1538727 - Assertion failure: false (Not connected to this video track), at /builds/worker/workspace/build/src/dom/media/encoder/MediaEncoder.cpp:612

Status: RESOLVED FIXED

(Core :: Audio/Video: Recording, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 4a692c812a3f.

Assertion failure: false (Not connected to this video track), at /builds/worker/workspace/build/src/dom/media/encoder/MediaEncoder.cpp:612

rax = 0x0000562af5683e40 rdx = 0x00007f06bc3293db
rcx = 0x0000000000000b40 rbx = 0x00007f06ae9aa550
rsi = 0x00007f06c8fc38b0 rdi = 0x00007f06c8fc2680
rbp = 0x00007ffe5d693110 rsp = 0x00007ffe5d6930f0
r8 = 0x00007f06c8fc38b0 r9 = 0x00007f06ca145740
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x00007f06ae9ad800 r13 = 0x0000000000000000
r14 = 0xffffffffffffffff r15 = 0x00007f06aef6cfb8
rip = 0x00007f06b852f7bb
OS|Linux|0.0.0 Linux 4.19.13-coreos #1 SMP Mon Jan 7 23:51:04 -00 2019 x86_64
CPU|amd64|family 6 model 79 stepping 1|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::MediaEncoder::RemoveMediaStreamTrack(mozilla::dom::MediaStreamTrack*)|hg:hg.mozilla.org/mozilla-central:dom/media/encoder/MediaEncoder.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|601|0x0
0|1|libxul.so|mozilla::dom::MediaRecorder::Session::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaRecorder.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|517|0x14
0|2|libxul.so|mozilla::DOMMediaStream::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1016|0xf
0|3|libxul.so|mozilla::DOMMediaStream::RemoveTrack(mozilla::dom::MediaStreamTrack&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|500|0x16
0|4|libxul.so|mozilla::dom::MediaStream_Binding::removeTrack|s3:gecko-generated-sources:3260d1e127e21679f3543986aca76ef9c80fb47da1a6bf2a609b09e6af3af9202a74ab7c5b3fd0a548157c121466479aae6845ddb9af802e8d9f88a68100aef3/dom/bindings/MediaStreamBinding.cpp:|1096|0xc
0|5|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|3144|0x9
0|6|libxul.so|CallJSNative(JSContext*, bool ()(JSContext, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|442|0x6
0|7|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|534|0xf
0|8|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|589|0xd
0|9|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|593|0xf
0|10|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|422|0xb
0|11|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|562|0xf
0|12|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|589|0xd
0|13|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|605|0x5
0|14|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|2623|0x1c
0|15|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:b504f583ed3111ab416617cd63caa012e7478d0516eb5d3bc3cd43cef007715c1a91854c0528b0ec8e85f6341ccebf73a1b2c32556687ebaf4023e3c38ff4197/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|16|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|17|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1039|0x1e
0|18|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1237|0x19
0|19|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:b9d87882a36584e2f17331b652cbc8681aee17ce|351|0x6
0|20|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|553|0x12
0|21|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1049|0x1a
0|22|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1149|0x19
0|23|libxul.so|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1025|0x5
0|24|libxul.so|nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4054|0x30
0|25|libxul.so|nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4025|0x19
0|26|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|4698|0x5
0|27|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:b9d87882a36584e2f17331b652cbc8681aee17ce|1122|0x13
0|28|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|295|0x15
0|29|libxul.so|nsThread::ProcessNextEvent(bool, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|1179|0x15
0|30|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|482|0x11
0|31|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|88|0xa
0|32|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|315|0x17
0|33|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|308|0x8
0|34|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|137|0xd
0|35|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|911|0x11
0|36|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|238|0x5
0|37|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|315|0x17
0|38|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b9d87882a36584e2f17331b652cbc8681aee17ce|308|0x8
0|39|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|749|0xc
0|40|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|49|0x14
0|41|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b9d87882a36584e2f17331b652cbc8681aee17ce|265|0x11
0|42|libc-2.27.so||||0x21b97
0|43|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b9d87882a36584e2f17331b652cbc8681aee17ce|184|0x5

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Andreas, can you take a look?

Comment 2

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1538727 - Add crashtest. r?bryce

Comment 3

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1538727 - Move TrackListener and track-PrincipalChangeObserver removal to Stop(). r?bryce

These are added in start, and we get into unexpected state if they notify us
after Stop() (when MediaEncoder shuts down and internally removes the tracks
it is encoding) but before Shutdown() when we remove the listeners. This is not
symmetrical. The proper thing to do is to remove these listeners in Stop() as
well.

Depends on D29080

Comment 4

[Andreas Pehrson [:pehrsons]]

Test-only: https://treeherder.mozilla.org/#/jobs?repo=try&revision=456fbc654b336beee107a9f2b7e0674f2e0d6c03
With fix: https://treeherder.mozilla.org/#/jobs?repo=try&revision=5f00dd270f01b2396b5bb243ee8c59320ef7ef7c

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1fdcbbc79e87
Add crashtest. r=bryce
https://hg.mozilla.org/integration/autoland/rev/eabc25a9ff76
Move TrackListener and track-PrincipalChangeObserver removal to Stop(). r=bryce

Comment 6

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/1fdcbbc79e87
https://hg.mozilla.org/mozilla-central/rev/eabc25a9ff76