Open Bug 1601799 Opened 4 months ago Updated 4 months ago

Assertion failure: !mOutputTracks.IsEmpty(), at /builds/worker/workspace/build/src/dom/media/mediasink/DecodedStream.cpp:409

Categories

(Core :: Audio/Video, defect, P2, critical)

defect

Tracking

()

Tracking Status
firefox73 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Attachments

(2 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 3dc70a33491f.

==31768==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f24edf4d769 bp 0x7f243ff1c870 sp 0x7f243ff1c460 T37)
==31768==The signal is caused by a WRITE memory access.
==31768==Hint: address points to the zero page.
    #0 0x7f24edf4d768 in SendData /builds/worker/workspace/build/src/dom/media/mediasink/DecodedStream.cpp:850:8
    #1 0x7f24edf4d768 in mozilla::DecodedStream::Start(mozilla::media::TimeUnit const&, mozilla::MediaInfo const&) /builds/worker/workspace/build/src/dom/media/mediasink/DecodedStream.cpp:486:5
    #2 0x7f24edf5a222 in mozilla::VideoSink::Start(mozilla::media::TimeUnit const&, mozilla::MediaInfo const&) /builds/worker/workspace/build/src/dom/media/mediasink/VideoSink.cpp:277:29
    #3 0x7f24ed9e59c2 in mozilla::MediaDecoderStateMachine::StartMediaSink() /builds/worker/workspace/build/src/dom/media/MediaDecoderStateMachine.cpp:3230:29
    #4 0x7f24ed9c6698 in mozilla::MediaDecoderStateMachine::MaybeStartPlayback() /builds/worker/workspace/build/src/dom/media/MediaDecoderStateMachine.cpp:2873:3
    #5 0x7f24ed9c5bb3 in mozilla::MediaDecoderStateMachine::DecodingState::Step() /builds/worker/workspace/build/src/dom/media/MediaDecoderStateMachine.cpp:2333:14
    #6 0x7f24edad238b in applyImpl<mozilla::MediaDecoderStateMachine, void (mozilla::MediaDecoderStateMachine::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1124:12
    #7 0x7f24edad238b in apply<mozilla::MediaDecoderStateMachine, void (mozilla::MediaDecoderStateMachine::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1130:12
    #8 0x7f24edad238b in mozilla::detail::RunnableMethodImpl<mozilla::MediaDecoderStateMachine*, void (mozilla::MediaDecoderStateMachine::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1176:13
    #9 0x7f24e6642a89 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:197:35
    #10 0x7f24e664d96d in mozilla::TaskQueue::Runner::Run() /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:201:12
    #11 0x7f24e6675969 in nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:304:14
    #12 0x7f24e66766bc in non-virtual thunk to nsThreadPool::Run() /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp
    #13 0x7f24e666a48a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1250:14
    #14 0x7f24e6671931 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #15 0x7f24e78b4f85 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:303:20
    #16 0x7f24e77bb832 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #17 0x7f24e77bb832 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #18 0x7f24e77bb832 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #19 0x7f24e6663f11 in nsThread::ThreadFunc(void*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:458:11
    #20 0x7f250ae48ec5 in _pt_root /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #21 0x7f250aa916da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #22 0x7f2509a6f88e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/build/src/dom/media/mediasink/DecodedStream.cpp:850:8 in SendData
Thread T37 (MediaDe~hine #1) created by T0 (file:// Content) here:
    #0 0x55706737e0ba in pthread_create /builds/worker/fetches/llvm-project/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:209:3
    #1 0x7f250ae3ab99 in _PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:458:14
    #2 0x7f250ae241ee in PR_CreateThread /builds/worker/workspace/build/src/nsprpub/pr/src/pthreads/ptthread.c:533:12
    #3 0x7f24e6666376 in nsThread::Init(nsTSubstring<char> const&) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:673:8
    #4 0x7f24e6670aa1 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) /builds/worker/workspace/build/src/xpcom/threads/nsThreadManager.cpp:550:12
    #5 0x7f24e6674a93 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, nsIRunnable*, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:139:57
    #6 0x7f24e6674271 in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:119:17
    #7 0x7f24e667686c in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>, unsigned int) /builds/worker/workspace/build/src/xpcom/threads/nsThreadPool.cpp:353:5
    #8 0x7f24e664c7a4 in mozilla::TaskQueue::DispatchLocked(nsCOMPtr<nsIRunnable>&, unsigned int, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/xpcom/threads/TaskQueue.cpp:107:26
    #9 0x7f24e66822f5 in mozilla::TaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchReason) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskQueue.h:70:14
    #10 0x7f24e664267e in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:245:20
    #11 0x7f24e6640b55 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:87:7
    #12 0x7f24e6640895 in reset /builds/worker/workspace/build/src/obj-firefox/dist/include/mozilla/Maybe.h:444:17
    #13 0x7f24e6640895 in mozilla::EventTargetWrapper::FireTailDispatcher() /builds/worker/workspace/build/src/xpcom/threads/AbstractThread.cpp:72:21
    #14 0x7f24e66450f4 in applyImpl<mozilla::EventTargetWrapper, void (mozilla::EventTargetWrapper::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1124:12
    #15 0x7f24e66450f4 in apply<mozilla::EventTargetWrapper, void (mozilla::EventTargetWrapper::*)()> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1130:12
    #16 0x7f24e66450f4 in mozilla::detail::RunnableMethodImpl<mozilla::EventTargetWrapper*, void (mozilla::EventTargetWrapper::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1176:13
    #17 0x7f24e6470458 in mozilla::CycleCollectedJSContext::ProcessStableStateQueue() /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:399:12
    #18 0x7f24e6474557 in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/xpcom/base/CycleCollectedJSContext.cpp:458:3
    #19 0x7f24e8ae395d in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/workspace/build/src/js/xpconnect/src/XPCJSContext.cpp:1329:28
    #20 0x7f24e666b1b1 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/build/src/xpcom/threads/nsThread.cpp:1313:24
    #21 0x7f24e6671931 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/build/src/xpcom/threads/nsThreadUtils.cpp:486:10
    #22 0x7f24e78b382f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/glue/MessagePump.cpp:88:21
    #23 0x7f24e77bb832 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #24 0x7f24e77bb832 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #25 0x7f24e77bb832 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #26 0x7f24ef51ba48 in nsBaseAppShell::Run() /builds/worker/workspace/build/src/widget/nsBaseAppShell.cpp:137:27
    #27 0x7f24f35e44e6 in XRE_RunAppShell() /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:943:20
    #28 0x7f24e77bb832 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:315:10
    #29 0x7f24e77bb832 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:308:3
    #30 0x7f24e77bb832 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:290:3
    #31 0x7f24f35e3d6f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/workspace/build/src/toolkit/xre/nsEmbedFunctions.cpp:778:34
    #32 0x5570673c65cc in content_process_main /builds/worker/workspace/build/src/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #33 0x5570673c65cc in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:303:18
    #34 0x7f250996fb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
Flags: in-testsuite?
Priority: -- → P2
You need to log in before you can comment on or make changes to this bug.