Closed Bug 1489160 Opened 6 years ago Closed 4 years ago

Assertion failure: false, at /builds/worker/workspace/build/src/dom/media/webaudio/AudioContext.cpp:926

Categories

(Core :: Web Audio, defect, P3)

Product:
Core
Component:
Web Audio
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
85 Branch
Tracking Flags:
Tracking Status
firefox-esr78 --- wontfix
firefox64 --- wontfix
firefox83 --- wontfix
firefox84 --- wontfix
firefox85 --- fixed

People

(Reporter: jkratzer, Assigned: pehrsons)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files, 1 obsolete file)

testcase.html
574 bytes, text/html
Details
Bug 1489160 - Add crashtest. r?karlt
47 bytes, text/x-phabricator-request
Details | Review
Bug 1489160 - Check mCloseCalled instead of mAudioContextState when checking for a closed AudioContext. r?karlt!
47 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —
Testcase found while fuzzing mozilla-central rev 0c947d96e8f3. Assertion failure: false, at /builds/worker/workspace/build/src/dom/media/webaudio/AudioContext.cpp:926 rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x0000000000000b40 rbx = 0x00007f6ac2f71ac0 rsi = 0x00007f6ada79b8b0 rdi = 0x00007f6ada79a680 rbp = 0x00007ffc7e70a190 rsp = 0x00007ffc7e70a150 r8 = 0x00007f6ada79b8b0 r9 = 0x00007f6adb913740 r10 = 0x00000000ffffffc7 r11 = 0x0000000000000000 r12 = 0x00000000cd1e4b01 r13 = 0x00007f6ac08bae20 r14 = 0x0000000000000000 r15 = 0x00007ffc7e70a7df rip = 0x00007f6acaba910b OS|Linux|0.0.0 Linux 4.15.0-33-generic #36-Ubuntu SMP Wed Aug 15 16:00:05 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV /SEGV_MAPERR|0x0|0 0|0|libxul.so|mozilla::dom::AudioContext::OnStateChanged(void*, mozilla::dom::AudioContextState)|hg:hg.mozilla.org/mozilla-central:dom/media/webaudio/AudioContext.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|926|0x18 0|1|libxul.so|mozilla::dom::StateChangeTask::Run()|hg:hg.mozilla.org/mozilla-central:dom/media/webaudio/AudioContext.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|830|0x1f 0|2|libxul.so|mozilla::EventTargetWrapper::Runner::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/AbstractThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|150|0x6 0|3|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|337|0x15 0|4|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1161|0x15 0|5|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|519|0x11 0|6|libxul.so|mozilla::dom::XMLHttpRequestMainThread::SendInternal(mozilla::dom::BodyExtractorBase const*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|334|0x11 0|7|libxul.so|mozilla::dom::XMLHttpRequestMainThread::Send(JSContext*, mozilla::dom::Nullable<mozilla::dom::DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString> const&, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/xhr/XMLHttpRequestMainThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2768|0x8 0|8|libxul.so|mozilla::dom::XMLHttpRequest_Binding::send|s3:gecko-generated-sources:e3b868314679b42dd3a09d144bd253108da5bedb13966ce276efac5ec4730aea644579d6d1218a669dff41788cd5a7f305b436ba302cf802bfc76d926c804fb1/dom/bindings/XMLHttpRequestBinding.cpp:|1275|0x20 0|9|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|3296|0x9 0|10|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|449|0x3 0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|537|0xf 0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|588|0xd 0|13|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|594|0xf 0|14|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|429|0xb 0|15|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|561|0xf 0|16|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|588|0xd 0|17|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|607|0x5 0|18|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|2867|0x1c 0|19|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:ccbadb8791154c00d5d9f3f34300a418cdfa4b3b0b60424e60394883162a95118b3edbfce81cbc7a5b48193d5a2618fc449143e250bd5c61dd1340709a3af189/dom/bindings/EventListenerBinding.cpp:|51|0x5 0|20|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c 0|21|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1108|0x26 0|22|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1342|0x19 0|23|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|391|0x6 0|24|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|637|0x12 0|25|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1113|0xb 0|26|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1168|0x2c 0|27|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|7094|0x18 0|28|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|6887|0x18 0|29|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1313|0x2b 0|30|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|856|0x22 0|31|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|745|0xf 0|32|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|631|0x16 0|33|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|629|0x1f 0|34|libxul.so|nsIDocument::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|8305|0x20 0|35|libxul.so|nsDocument::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|8227|0x5 0|36|libxul.so|nsIDocument::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|5099|0x11 0|37|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1178|0x13 0|38|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|337|0x15 0|39|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|1161|0x15 0|40|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|519|0x11 0|41|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|97|0xa 0|42|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|325|0x17 0|43|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|318|0x8 0|44|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|158|0xd 0|45|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|944|0x11 0|46|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|269|0x5 0|47|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|325|0x17 0|48|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|318|0x8 0|49|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|770|0x8 0|50|firefox|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|50|0x14 0|51|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|287|0x11 0|52|libc-2.27.so||||0x21b97 0|53|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:0c947d96e8f3c9f04979975c69aa7d0bcb8a4266|164|0x5
Flags: in-testsuite?
Flags: needinfo?(karlt)
Priority: -- → P3
Blocks: 1170547
Flags: needinfo?(karlt)

A Pernosco session is available here: https://pernos.co/debug/iLa1wQFASowPWdfW7hDRHQ/index.html

Flags: needinfo?(apehrson)

This assertion fails because we double-close an AudioContext. No surprise there.

There is a guard in AudioContext::Close() that seems intended to catch this, but it looks only at mAudioContextState which is set async.

Its of old origin, and not looking at mCloseCalled seems like an oversight, as the guard and mCloseCalled were implemented in the same patch, and Suspend() and Resume() have similar guards though these do account for mCloseCalled. The guard in Close() didn't, already then.

I'll see whether adding a check for mCloseCalled to the Close() guard is sufficient.

Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)
See Also: → 1644647
Attachment #9190531 - Attachment description: Bug 1489160 - Account for pending closed state in AudioContext::Close. r?karlt → Bug 1489160 - Per spec, check for control thread state instead of state attribute in AudioContext::Close. r?karlt
Attachment #9190531 - Attachment description: Bug 1489160 - Per spec, check for control thread state instead of state attribute in AudioContext::Close. r?karlt → Bug 1489160 - Check mCloseCalled instead of mAudioContextState when checking for a closed AudioContext. r?karlt!
Attachment #9190794 - Attachment is obsolete: true
Pushed by pehrsons@gmail.com: https://hg.mozilla.org/integration/autoland/rev/0f8c3d54dea3 Add crashtest. r=karlt https://hg.mozilla.org/integration/autoland/rev/76c777a96473 Check mCloseCalled instead of mAudioContextState when checking for a closed AudioContext. r=karlt

https://hg.mozilla.org/mozilla-central/rev/0f8c3d54dea3
https://hg.mozilla.org/mozilla-central/rev/76c777a96473

Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox85: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 85 Branch
status-firefox64: affected → wontfix
status-firefox83: --- → wontfix
status-firefox84: --- → wontfix
status-firefox-esr78: --- → wontfix
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: