1573524 - Assertion failure: !Ended(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:376

Status: RESOLVED FIXED

(Core :: Audio/Video: Recording, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 58400ee2747a.

Assertion failure: !Ended(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:376

rax = 0x000055de0edd71a0   rdx = 0x0000000000000000
rcx = 0x00007f11d1b2036f   rbx = 0x00007f11c2e1b7a0
rsi = 0x00007f11dd3fe8b0   rdi = 0x00007f11dd3fd680
rbp = 0x00007fffbc8d17c0   rsp = 0x00007fffbc8d17c0
r8 = 0x00007f11dd3fe8b0    r9 = 0x00007f11de568780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x0000000000000003   r13 = 0x00007fffbc8d17f0
r14 = 0x00007f11c34e5e30   r15 = 0x00007f11c2e67f18
rip = 0x00007f11cdb47d38
OS|Linux|0.0.0 Linux 4.18.0-25-generic #26~18.04.1-Ubuntu SMP Thu Jun 27 07:28:31 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::MediaStreamTrack::Graph() const|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:58400ee2747af785469bbecf414d0d739591615c|376|0x2b
0|1|libxul.so|mozilla::dom::MediaRecorder::Session::MediaStreamReady()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaRecorder.cpp:58400ee2747af785469bbecf414d0d739591615c|694|0x23
0|2|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::MediaRecorder::Session*, void (mozilla::dom::MediaRecorder::Session::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:58400ee2747af785469bbecf414d0d739591615c|1176|0x13
0|3|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:58400ee2747af785469bbecf414d0d739591615c|1225|0x15
0|4|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:58400ee2747af785469bbecf414d0d739591615c|486|0x11
0|5|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:58400ee2747af785469bbecf414d0d739591615c|88|0xa
0|6|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|315|0x17
0|7|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|290|0x8
0|8|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:58400ee2747af785469bbecf414d0d739591615c|137|0xd
0|9|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:58400ee2747af785469bbecf414d0d739591615c|934|0x11
0|10|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:58400ee2747af785469bbecf414d0d739591615c|238|0x5
0|11|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|315|0x17
0|12|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|290|0x8
0|13|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:58400ee2747af785469bbecf414d0d739591615c|769|0xc
0|14|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:58400ee2747af785469bbecf414d0d739591615c|56|0x14
0|15|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:58400ee2747af785469bbecf414d0d739591615c|267|0x12
0|16|libc-2.27.so||||0x21b97
0|17|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:58400ee2747af785469bbecf414d0d739591615c|184|0x5

Comment 1

[Nico Grunbaum [:ng, @chew:mozilla.org]]

Andreas, would you mind taking a first triage pass on this?

Comment 2

[Andreas Pehrson [:pehrsons]]

This is almost trivial to fix, with a heavily timing-dependent testcase, and the patches in bug 1514158 to bring MediaRecorder to spec will permanently close this hole. I'll not bother with landing a crashtest for this, but push a fix since bug 1514158 won't land until 71.

Comment 3

[Andreas Pehrson [:pehrsons]]

Jason, FYI, to properly repro this (would be nice to manually verify the fix) we're lacking tmp-46407S3FMpBhIBRAO.webm as referenced by the test.

Comment 4

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1573524 - In MediaRecorder::MediaStreamReady, get the graph rate from a track that's guaranteed live. r?padenot

Comment 5

[Jason Kratzer [:jkratzer]]

Attachment: tmp-46407S3FMpBhIBRAO.webm

My apologies. Here's the missing media file referenced by the testcase.

Comment 6

[Andreas Pehrson [:pehrsons]]

I still failed to reproduce and just noticed it references a different file too; tmp-46407JSGGIASh6HY3.mp4. Sorry for not catching this earlier. Jason, is this file also required to reproduce?

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/56e6a944c320
In MediaRecorder::MediaStreamReady, get the graph rate from a track that's guaranteed live. r=padenot

Comment 8

[Jason Kratzer [:jkratzer]]

Attachment: tmp-46407JSGGIASh6HY3.mp4

My apologies - here's the other required media file.

Comment 9

[Andreas Pehrson [:pehrsons]]

Thanks! I can reproduce now, and the pushed fix does indeed fix this.

Comment 10

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/56e6a944c320