1547899 - AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadLocal.h:158:33 in get

Status: RESOLVED FIXED

(Core :: Audio/Video, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 420e18a75314.

==28636==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000058 (pc 0x7fe5fa176130 bp 0x7ffc5d1087f0 sp 0x7ffc5d1087d0 T0)
==28636==The signal is caused by a READ memory access.
==28636==Hint: address points to the zero page.
#0 0x7fe5fa17612f in get /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadLocal.h:158:33
#1 0x7fe5fa17612f in get /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/ThreadLocal.h:203
#2 0x7fe5fa17612f in AutoEnter /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/AbstractThread.h:126
#3 0x7fe5fa17612f in mozilla::MediaDecoder::RemoveOutputStream(mozilla::DOMMediaStream*) /builds/worker/workspace/build/src/dom/media/MediaDecoder.cpp:261
#4 0x7fe5f9e4cc5c in mozilla::dom::HTMLMediaElement::PlaybackEnded() /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:5102:19
#5 0x7fe5f9ea4d0f in mozilla::dom::HTMLMediaElement::MediaStreamTrackListener::NotifyInactive() /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:4638:15
#6 0x7fe5fa104368 in mozilla::DOMMediaStream::NotifyInactive() /builds/worker/workspace/build/src/dom/media/DOMMediaStream.cpp:926:25
#7 0x7fe5fa11585f in mozilla::DOMMediaStream::PlaybackTrackListener::NotifyEnded(mozilla::dom::MediaStreamTrack*) /builds/worker/workspace/build/src/dom/media/DOMMediaStream.cpp:125:14
#8 0x7fe5fa49d021 in mozilla::dom::MediaStreamTrack::NotifyEnded() /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:472:17
#9 0x7fe5fa4a21cb in mozilla::dom::MediaStreamTrack::OverrideEnded() /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:558:3
#10 0x7fe5fa7cfbe4 in applyImpl<mozilla::dom::MediaStreamTrack, void (mozilla::dom::MediaStreamTrack::)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1122:12
#11 0x7fe5fa7cfbe4 in apply<mozilla::dom::MediaStreamTrack, void (mozilla::dom::MediaStreamTrack::)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1128
#12 0x7fe5fa7cfbe4 in mozilla::detail::RunnableMethodImpl<RefPtr<mozilla::dom::MediaStreamTrack>, void (mozilla::dom::MediaStreamTrack::)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1174
#13 0x7fe5f184f341 in nsThread::ProcessNextEvent(bool, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1180:14
#14 0x7fe5f1856f64 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
#15 0x7fe5f2bbd07f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
#16 0x7fe5f2a95dfe in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
#17 0x7fe5f2a95dfe in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
#18 0x7fe5f2a95dfe in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
#19 0x7fe5fc15aad3 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
#20 0x7fe600765d7e in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:919:20
#21 0x7fe5f2a95dfe in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
#22 0x7fe5f2a95dfe in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308
#23 0x7fe5f2a95dfe in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290
#24 0x7fe600764eec in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:757:34
#25 0x5593a322472e in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
#26 0x5593a322472e in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:263
#27 0x7fe615987b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

Comment 1

[neerajdana9]

For best software development courses visit https://www.smartcodehub.com

Comment 2

[Patricia Lawless]

Hi Nils, will this be fixed for 68? (asking in relation to regression triage) Thanks!

Comment 3

[Andreas Pehrson [:pehrsons]]

This looks like mine, thanks Julien.

FWIW I disagree with P1. This can only happen when you use HTMLMediaElement.mozCaptureStream() (little use), and even so it's probably a race that comes up as a narrow corner case.

To answer Patricia, we should be able to have this fixed in 68. Hopefully that's also where we the regression stems from.

Comment 4

[Timea Cernea [:tbabos][inactive]]

Updating flags for affected versions.

Comment 5

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1547899 - Add crashtest. r?jib

Comment 6

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1547899 - Discard output streams also when playback is aborted. r?jib

This was done as a catch-all in PlaybackEnded(), but playback might not end if
the source changes in the middle of playback. This catches those cases too.

Depends on D35320

Comment 7

[Andreas Pehrson [:pehrsons]]

Test-only: https://treeherder.mozilla.org/#/jobs?repo=try&revision=fa35e8de1a4fec1c5e127878de5c903d07d9a648
With fix: https://treeherder.mozilla.org/#/jobs?repo=try&revision=6b09859bb13ad88d0e89ddce3e8e4f4530b4fce1

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d307df237d65
Add crashtest. r=jib
https://hg.mozilla.org/integration/autoland/rev/b31c7c9f1920
Discard output streams also when playback is aborted. r=jib

Comment 9

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/d307df237d65
https://hg.mozilla.org/mozilla-central/rev/b31c7c9f1920

Comment 10

[Andreas Pehrson [:pehrsons]]

Comment on attachment 9072823 [details]
Bug 1547899 - Discard output streams also when playback is aborted. r?jib

Beta/Release Uplift Approval Request

• User impact if declined: A null pointer de-referencing crash could be triggered at will.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Simple enough.
• String changes made/needed:

Comment 11

[Julien Cristau [:jcristau]]

Comment on attachment 9072823 [details]
Bug 1547899 - Discard output streams also when playback is aborted. r?jib

alright let's take this for 68 rc1

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-release/rev/478af069d3f6
https://hg.mozilla.org/releases/mozilla-release/rev/561858d2d2a9

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-esr68/rev/478af069d3f6
https://hg.mozilla.org/releases/mozilla-esr68/rev/561858d2d2a9

Comment 14

[Anca Soncutean, Desktop QA]

(In reply to Andreas Pehrson [:pehrsons] from comment #10)

• Is this code covered by automated tests?: Yes
• Needs manual test from QE?: No

Marking this as qe-verify- per Andreas' assessment.