Assertion failure: false (Not connected to this video track), at /builds/worker/workspace/build/src/dom/media/encoder/MediaEncoder.cpp:612

RESOLVED FIXED in Firefox 68

Status

()

defect
P2
normal
Rank:
14
RESOLVED FIXED
4 months ago
Last month

People

(Reporter: jkratzer, Assigned: pehrsons)

Tracking

(Blocks 1 bug, {assertion, testcase})

Trunk
mozilla68
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox-esr60 unaffected, firefox67 wontfix, firefox68 fixed)

Details

Attachments

(3 attachments)

Posted file testcase.html

Testcase found while fuzzing mozilla-central rev 4a692c812a3f.

Assertion failure: false (Not connected to this video track), at /builds/worker/workspace/build/src/dom/media/encoder/MediaEncoder.cpp:612

rax = 0x0000562af5683e40 rdx = 0x00007f06bc3293db
rcx = 0x0000000000000b40 rbx = 0x00007f06ae9aa550
rsi = 0x00007f06c8fc38b0 rdi = 0x00007f06c8fc2680
rbp = 0x00007ffe5d693110 rsp = 0x00007ffe5d6930f0
r8 = 0x00007f06c8fc38b0 r9 = 0x00007f06ca145740
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x00007f06ae9ad800 r13 = 0x0000000000000000
r14 = 0xffffffffffffffff r15 = 0x00007f06aef6cfb8
rip = 0x00007f06b852f7bb
OS|Linux|0.0.0 Linux 4.19.13-coreos #1 SMP Mon Jan 7 23:51:04 -00 2019 x86_64
CPU|amd64|family 6 model 79 stepping 1|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::MediaEncoder::RemoveMediaStreamTrack(mozilla::dom::MediaStreamTrack*)|hg:hg.mozilla.org/mozilla-central:dom/media/encoder/MediaEncoder.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|601|0x0
0|1|libxul.so|mozilla::dom::MediaRecorder::Session::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaRecorder.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|517|0x14
0|2|libxul.so|mozilla::DOMMediaStream::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1016|0xf
0|3|libxul.so|mozilla::DOMMediaStream::RemoveTrack(mozilla::dom::MediaStreamTrack&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|500|0x16
0|4|libxul.so|mozilla::dom::MediaStream_Binding::removeTrack|s3:gecko-generated-sources:3260d1e127e21679f3543986aca76ef9c80fb47da1a6bf2a609b09e6af3af9202a74ab7c5b3fd0a548157c121466479aae6845ddb9af802e8d9f88a68100aef3/dom/bindings/MediaStreamBinding.cpp:|1096|0xc
0|5|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|3144|0x9
0|6|libxul.so|CallJSNative(JSContext*, bool ()(JSContext, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|442|0x6
0|7|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|534|0xf
0|8|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|589|0xd
0|9|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|593|0xf
0|10|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|422|0xb
0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|562|0xf
0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|589|0xd
0|13|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|605|0x5
0|14|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|2623|0x1c
0|15|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:b504f583ed3111ab416617cd63caa012e7478d0516eb5d3bc3cd43cef007715c1a91854c0528b0ec8e85f6341ccebf73a1b2c32556687ebaf4023e3c38ff4197/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|16|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|17|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1039|0x1e
0|18|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1237|0x19
0|19|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:b9d87882a36584e2f17331b652cbc8681aee17ce|351|0x6
0|20|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|553|0x12
0|21|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1049|0x1a
0|22|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports
, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1149|0x19
0|23|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1025|0x5
0|24|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4054|0x30
0|25|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4025|0x19
0|26|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4698|0x5
0|27|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:b9d87882a36584e2f17331b652cbc8681aee17ce|1122|0x13
0|28|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|295|0x15
0|29|libxul.so|nsThread::ProcessNextEvent(bool, bool
)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1179|0x15
0|30|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|482|0x11
0|31|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|88|0xa
0|32|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|315|0x17
0|33|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|308|0x8
0|34|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|137|0xd
0|35|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|911|0x11
0|36|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|238|0x5
0|37|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|315|0x17
0|38|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|308|0x8
0|39|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|749|0xc
0|40|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|49|0x14
0|41|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|265|0x11
0|42|libc-2.27.so||||0x21b97
0|43|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b9d87882a36584e2f17331b652cbc8681aee17ce|184|0x5

Flags: in-testsuite?

Andreas, can you take a look?

Rank: 14
Flags: needinfo?(apehrson)
Priority: -- → P2
Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)

These are added in start, and we get into unexpected state if they notify us
after Stop() (when MediaEncoder shuts down and internally removes the tracks
it is encoding) but before Shutdown() when we remove the listeners. This is not
symmetrical. The proper thing to do is to remove these listeners in Stop() as
well.

Depends on D29080

Pushed by bvandyk@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1fdcbbc79e87
Add crashtest. r=bryce
https://hg.mozilla.org/integration/autoland/rev/eabc25a9ff76
Move TrackListener and track-PrincipalChangeObserver removal to Stop(). r=bryce
Status: ASSIGNED → RESOLVED
Closed: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.