Closed Bug 1576938 Opened 3 months ago Closed 2 months ago

Assertion failure: !mInputStream->IsDestroyed(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:201

Categories

(Core :: Audio/Video, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla70
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed

People

(Reporter: jkratzer, Assigned: pehrsons)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, regression, testcase)

Attachments

(5 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 993cf82f6bbf.

Assertion failure: !mInputStream->IsDestroyed(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:201

rax = 0x000055e487b2c1a0   rdx = 0x0000000000000000
rcx = 0x00007fde8c9df5c4   rbx = 0x00007fde7df99800
rsi = 0x00007fde9828c8b0   rdi = 0x00007fde9828b680
rbp = 0x00007ffc28b610e0   rsp = 0x00007ffc28b60f90
r8 = 0x00007fde9828c8b0    r9 = 0x00007fde993f6780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007fde7df998f8   r13 = 0x00007fde7f1674a0
r14 = 0x00007fde7df998a0   r15 = 0x0000000044815f00
rip = 0x00007fde88b06b79
OS|Linux|0.0.0 Linux 5.0.0-25-generic #26~18.04.1-Ubuntu SMP Thu Aug 1 13:51:02 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::MediaStreamTrack::MediaStreamTrack(nsPIDOMWindowInner*, mozilla::MediaStream*, int, mozilla::dom::MediaStreamTrackSource*, mozilla::dom::MediaStreamTrackState, mozilla::dom::MediaTrackConstraints const&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|204|0x70
0|1|libxul.so|mozilla::dom::VideoStreamTrack::VideoStreamTrack(nsPIDOMWindowInner*, mozilla::MediaStream*, int, mozilla::dom::MediaStreamTrackSource*, mozilla::dom::MediaStreamTrackState, mozilla::dom::MediaTrackConstraints const&)|hg:hg.mozilla.org/mozilla-central:dom/media/VideoStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|23|0x8
0|2|libxul.so|mozilla::dom::VideoStreamTrack::CloneInternal()|hg:hg.mozilla.org/mozilla-central:dom/media/VideoStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|85|0x35
0|3|libxul.so|mozilla::dom::MediaStreamTrack::Clone()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|501|0x9
0|4|libxul.so|mozilla::DOMMediaStream::Clone()|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|362|0x17
0|5|libxul.so|mozilla::dom::MediaStream_Binding::clone|s3:gecko-generated-sources:f1e855c1879b52b0f2ea7a455448827286c9534f313ed1dd41c8a524d5389ac76db92707842f6079338a7774d6a2a6d73c5a12095629151453f0281b43b485d4/dom/bindings/MediaStreamBinding.cpp:|1129|0xb
0|6|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|7|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|8|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|10|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|11|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|12|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|13|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|14|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|15|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|16|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:9ca8646d8042e9b4b76d2e1b358b984be17743b71b832c0897d61bb500e0fecbe38fa54273dc522878c87fcb2c9bfd274a8190c7bc56fbbb58cb3ca68462e527/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|17|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|18|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1233|0x19
0|19|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|351|0x6
0|20|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|551|0x12
0|21|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1048|0x1a
0|22|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1148|0x19
0|23|libxul.so|mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/events/DOMEventTargetHelper.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|167|0x5
0|24|libxul.so|mozilla::dom::EventTarget_Binding::dispatchEvent|s3:gecko-generated-sources:182b6fbeb9fc6f02d2127347892d0c294e0da52880c5fddb14186eb595f0a9a47ac1326be2e4e33f3ac5fa2e70b443e27420a4870c6cd073fb6cc8e80942ed85/dom/bindings/EventTargetBinding.cpp:|1066|0x9d
0|25|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|26|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|27|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|28|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|29|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|30|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|31|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|32|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|33|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|34|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|35|libxul.so|mozilla::dom::PeerConnectionObserverJSImpl::OnStateChange(mozilla::dom::PCObserverStateType, mozilla::ErrorResult&, JS::Realm*)|s3:gecko-generated-sources:accb423061489f8c966bc451db284c7e7c7bd63f1bf1a75e0b8d22281b97d08d3252e6996fc1e9618bae4b18f17aa5c9bc4d7529f7a6dd57bf324dd744a5dd7e/dom/bindings/PeerConnectionObserverBinding.cpp:|2424|0x5
0|36|libxul.so|mozilla::PeerConnectionImpl::SetSignalingState_m(mozilla::dom::RTCSignalingState, bool)|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2275|0x19
0|37|libxul.so|mozilla::PeerConnectionImpl::Close()|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2059|0xd
0|38|libxul.so|mozilla::dom::PeerConnectionImpl_Binding::close|s3:gecko-generated-sources:24d8967407bc5469491952d9d665496912db5ffce0de3c7a35bfb476a5bdc0ef939bb32365b3af94a8d848d6ca3a8458f9d186b7ba5c57593f5ab44df632e585/dom/bindings/PeerConnectionImplBinding.cpp:|1197|0x8
0|39|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|40|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|41|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|42|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|43|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|44|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|45|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|46|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|47|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|48|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|49|libxul.so|mozilla::dom::RTCPeerConnectionJSImpl::Close(mozilla::ErrorResult&, JS::Realm*)|s3:gecko-generated-sources:6fa782bcea89e6867012a82f5a1642de668d36b780ef2be3f720e6092b8c86d449b9b6d8340a5b6d968b841235c7856b7c1653c2ad9b161fd7edda26ac1359d9/dom/bindings/RTCPeerConnectionBinding.cpp:|8570|0x5
0|50|libxul.so|mozilla::dom::RTCPeerConnection_Binding::close|s3:gecko-generated-sources:6fa782bcea89e6867012a82f5a1642de668d36b780ef2be3f720e6092b8c86d449b9b6d8340a5b6d968b841235c7856b7c1653c2ad9b161fd7edda26ac1359d9/dom/bindings/RTCPeerConnectionBinding.cpp:|4558|0x1c
0|51|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|52|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|53|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|54|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|55|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|56|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|57|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|58|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|59|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|60|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.h:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|98|0x14
0|61|libxul.so|PromiseReactionJob|hg:hg.mozilla.org/mozilla-central:js/src/builtin/Promise.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1703|0x3a
0|62|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|63|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|64|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|65|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|66|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|67|libxul.so|mozilla::dom::PromiseJobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:459bd68f053d4775f5b0b7c60fdedb096097672d24585038b4bb3482166c8e296d4679eb046b8f15653c228c4c1978ecacfffce20fced70b78964dafea2eee2d/dom/bindings/PromiseBinding.cpp:|26|0x5
0|68|libxul.so|mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:8ff597fee16137a41c5c768d4731e63150ba2f32aaccb2a1985be307f0fad868e61bb63f08de085a377133bcfcb41787e072b5d1f0cda75a29d00492f676fce1/dist/include/mozilla/dom/PromiseBinding.h:|91|0x12
0|69|libxul.so|mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|240|0x41
0|70|libxul.so|mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|662|0x17
0|71|libxul.so|mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|491|0x7
0|72|libxul.so|XPCJSContext::AfterProcessTask(unsigned int)|hg:hg.mozilla.org/mozilla-central:js/xpconnect/src/XPCJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1313|0xb
0|73|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1283|0xc
0|74|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|486|0x11
0|75|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|88|0xa
0|76|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|315|0x17
0|77|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|290|0x8
0|78|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|137|0xd
0|79|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|934|0x11
0|80|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|238|0x5
0|81|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|315|0x17
0|82|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|290|0x8
0|83|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|769|0xc
0|84|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|56|0x14
0|85|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|267|0x12
0|86|libc-2.27.so||||0x21b97
0|87|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|184|0x5
Flags: in-testsuite?

Testcase bisects to the following range:

Start: 2393746829693f23406582a3debf6126b8a33a7c (20190819215716)
End: 14bd73fd1e01022663fe79675d1273defeb52ef0 (20190820034531)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2393746829693f23406582a3debf6126b8a33a7c&tochange=14bd73fd1e01022663fe79675d1273defeb52ef0

Possibly a regression from bug 1571705.

Andreas, could you take a look? it might be a regression.

Flags: needinfo?(apehrson)
Priority: -- → P2

I'd say this reveals the root cause of bug 1571705. We now assert at an earlier stage to avoid ending up in a bad state. I'll take a look, thanks!

Assignee: nobody → apehrson
Status: NEW → ASSIGNED
Flags: needinfo?(apehrson)

Bugbug thinks this bug is a regression, but please revert this change in case of error.

Keywords: regression

So RTCPeerConnection.createOffer({offerToReceiveVideo: true}) synchronously creates a video track on a receiver. RTCPeerConnection.close() synchronously calls MediaStream::EndTrack and MediaStream::Destroy on the input stream for the received track. The MediaStreamTrack itself picks this up asynchronously, so calling MediaStreamTrack.clone() right after peer.close() gives us the crash.

The testcase can be greatly simplified -- I'll upload what I ended up with. Jason, maybe you want to take a look at why your tools weren't able to reduce the testcase further?

Flags: needinfo?(jkratzer)
Attached file simplified.html

I think we need to handle the input stream being destroyed in the MediaStreamTrack ctor. There's a potential race in relying on the input stream to end the track (it might be missed), but that will be handled async by MediaStreamTrackSource::OverrideEnded. In this case it's called by RemoteTrackSource::ForceEnded.

Depends on: 1577495
Flags: needinfo?(jkratzer)

This is a valid use case when cloning a MediaStreamTrack, if the source track of
the clone has had its input stream destroyed out-of-band and that change hasn't
been asynchronously communicated to the source track yet, i.e., it's still live.

Depends on D44019

Pushed by pehrsons@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/e830fea4c442
Add crashtest. r=karlt
https://hg.mozilla.org/integration/autoland/rev/2f4ccf9252b9
Allow a live MediaStreamTrack to be created with a destroyed input stream. r=karlt
https://hg.mozilla.org/integration/autoland/rev/087b063910da
Make MediaInputPort::Init work on an already-disconnected port. r=karlt
You need to log in before you can comment on or make changes to this bug.