Closed
Bug 1576938
Opened 5 years ago
Closed 5 years ago
Assertion failure: !mInputStream->IsDestroyed(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:201
Categories
(Core :: Audio/Video, defect, P2)
Core
Audio/Video
Tracking
()
RESOLVED
FIXED
mozilla70
| Tracking | Status | |
|---|---|---|
| firefox-esr60 | --- | unaffected |
| firefox-esr68 | --- | unaffected |
| firefox68 | --- | unaffected |
| firefox69 | --- | unaffected |
| firefox70 | --- | fixed |
People
(Reporter: jkratzer, Assigned: pehrsons)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, regression, testcase)
Attachments
(5 files)
Testcase found while fuzzing mozilla-central rev 993cf82f6bbf.
Assertion failure: !mInputStream->IsDestroyed(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:201
rax = 0x000055e487b2c1a0 rdx = 0x0000000000000000
rcx = 0x00007fde8c9df5c4 rbx = 0x00007fde7df99800
rsi = 0x00007fde9828c8b0 rdi = 0x00007fde9828b680
rbp = 0x00007ffc28b610e0 rsp = 0x00007ffc28b60f90
r8 = 0x00007fde9828c8b0 r9 = 0x00007fde993f6780
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x00007fde7df998f8 r13 = 0x00007fde7f1674a0
r14 = 0x00007fde7df998a0 r15 = 0x0000000044815f00
rip = 0x00007fde88b06b79
OS|Linux|0.0.0 Linux 5.0.0-25-generic #26~18.04.1-Ubuntu SMP Thu Aug 1 13:51:02 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::MediaStreamTrack::MediaStreamTrack(nsPIDOMWindowInner*, mozilla::MediaStream*, int, mozilla::dom::MediaStreamTrackSource*, mozilla::dom::MediaStreamTrackState, mozilla::dom::MediaTrackConstraints const&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|204|0x70
0|1|libxul.so|mozilla::dom::VideoStreamTrack::VideoStreamTrack(nsPIDOMWindowInner*, mozilla::MediaStream*, int, mozilla::dom::MediaStreamTrackSource*, mozilla::dom::MediaStreamTrackState, mozilla::dom::MediaTrackConstraints const&)|hg:hg.mozilla.org/mozilla-central:dom/media/VideoStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|23|0x8
0|2|libxul.so|mozilla::dom::VideoStreamTrack::CloneInternal()|hg:hg.mozilla.org/mozilla-central:dom/media/VideoStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|85|0x35
0|3|libxul.so|mozilla::dom::MediaStreamTrack::Clone()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|501|0x9
0|4|libxul.so|mozilla::DOMMediaStream::Clone()|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|362|0x17
0|5|libxul.so|mozilla::dom::MediaStream_Binding::clone|s3:gecko-generated-sources:f1e855c1879b52b0f2ea7a455448827286c9534f313ed1dd41c8a524d5389ac76db92707842f6079338a7774d6a2a6d73c5a12095629151453f0281b43b485d4/dom/bindings/MediaStreamBinding.cpp:|1129|0xb
0|6|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|7|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|8|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|10|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|11|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|12|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|13|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|14|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|15|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|16|libxul.so|mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&)|s3:gecko-generated-sources:9ca8646d8042e9b4b76d2e1b358b984be17743b71b832c0897d61bb500e0fecbe38fa54273dc522878c87fcb2c9bfd274a8190c7bc56fbbb58cb3ca68462e527/dom/bindings/EventListenerBinding.cpp:|52|0x5
0|17|libxul.so|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|s3:gecko-generated-sources:f3d9c01258576daaac3afc4fb3b283652e7f1168abb5287eff6775451ebd0ab6a0e4c8d88d3a67f7147042501bc091c6dfed25b4b8ccf4e4f420897b8d0ba906/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c
0|18|libxul.so|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1233|0x19
0|19|libxul.so|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|351|0x6
0|20|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|551|0x12
0|21|libxul.so|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1048|0x1a
0|22|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1148|0x19
0|23|libxul.so|mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/events/DOMEventTargetHelper.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|167|0x5
0|24|libxul.so|mozilla::dom::EventTarget_Binding::dispatchEvent|s3:gecko-generated-sources:182b6fbeb9fc6f02d2127347892d0c294e0da52880c5fddb14186eb595f0a9a47ac1326be2e4e33f3ac5fa2e70b443e27420a4870c6cd073fb6cc8e80942ed85/dom/bindings/EventTargetBinding.cpp:|1066|0x9d
0|25|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::MaybeGlobalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|26|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|27|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|28|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|29|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|30|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|31|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|32|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|33|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|34|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|35|libxul.so|mozilla::dom::PeerConnectionObserverJSImpl::OnStateChange(mozilla::dom::PCObserverStateType, mozilla::ErrorResult&, JS::Realm*)|s3:gecko-generated-sources:accb423061489f8c966bc451db284c7e7c7bd63f1bf1a75e0b8d22281b97d08d3252e6996fc1e9618bae4b18f17aa5c9bc4d7529f7a6dd57bf324dd744a5dd7e/dom/bindings/PeerConnectionObserverBinding.cpp:|2424|0x5
0|36|libxul.so|mozilla::PeerConnectionImpl::SetSignalingState_m(mozilla::dom::RTCSignalingState, bool)|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2275|0x19
0|37|libxul.so|mozilla::PeerConnectionImpl::Close()|hg:hg.mozilla.org/mozilla-central:media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2059|0xd
0|38|libxul.so|mozilla::dom::PeerConnectionImpl_Binding::close|s3:gecko-generated-sources:24d8967407bc5469491952d9d665496912db5ffce0de3c7a35bfb476a5bdc0ef939bb32365b3af94a8d848d6ca3a8458f9d186b7ba5c57593f5ab44df632e585/dom/bindings/PeerConnectionImplBinding.cpp:|1197|0x8
0|39|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|40|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|41|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|42|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|43|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|44|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|45|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|46|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|47|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|48|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|49|libxul.so|mozilla::dom::RTCPeerConnectionJSImpl::Close(mozilla::ErrorResult&, JS::Realm*)|s3:gecko-generated-sources:6fa782bcea89e6867012a82f5a1642de668d36b780ef2be3f720e6092b8c86d449b9b6d8340a5b6d968b841235c7856b7c1653c2ad9b161fd7edda26ac1359d9/dom/bindings/RTCPeerConnectionBinding.cpp:|8570|0x5
0|50|libxul.so|mozilla::dom::RTCPeerConnection_Binding::close|s3:gecko-generated-sources:6fa782bcea89e6867012a82f5a1642de668d36b780ef2be3f720e6092b8c86d449b9b6d8340a5b6d968b841235c7856b7c1653c2ad9b161fd7edda26ac1359d9/dom/bindings/RTCPeerConnectionBinding.cpp:|4558|0x1c
0|51|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|3163|0x24
0|52|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|53|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|54|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|55|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|598|0xf
0|56|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|424|0xb
0|57|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|567|0xf
0|58|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|59|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|60|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.h:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|98|0x14
0|61|libxul.so|PromiseReactionJob|hg:hg.mozilla.org/mozilla-central:js/src/builtin/Promise.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1703|0x3a
0|62|libxul.so|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|447|0x16
0|63|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|539|0x12
0|64|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|594|0xd
0|65|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|610|0x5
0|66|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|2722|0x1c
0|67|libxul.so|mozilla::dom::PromiseJobCallback::Call(JSContext*, JS::Handle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:459bd68f053d4775f5b0b7c60fdedb096097672d24585038b4bb3482166c8e296d4679eb046b8f15653c228c4c1978ecacfffce20fced70b78964dafea2eee2d/dom/bindings/PromiseBinding.cpp:|26|0x5
0|68|libxul.so|mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:8ff597fee16137a41c5c768d4731e63150ba2f32aaccb2a1985be307f0fad868e61bb63f08de085a377133bcfcb41787e072b5d1f0cda75a29d00492f676fce1/dist/include/mozilla/dom/PromiseBinding.h:|91|0x12
0|69|libxul.so|mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|240|0x41
0|70|libxul.so|mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|662|0x17
0|71|libxul.so|mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int)|hg:hg.mozilla.org/mozilla-central:xpcom/base/CycleCollectedJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|491|0x7
0|72|libxul.so|XPCJSContext::AfterProcessTask(unsigned int)|hg:hg.mozilla.org/mozilla-central:js/xpconnect/src/XPCJSContext.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1313|0xb
0|73|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|1283|0xc
0|74|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|486|0x11
0|75|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|88|0xa
0|76|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|315|0x17
0|77|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|290|0x8
0|78|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|137|0xd
0|79|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|934|0x11
0|80|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|238|0x5
0|81|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|315|0x17
0|82|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|290|0x8
0|83|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|769|0xc
0|84|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|56|0x14
0|85|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|267|0x12
0|86|libc-2.27.so||||0x21b97
0|87|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:993cf82f6bbf09537f4cec8144cb69bfdf26bff3|184|0x5
Flags: in-testsuite?
|
Reporter | |
Comment 1•5 years ago
|
||
Testcase bisects to the following range:
Start: 2393746829693f23406582a3debf6126b8a33a7c (20190819215716)
End: 14bd73fd1e01022663fe79675d1273defeb52ef0 (20190820034531)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=2393746829693f23406582a3debf6126b8a33a7c&tochange=14bd73fd1e01022663fe79675d1273defeb52ef0
Possibly a regression from bug 1571705.
|
||
Comment 2•5 years ago
|
||
Andreas, could you take a look? it might be a regression.
Flags: needinfo?(apehrson)
Priority: -- → P2
|
Assignee | |
Comment 3•5 years ago
|
||
I'd say this reveals the root cause of bug 1571705. We now assert at an earlier stage to avoid ending up in a bad state. I'll take a look, thanks!
Assignee: nobody → apehrson
Status: NEW → ASSIGNED
status-firefox68:
--- → unaffected
status-firefox69:
--- → unaffected
status-firefox-esr60:
--- → unaffected
status-firefox-esr68:
--- → unaffected
Flags: needinfo?(apehrson)
|
|
Assignee | |
Comment 4•5 years ago
|
||
FWIW I have a pernosco recording at https://pernos.co/debug/foj1G4Hk6VcBen0VN6qX2A/index.html
|
||
Comment 5•5 years ago
|
||
Bugbug thinks this bug is a regression, but please revert this change in case of error.
Keywords: regression
|
|
Assignee | |
Comment 6•5 years ago
|
||
So RTCPeerConnection.createOffer({offerToReceiveVideo: true}) synchronously creates a video track on a receiver. RTCPeerConnection.close() synchronously calls MediaStream::EndTrack and MediaStream::Destroy on the input stream for the received track. The MediaStreamTrack itself picks this up asynchronously, so calling MediaStreamTrack.clone() right after peer.close() gives us the crash.
The testcase can be greatly simplified -- I'll upload what I ended up with. Jason, maybe you want to take a look at why your tools weren't able to reduce the testcase further?
Flags: needinfo?(jkratzer)
|
|
Assignee | |
Comment 7•5 years ago
|
||
|
|
Assignee | |
Comment 8•5 years ago
|
||
I think we need to handle the input stream being destroyed in the MediaStreamTrack ctor. There's a potential race in relying on the input stream to end the track (it might be missed), but that will be handled async by MediaStreamTrackSource::OverrideEnded. In this case it's called by RemoteTrackSource::ForceEnded.
|
|
Reporter | |
Updated•5 years ago
|
Flags: needinfo?(jkratzer)
|
|
Assignee | |
Comment 9•5 years ago
|
||
|
|
Assignee | |
Comment 10•5 years ago
|
||
This is a valid use case when cloning a MediaStreamTrack, if the source track of
the clone has had its input stream destroyed out-of-band and that change hasn't
been asynchronously communicated to the source track yet, i.e., it's still live.
Depends on D44019
|
|
Assignee | |
Comment 11•5 years ago
|
||
Depends on D44020
|
||
Comment 12•5 years ago
|
||
Pushed by pehrsons@gmail.com: https://hg.mozilla.org/integration/autoland/rev/e830fea4c442 Add crashtest. r=karlt https://hg.mozilla.org/integration/autoland/rev/2f4ccf9252b9 Allow a live MediaStreamTrack to be created with a destroyed input stream. r=karlt https://hg.mozilla.org/integration/autoland/rev/087b063910da Make MediaInputPort::Init work on an already-disconnected port. r=karlt
|
||
Comment 13•5 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/e830fea4c442
https://hg.mozilla.org/mozilla-central/rev/2f4ccf9252b9
https://hg.mozilla.org/mozilla-central/rev/087b063910da
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla70
|
||
Comment 14•5 years ago
|
||
| bugherder uplift | ||
You need to log in
before you can comment on or make changes to this bug.
Description
•