Closed Bug 1538727 Opened 1 year ago Closed 1 year ago

Assertion failure: false (Not connected to this video track), at /builds/worker/workspace/build/src/dom/media/encoder/MediaEncoder.cpp:612

Categories

(Core :: Audio/Video: Recording, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla68
Tracking Status
firefox-esr60 --- unaffected
firefox67 --- wontfix
firefox68 --- fixed

People

(Reporter: jkratzer, Assigned: pehrsons)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 4a692c812a3f.

Assertion failure: false (Not connected to this video track), at /builds/worker/workspace/build/src/dom/media/encoder/MediaEncoder.cpp:612

rax = 0x0000562af5683e40 rdx = 0x00007f06bc3293db
rcx = 0x0000000000000b40 rbx = 0x00007f06ae9aa550
rsi = 0x00007f06c8fc38b0 rdi = 0x00007f06c8fc2680
rbp = 0x00007ffe5d693110 rsp = 0x00007ffe5d6930f0
r8 = 0x00007f06c8fc38b0 r9 = 0x00007f06ca145740
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x00007f06ae9ad800 r13 = 0x0000000000000000
r14 = 0xffffffffffffffff r15 = 0x00007f06aef6cfb8
rip = 0x00007f06b852f7bb
OS|Linux|0.0.0 Linux 4.19.13-coreos #1 SMP Mon Jan 7 23:51:04 -00 2019 x86_64
CPU|amd64|family 6 model 79 stepping 1|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::MediaEncoder::RemoveMediaStreamTrack(mozilla::dom::MediaStreamTrack*)|hg:hg.mozilla.org/mozilla-central:dom/media/encoder/MediaEncoder.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|601|0x0
0|1|libxul.so|mozilla::dom::MediaRecorder::Session::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaRecorder.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|517|0x14
0|2|libxul.so|mozilla::DOMMediaStream::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1016|0xf
0|3|libxul.so|mozilla::DOMMediaStream::RemoveTrack(mozilla::dom::MediaStreamTrack&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|500|0x16
0|4|libxul.so|mozilla::dom::MediaStream_Binding::removeTrack|s3:gecko-generated-sources:3260d1e127e21679f3543986aca76ef9c80fb47da1a6bf2a609b09e6af3af9202a74ab7c5b3fd0a548157c121466479aae6845ddb9af802e8d9f88a68100aef3/dom/bindings/MediaStreamBinding.cpp:|1096|0xc
0|5|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|3144|0x9
0|6|libxul.so|CallJSNative(JSContext*, bool ()(JSContext, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|442|0x6
0|7|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|534|0xf
0|8|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|589|0xd
0|9|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|593|0xf
0|10|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|422|0xb
0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|562|0xf
0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|589|0xd
0|13|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|605|0x5
0|14|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|2623|0x1c
0|15|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:b504f583ed3111ab416617cd63caa012e7478d0516eb5d3bc3cd43cef007715c1a91854c0528b0ec8e85f6341ccebf73a1b2c32556687ebaf4023e3c38ff4197/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|16|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|17|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1039|0x1e
0|18|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1237|0x19
0|19|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:b9d87882a36584e2f17331b652cbc8681aee17ce|351|0x6
0|20|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|553|0x12
0|21|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1049|0x1a
0|22|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports
, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1149|0x19
0|23|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1025|0x5
0|24|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4054|0x30
0|25|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4025|0x19
0|26|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4698|0x5
0|27|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:b9d87882a36584e2f17331b652cbc8681aee17ce|1122|0x13
0|28|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|295|0x15
0|29|libxul.so|nsThread::ProcessNextEvent(bool, bool
)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1179|0x15
0|30|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|482|0x11
0|31|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|88|0xa
0|32|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|315|0x17
0|33|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|308|0x8
0|34|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|137|0xd
0|35|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|911|0x11
0|36|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|238|0x5
0|37|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|315|0x17
0|38|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|308|0x8
0|39|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|749|0xc
0|40|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|49|0x14
0|41|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|265|0x11
0|42|libc-2.27.so||||0x21b97
0|43|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b9d87882a36584e2f17331b652cbc8681aee17ce|184|0x5

Flags: in-testsuite?

Andreas, can you take a look?

Rank: 14
Flags: needinfo?(apehrson)
Priority: -- → P2
Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)

These are added in start, and we get into unexpected state if they notify us
after Stop() (when MediaEncoder shuts down and internally removes the tracks
it is encoding) but before Shutdown() when we remove the listeners. This is not
symmetrical. The proper thing to do is to remove these listeners in Stop() as
well.

Depends on D29080

Pushed by bvandyk@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1fdcbbc79e87
Add crashtest. r=bryce
https://hg.mozilla.org/integration/autoland/rev/eabc25a9ff76
Move TrackListener and track-PrincipalChangeObserver removal to Stop(). r=bryce
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.