Closed Bug 1573524 Opened 8 months ago Closed 7 months ago

Assertion failure: !Ended(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:376

Categories

(Core :: Audio/Video: Recording, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed

People

(Reporter: jkratzer, Assigned: pehrsons)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, testcase)

Attachments

(4 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 58400ee2747a.

Assertion failure: !Ended(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:376

rax = 0x000055de0edd71a0   rdx = 0x0000000000000000
rcx = 0x00007f11d1b2036f   rbx = 0x00007f11c2e1b7a0
rsi = 0x00007f11dd3fe8b0   rdi = 0x00007f11dd3fd680
rbp = 0x00007fffbc8d17c0   rsp = 0x00007fffbc8d17c0
r8 = 0x00007f11dd3fe8b0    r9 = 0x00007f11de568780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x0000000000000003   r13 = 0x00007fffbc8d17f0
r14 = 0x00007f11c34e5e30   r15 = 0x00007f11c2e67f18
rip = 0x00007f11cdb47d38
OS|Linux|0.0.0 Linux 4.18.0-25-generic #26~18.04.1-Ubuntu SMP Thu Jun 27 07:28:31 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::MediaStreamTrack::Graph() const|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:58400ee2747af785469bbecf414d0d739591615c|376|0x2b
0|1|libxul.so|mozilla::dom::MediaRecorder::Session::MediaStreamReady()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaRecorder.cpp:58400ee2747af785469bbecf414d0d739591615c|694|0x23
0|2|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::MediaRecorder::Session*, void (mozilla::dom::MediaRecorder::Session::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:58400ee2747af785469bbecf414d0d739591615c|1176|0x13
0|3|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:58400ee2747af785469bbecf414d0d739591615c|1225|0x15
0|4|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:58400ee2747af785469bbecf414d0d739591615c|486|0x11
0|5|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:58400ee2747af785469bbecf414d0d739591615c|88|0xa
0|6|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|315|0x17
0|7|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|290|0x8
0|8|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:58400ee2747af785469bbecf414d0d739591615c|137|0xd
0|9|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:58400ee2747af785469bbecf414d0d739591615c|934|0x11
0|10|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:58400ee2747af785469bbecf414d0d739591615c|238|0x5
0|11|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|315|0x17
0|12|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|290|0x8
0|13|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:58400ee2747af785469bbecf414d0d739591615c|769|0xc
0|14|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:58400ee2747af785469bbecf414d0d739591615c|56|0x14
0|15|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:58400ee2747af785469bbecf414d0d739591615c|267|0x12
0|16|libc-2.27.so||||0x21b97
0|17|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:58400ee2747af785469bbecf414d0d739591615c|184|0x5
Flags: in-testsuite?

Andreas, would you mind taking a first triage pass on this?

Flags: needinfo?(apehrson)
Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Component: Audio/Video → Audio/Video: Recording
Flags: needinfo?(apehrson)
Priority: -- → P2

This is almost trivial to fix, with a heavily timing-dependent testcase, and the patches in bug 1514158 to bring MediaRecorder to spec will permanently close this hole. I'll not bother with landing a crashtest for this, but push a fix since bug 1514158 won't land until 71.

Has Regression Range: --- → yes
Regressed by: 1493613

Jason, FYI, to properly repro this (would be nice to manually verify the fix) we're lacking tmp-46407S3FMpBhIBRAO.webm as referenced by the test.

Flags: needinfo?(jkratzer)

My apologies. Here's the missing media file referenced by the testcase.

Flags: needinfo?(jkratzer)

I still failed to reproduce and just noticed it references a different file too; tmp-46407JSGGIASh6HY3.mp4. Sorry for not catching this earlier. Jason, is this file also required to reproduce?

Flags: needinfo?(jkratzer)
Pushed by pehrsons@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/56e6a944c320
In MediaRecorder::MediaStreamReady, get the graph rate from a track that's guaranteed live. r=padenot

My apologies - here's the other required media file.

Flags: needinfo?(jkratzer)

Thanks! I can reproduce now, and the pushed fix does indeed fix this.

Status: ASSIGNED → RESOLVED
Closed: 7 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
You need to log in before you can comment on or make changes to this bug.