Closed Bug 1553262 Opened 11 months ago Closed 10 months ago

Assertion failure: ms.mCapturingMediaStream, at /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:2267

Categories

(Core :: Audio/Video: Playback, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla69
Tracking Status
firefox-esr60 --- wontfix
firefox67 --- wontfix
firefox68 --- wontfix
firefox69 --- fixed

People

(Reporter: jkratzer, Assigned: pehrsons)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(3 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev b74e5737da64.

Assertion failure: ms.mCapturingMediaStream, at /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:2267

rax = 0x000055ff80139e40   rdx = 0x0000000000000000
rcx = 0x00007f3253b7c1f8   rbx = 0x00007f325e679000
rsi = 0x00007f325ec7c8b0   rdi = 0x00007f325ec7b680
rbp = 0x00007ffce5bb8c50   rsp = 0x00007ffce5bb8b20
r8 = 0x00007f325ec7c8b0    r9 = 0x00007f325fde6740
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f325e679148   r13 = 0x0000000000000000
r14 = 0x00007ffce5bb8ba8   r15 = 0x00007f32457ae828
rip = 0x00007f324fae22fc
OS|Linux|0.0.0 Linux 4.18.0-17-generic #18~18.04.1-Ubuntu SMP Fri Mar 15 15:27:12 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::HTMLMediaElement::NotifyMediaTrackDisabled(mozilla::dom::MediaTrack*)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2221|0x51
0|1|libxul.so|mozilla::dom::VideoTrack::SetEnabledInternal(bool, int)|hg:hg.mozilla.org/mozilla-central:dom/media/VideoTrack.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|82|0x8
0|2|libxul.so|mozilla::dom::MediaTrackList::EmptyTracks()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaTrackList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|106|0x20
0|3|libxul.so|mozilla::dom::HTMLMediaElement::AbortExistingLoads()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1802|0x9
0|4|libxul.so|mozilla::dom::HTMLMediaElement::DoLoad()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2033|0x5
0|5|libxul.so|mozilla::dom::HTMLMediaElement_Binding::set_srcObject|s3:gecko-generated-sources:642295f38fa128c7d13034ab7d13ca43a717a644e33db44cee86d0da8cd623a2dbc3adabde68d3fe2ef03116c8e546bf3a474f9b65d69a2da5c04f607127e791/dom/bindings/HTMLMediaElementBinding.cpp:|2079|0x5
0|6|libxul.so|bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3118|0x1d
0|7|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|443|0x13
0|8|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|535|0x12
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|590|0xd
0|10|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|606|0x5
0|11|libxul.so|js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|744|0x22
0|12|libxul.so|SetExistingProperty|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2879|0x1b
0|13|libxul.so|bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2908|0x2d
0|14|libxul.so|js::jit::DoSetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICSetProp_Fallback*, JS::Value*, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineIC.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3070|0x1e
0|15|||||0x1fecf1d2f005
0|16|||||0x1fecf1d15ac4
0|17|libxul.so|js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*)|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineJIT.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|199|0x1af
0|18|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1989|0x14
0|19|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|423|0xb
0|20|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|563|0xf
0|21|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|590|0xd
0|22|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|606|0x5
0|23|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2655|0x1c
0|24|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:9ca8646d8042e9b4b76d2e1b358b984be17743b71b832c0897d61bb500e0fecbe38fa54273dc522878c87fcb2c9bfd274a8190c7bc56fbbb58cb3ca68462e527/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|25|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|26|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1039|0x1e
0|27|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1239|0x19
0|28|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|351|0x6
0|29|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|551|0x12
0|30|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1048|0x1a
0|31|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1105|0x25
0|32|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6647|0x14
0|33|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6447|0x18
0|34|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1315|0x64
0|35|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|874|0x2a
0|36|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|712|0x15
0|37|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|600|0x16
0|38|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|568|0x17
0|39|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8031|0x20
0|40|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|7963|0x5
0|41|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|5101|0xd
0|42|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:b74e5737da64a7af28ab4f81f996950917aa71c5|1174|0x13
0|43|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|295|0x15
0|44|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1175|0x15
0|45|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|486|0x11
0|46|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|88|0xa
0|47|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|315|0x17
0|48|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|290|0x8
0|49|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|137|0xd
0|50|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|911|0x11
0|51|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|238|0x5
0|52|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|315|0x17
0|53|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|290|0x8
0|54|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|749|0xc
0|55|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|56|0x14
0|56|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|263|0x11
0|57|libc-2.27.so||||0x21b97
0|58|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b74e5737da64a7af28ab4f81f996950917aa71c5|184|0x5
Flags: in-testsuite?
Component: DOM: Core & HTML → Audio/Video: Playback
Priority: -- → P2
Assignee: nobody → apehrson
Status: NEW → ASSIGNED

A crashtest oddly enough led to unrelated hangs.

Video tracks are not added to output streams that capture only audio, so we
cannot assume that an output stream that captures only audio has been locked to
capture MediaStream sources when a video track is removed.

Depends on D34854

Pushed by pehrsons@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/71f8404697a7
Add mochitest. r=jib
https://hg.mozilla.org/integration/autoland/rev/ce18030071c4
Ignore removing video tracks for streams that only capture audio. r=jib
Status: ASSIGNED → RESOLVED
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69

Is there a user impact which justifies backport consideration here or can this patch ride the trains?

Flags: needinfo?(apehrson)
Flags: in-testsuite?
Flags: in-testsuite+

It can ride the trains. There's no impact on non-debug builds.

Flags: needinfo?(apehrson)
You need to log in before you can comment on or make changes to this bug.