1553262 - Assertion failure: ms.mCapturingMediaStream, at /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:2267

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev b74e5737da64.

Assertion failure: ms.mCapturingMediaStream, at /builds/worker/workspace/build/src/dom/html/HTMLMediaElement.cpp:2267

rax = 0x000055ff80139e40   rdx = 0x0000000000000000
rcx = 0x00007f3253b7c1f8   rbx = 0x00007f325e679000
rsi = 0x00007f325ec7c8b0   rdi = 0x00007f325ec7b680
rbp = 0x00007ffce5bb8c50   rsp = 0x00007ffce5bb8b20
r8 = 0x00007f325ec7c8b0    r9 = 0x00007f325fde6740
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x00007f325e679148   r13 = 0x0000000000000000
r14 = 0x00007ffce5bb8ba8   r15 = 0x00007f32457ae828
rip = 0x00007f324fae22fc
OS|Linux|0.0.0 Linux 4.18.0-17-generic #18~18.04.1-Ubuntu SMP Fri Mar 15 15:27:12 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::HTMLMediaElement::NotifyMediaTrackDisabled(mozilla::dom::MediaTrack*)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2221|0x51
0|1|libxul.so|mozilla::dom::VideoTrack::SetEnabledInternal(bool, int)|hg:hg.mozilla.org/mozilla-central:dom/media/VideoTrack.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|82|0x8
0|2|libxul.so|mozilla::dom::MediaTrackList::EmptyTracks()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaTrackList.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|106|0x20
0|3|libxul.so|mozilla::dom::HTMLMediaElement::AbortExistingLoads()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1802|0x9
0|4|libxul.so|mozilla::dom::HTMLMediaElement::DoLoad()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2033|0x5
0|5|libxul.so|mozilla::dom::HTMLMediaElement_Binding::set_srcObject|s3:gecko-generated-sources:642295f38fa128c7d13034ab7d13ca43a717a644e33db44cee86d0da8cd623a2dbc3adabde68d3fe2ef03116c8e546bf3a474f9b65d69a2da5c04f607127e791/dom/bindings/HTMLMediaElementBinding.cpp:|2079|0x5
0|6|libxul.so|bool mozilla::dom::binding_detail::GenericSetter<mozilla::dom::binding_detail::NormalThisPolicy>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3118|0x1d
0|7|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|443|0x13
0|8|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|535|0x12
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|590|0xd
0|10|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|606|0x5
0|11|libxul.so|js::CallSetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|744|0x22
0|12|libxul.so|SetExistingProperty|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2879|0x1b
0|13|libxul.so|bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/NativeObject.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2908|0x2d
0|14|libxul.so|js::jit::DoSetPropFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICSetProp_Fallback*, JS::Value*, JS::Handle<JS::Value>, JS::Handle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineIC.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|3070|0x1e
0|15|||||0x1fecf1d2f005
0|16|||||0x1fecf1d15ac4
0|17|libxul.so|js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*)|hg:hg.mozilla.org/mozilla-central:js/src/jit/BaselineJIT.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|199|0x1af
0|18|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1989|0x14
0|19|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|423|0xb
0|20|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|563|0xf
0|21|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|590|0xd
0|22|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|606|0x5
0|23|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|2655|0x1c
0|24|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:9ca8646d8042e9b4b76d2e1b358b984be17743b71b832c0897d61bb500e0fecbe38fa54273dc522878c87fcb2c9bfd274a8190c7bc56fbbb58cb3ca68462e527/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|25|libxul.so|void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|26|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1039|0x1e
0|27|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1239|0x19
0|28|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|351|0x6
0|29|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|551|0x12
0|30|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1048|0x1a
0|31|libxul.so|nsDocumentViewer::LoadComplete(nsresult)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1105|0x25
0|32|libxul.so|nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6647|0x14
0|33|libxul.so|nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|6447|0x18
0|34|libxul.so|nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1315|0x64
0|35|libxul.so|nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|874|0x2a
0|36|libxul.so|nsDocLoader::DocLoaderIsEmpty(bool)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|712|0x15
0|37|libxul.so|nsDocLoader::OnStopRequest(nsIRequest*, nsresult)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsDocLoader.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|600|0x16
0|38|libxul.so|mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsLoadGroup.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|568|0x17
0|39|libxul.so|mozilla::dom::Document::DoUnblockOnload()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|8031|0x20
0|40|libxul.so|mozilla::dom::Document::UnblockOnload(bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|7963|0x5
0|41|libxul.so|mozilla::dom::Document::DispatchContentLoadedEvents()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|5101|0xd
0|42|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:b74e5737da64a7af28ab4f81f996950917aa71c5|1174|0x13
0|43|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|295|0x15
0|44|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|1175|0x15
0|45|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|486|0x11
0|46|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|88|0xa
0|47|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|315|0x17
0|48|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|290|0x8
0|49|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|137|0xd
0|50|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|911|0x11
0|51|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|238|0x5
0|52|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|315|0x17
0|53|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:b74e5737da64a7af28ab4f81f996950917aa71c5|290|0x8
0|54|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|749|0xc
0|55|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|56|0x14
0|56|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:b74e5737da64a7af28ab4f81f996950917aa71c5|263|0x11
0|57|libc-2.27.so||||0x21b97
0|58|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:b74e5737da64a7af28ab4f81f996950917aa71c5|184|0x5

Comment 1

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1553262 - Add mochitest. r?jib

A crashtest oddly enough led to unrelated hangs.

Comment 2

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1553262 - Ignore removing video tracks for streams that only capture audio. r?jib

Video tracks are not added to output streams that capture only audio, so we
cannot assume that an output stream that captures only audio has been locked to
capture MediaStream sources when a video track is removed.

Depends on D34854

Comment 3

[Andreas Pehrson [:pehrsons]]

test-only: https://treeherder.mozilla.org/#/jobs?repo=try&revision=0bc549e1f7cc83356db1b865110b8097a652bcd1
with fix: https://treeherder.mozilla.org/#/jobs?repo=try&revision=aec6126bf874dd5ded52fc0373282757edee9b72

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/71f8404697a7
Add mochitest. r=jib
https://hg.mozilla.org/integration/autoland/rev/ce18030071c4
Ignore removing video tracks for streams that only capture audio. r=jib

Comment 5

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/71f8404697a7
https://hg.mozilla.org/mozilla-central/rev/ce18030071c4

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Is there a user impact which justifies backport consideration here or can this patch ride the trains?

Comment 7

[Andreas Pehrson [:pehrsons]]

It can ride the trains. There's no impact on non-debug builds.