x13
0|38|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|337|0x15
0|39|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1161|0x15
0|40|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|519|0x11
0|41|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|97|0xa
0|42|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|325|0x17
0|43|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|318|0x8
0|44|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|158|0xd
0|45|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|944|0x11
0|46|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|269|0x5
0|47|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|325|0x17
0|48|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|318|0x8
0|49|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|770|0x8
0|50|firefox|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|50|0x14
0|51|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|287|0x11
0|52|libc-2.27.so||||0x21b97
0|53|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|164|0x5
Flags: in-testsuite?
Flags: needinfo?(karlt)
Priority: -- → P3
Blocks: 1170547
Flags: needinfo?(karlt)

A Pernosco session is available here: https://pernos.co/debug/iLa1wQFASowPWdfW7hDRHQ/index.html

Flags: needinfo?(apehrson)

This assertion fails because we double-close an AudioContext. No surprise there.

There is a guard in AudioContext::Close() that seems intended to catch this, but it looks only at mAudioContextState which is set async.

Its of old origin, and not looking at mCloseCalled seems like an oversight, as the guard and mCloseCalled were implemented in the same patch, and Suspend() and Resume() have similar guards though these do account for mCloseCalled. The guard in Close() didn't, already then.

I'll see whether adding a check for mCloseCalled to the Close() guard is sufficient.

Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)
See Also: → 1644647
Attachment #9190531 - Attachment description: Bug 1489160 - Account for pending closed state in AudioContext::Close. r?karlt → Bug 1489160 - Per spec, check for control thread state instead of state attribute in AudioContext::Close. r?karlt
Attachment #9190531 - Attachment description: Bug 1489160 - Per spec, check for control thread state instead of state attribute in AudioContext::Close. r?karlt → Bug 1489160 - Check mCloseCalled instead of mAudioContextState when checking for a closed AudioContext. r?karlt!
Attachment #9190794 - Attachment is obsolete: true
Pushed by pehrsons@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/0f8c3d54dea3
Add crashtest. r=karlt
https://hg.mozilla.org/integration/autoland/rev/76c777a96473
Check mCloseCalled instead of mAudioContextState when checking for a closed AudioContext. r=karlt

https://hg.mozilla.org/mozilla-central/rev/0f8c3d54dea3
https://hg.mozilla.org/mozilla-central/rev/76c777a96473

Status: ASSIGNED → RESOLVED
Closed: 3 years ago
status-firefox85: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 85 Branch
status-firefox64: affected → wontfix
status-firefox83: --- → wontfix
status-firefox84: --- → wontfix
status-firefox-esr78: --- → wontfix
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: