1629389 - Assertion failure: mRawPtr != nullptr (You can't dereference a NULL RefPtr with operator->().), at /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:315

Status: VERIFIED FIXED

(Core :: Audio/Video: MediaStreamGraph, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev e1342040e7eb (built with --enable-debug).

Assertion failure: mRawPtr != nullptr (You can't dereference a NULL RefPtr with operator->().), at /builds/worker/workspace/obj-build/dist/include/mozilla/RefPtr.h:315

rax = 0x00005631fe822380   rdx = 0x0000000000000000
rcx = 0x00007ff3736945a6   rbx = 0x00007ff359b0b310
rsi = 0x00007ff3801bf8b0   rdi = 0x00007ff3801be680
rbp = 0x00007ffdf3675000   rsp = 0x00007ffdf3675000
r8 = 0x00007ff3801bf8b0    r9 = 0x00007ff381319780
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x00007ff359b0b310   r13 = 0x00007ff359b0b330
r14 = 0x00007ffdf3675068   r15 = 0x00007ff36bca22f0
rip = 0x00007ff36e347503
OS|Linux|0.0.0 Linux 5.3.0-45-generic #37~18.04.1-Ubuntu SMP Fri Mar 27 15:58:10 UTC 2020 x86_64
CPU|amd64|family 6 model 158 stepping 10|12
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|RefPtr<mozilla::ProcessedMediaTrack>::operator->() const|hg:hg.mozilla.org/mozilla-central:mfbt/RefPtr.h:e1342040e7eb59de587efc614980577d53e591da|314|0x16
0|1|libxul.so|mozilla::MediaStreamWindowCapturer::CapturedTrack::~CapturedTrack()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamWindowCapturer.cpp:e1342040e7eb59de587efc614980577d53e591da|22|0x17
0|2|libxul.so|nsTArray_Impl<mozilla::UniquePtr<mozilla::MediaStreamWindowCapturer::CapturedTrack, mozilla::DefaultDelete<mozilla::MediaStreamWindowCapturer::CapturedTrack> >, nsTArrayInfallibleAllocator>::DestructRange(unsigned long, unsigned long)|hg:hg.mozilla.org/mozilla-central:xpcom/ds/nsTArray.h:e1342040e7eb59de587efc614980577d53e591da|2244|0x17
0|3|libxul.so|mozilla::MediaStreamWindowCapturer::RemoveTrack(mozilla::dom::AudioStreamTrack*)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamWindowCapturer.cpp:e1342040e7eb59de587efc614980577d53e591da|68|0x10
0|4|libxul.so|mozilla::DOMMediaStream::NotifyTrackRemoved(RefPtr<mozilla::dom::MediaStreamTrack> const&)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:e1342040e7eb59de587efc614980577d53e591da|509|0x11
0|5|libxul.so|mozilla::DOMMediaStream::PlaybackTrackListener::NotifyEnded(mozilla::dom::MediaStreamTrack*)|hg:hg.mozilla.org/mozilla-central:dom/media/DOMMediaStream.cpp:e1342040e7eb59de587efc614980577d53e591da|88|0x17
0|6|libxul.so|mozilla::dom::MediaStreamTrack::NotifyEnded()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:e1342040e7eb59de587efc614980577d53e591da|476|0x1b
0|7|libxul.so|mozilla::dom::HTMLMediaElement::AudioCaptureTrackChange(bool)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:e1342040e7eb59de587efc614980577d53e591da|7256|0x1e6
0|8|libxul.so|mozilla::dom::HTMLMediaElement::SuspendOrResumeElement(bool)|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:e1342040e7eb59de587efc614980577d53e591da|6353|0x19
0|9|libxul.so|mozilla::dom::HTMLMediaElement::NotifyOwnerDocumentActivityChanged()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:e1342040e7eb59de587efc614980577d53e591da|6440|0x16
0|10|libxul.so|mozilla::dom::NotifyActivityChanged|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1342040e7eb59de587efc614980577d53e591da|6834|0x8
0|11|libxul.so|mozilla::dom::Document::EnumerateActivityObservers(void (*)(nsISupports*, void*), void*)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1342040e7eb59de587efc614980577d53e591da|11945|0xb
0|12|libxul.so|mozilla::dom::Document::UpdateVisibilityState()|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1342040e7eb59de587efc614980577d53e591da|14086|0x11
0|13|libxul.so|mozilla::dom::Document::OnPageHide(bool, mozilla::dom::EventTarget*, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/Document.cpp:e1342040e7eb59de587efc614980577d53e591da|10934|0x8
0|14|libxul.so|nsDocumentViewer::PageHide(bool)|hg:hg.mozilla.org/mozilla-central:layout/base/nsDocumentViewer.cpp:e1342040e7eb59de587efc614980577d53e591da|1485|0x1f
0|15|libxul.so|nsDocShell::FirePageHideNotificationInternal(bool, bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:e1342040e7eb59de587efc614980577d53e591da|965|0x5c
0|16|libxul.so|nsDocShell::FirePageHideNotificationInternal(bool, bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:e1342040e7eb59de587efc614980577d53e591da|965|0x1dc
0|17|libxul.so|nsDocShell::FirePageHideNotification(bool)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:e1342040e7eb59de587efc614980577d53e591da|961|0x5
0|18|libxul.so|nsDocShell::CreateContentViewer(nsTSubstring<char> const&, nsIRequest*, nsIStreamListener**)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDocShell.cpp:e1342040e7eb59de587efc614980577d53e591da|7631|0x1a
0|19|libxul.so|nsDSURIContentListener::DoContent(nsTSubstring<char> const&, bool, nsIRequest*, nsIStreamListener**, bool*)|hg:hg.mozilla.org/mozilla-central:docshell/base/nsDSURIContentListener.cpp:e1342040e7eb59de587efc614980577d53e591da|168|0x17
0|20|libxul.so|nsDocumentOpenInfo::TryContentListener(nsIURIContentListener*, nsIChannel*)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsURILoader.cpp:e1342040e7eb59de587efc614980577d53e591da|632|0x26
0|21|libxul.so|nsDocumentOpenInfo::DispatchContent(nsIRequest*, nsISupports*)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsURILoader.cpp:e1342040e7eb59de587efc614980577d53e591da|313|0x10
0|22|libxul.so|nsDocumentOpenInfo::OnStartRequest(nsIRequest*)|hg:hg.mozilla.org/mozilla-central:uriloader/base/nsURILoader.cpp:e1342040e7eb59de587efc614980577d53e591da|191|0xd
0|23|libxul.so|nsBaseChannel::OnStartRequest(nsIRequest*)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsBaseChannel.cpp:e1342040e7eb59de587efc614980577d53e591da|829|0x12
0|24|libxul.so|nsInputStreamPump::OnStateStart()|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsInputStreamPump.cpp:e1342040e7eb59de587efc614980577d53e591da|518|0x15
0|25|libxul.so|nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream*)|hg:hg.mozilla.org/mozilla-central:netwerk/base/nsInputStreamPump.cpp:e1342040e7eb59de587efc614980577d53e591da|427|0x8
0|26|libxul.so|nsInputStreamReadyEvent::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/io/nsStreamUtils.cpp:e1342040e7eb59de587efc614980577d53e591da|93|0x6
0|27|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:e1342040e7eb59de587efc614980577d53e591da|282|0x14
0|28|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:e1342040e7eb59de587efc614980577d53e591da|1220|0xe
0|29|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:e1342040e7eb59de587efc614980577d53e591da|481|0x11
0|30|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:e1342040e7eb59de587efc614980577d53e591da|87|0xa
0|31|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1342040e7eb59de587efc614980577d53e591da|315|0x19
0|32|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1342040e7eb59de587efc614980577d53e591da|290|0x8
0|33|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:e1342040e7eb59de587efc614980577d53e591da|137|0xd
0|34|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:e1342040e7eb59de587efc614980577d53e591da|926|0x6
0|35|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:e1342040e7eb59de587efc614980577d53e591da|237|0x5
0|36|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1342040e7eb59de587efc614980577d53e591da|315|0x19
0|37|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:e1342040e7eb59de587efc614980577d53e591da|290|0x8
0|38|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:e1342040e7eb59de587efc614980577d53e591da|761|0x8
0|39|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:e1342040e7eb59de587efc614980577d53e591da|56|0x14
0|40|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:e1342040e7eb59de587efc614980577d53e591da|303|0x13
0|41|libc-2.27.so||||0x21b97
0|42|firefox-bin|__cxa_throw_bad_array_new_length|hg:hg.mozilla.org/mozilla-central:build/unix/stdc++compat/stdc++compat.cpp:e1342040e7eb59de587efc614980577d53e591da|82|0x12
0|43|firefox-bin||||0x10b10
0|44|ld-2.27.so||||0x10733
0|45|libdl-2.27.so||||0x202d80
0|46|libpthread-2.27.so||||0x219bb0
0|47|firefox-bin||||0x10b10
0|48|firefox-bin|_start|||0x29

Comment 1

[Alastor Wu [:alwu]]

Hi, Paul,
Can you take a look on this issue? It seems that mPort could be null when we create a MediaStreamWindowCapturer.
Thank you.

Comment 2

[Paul Adenot (:padenot)]

Attachment: Bug 1629389 - Null check in the destructor of MediaStreamWindowCapturer. r?alwu

Connecting to a capture track can return nullptr, this needs to be handled:
https://searchfox.org/mozilla-central/source/dom/media/MediaTrackGraph.cpp#3756

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/98d1b98c7177
Null check in the destructor of MediaStreamWindowCapturer. r=alwu

Comment 4

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/98d1b98c7177

Comment 5

[Intermittent Failures Robot]

1 failures in 4528 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 1

Platform breakdown:

• macosx1014-64: 1

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1629389&startday=2020-04-13&endday=2020-04-19&tree=all

Comment 6

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Bug marked as FIXED but still reproduces on mozilla-central 20200423095248-47426d145e24.

Comment 7

[Alastor Wu [:alwu]]

I can't reproduce it on yesterday central (530358:2203d818a3b4), can you reproduce this crash?

Comment 8

[Paul Adenot (:padenot)]

I can't repro either, despite having flipped the audiocapture pref and the permission pref so that it reloads on its own.

Comment 9

[Jason Kratzer [:jkratzer]]

Bugmon is confused here. The original bug has been fixed. The testcase now returns the following assertion:
Assertion failure: !nsContentUtils::IsInStableOrMetaStableState(), at /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:739

I've opened bug 1633428 to track this issue.

Comment 10

[Paul Adenot (:padenot)]

I'm re-closing this then, thanks!

Comment 11

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200428100141-a99c73301874.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.