1641585 - Assertion failure: mChannels && mFrames && mSampleRate (Mix not called for this cycle?), at /builds/worker/checkouts/gecko/dom/media/AudioMixer.h:54

Status: NEW

(Core :: Audio/Video: MediaStreamGraph, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev cfa4bd8e6f78 (built with --enable-debug).

Assertion failure: mChannels && mFrames && mSampleRate (Mix not called for this cycle?), at /builds/worker/checkouts/gecko/dom/media/AudioMixer.h:54

rax = 0x00007f9f5324525c   rdx = 0x0000000000000000
rcx = 0x0000557cd4d70a58   rbx = 0x00007f9f4011b690
rsi = 0x00007f9f6437d8b0   rdi = 0x00007f9f6437c680
rbp = 0x00007f9f4011b640   rsp = 0x00007f9f4011b600
r8 = 0x00007f9f6437d8b0    r9 = 0x00007f9f4011d700
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x0000000000000000   r13 = 0x0000557cd750a540
r14 = 0x0000000000000000   r15 = 0x0000557cd6e05f48
rip = 0x00007f9f4cfadc41
OS|Linux|0.0.0 Linux 5.3.0-51-generic #44~18.04.2-Ubuntu SMP Thu Apr 23 14:27:18 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|36
36|0|libxul.so|mozilla::AudioMixer::FinishMixing()|hg:hg.mozilla.org/mozilla-central:dom/media/AudioMixer.h:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|53|0x3f
36|1|libxul.so|mozilla::AudioCaptureTrack::ProcessInput(long, long, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/media/AudioCaptureTrack.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|100|0x12
36|2|libxul.so|mozilla::MediaTrackGraphImpl::Process(mozilla::AudioMixer*)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaTrackGraph.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1278|0x3b
36|3|libxul.so|mozilla::MediaTrackGraphImpl::OneIterationImpl(long, long, mozilla::AudioMixer*)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaTrackGraph.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1402|0xf
36|4|libxul.so|mozilla::GraphRunner::Run()|hg:hg.mozilla.org/mozilla-central:dom/media/GraphRunner.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|114|0x20
36|5|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|1211|0x11
36|6|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|501|0xc
36|7|libxul.so|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|332|0x13
36|8|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|315|0x17
36|9|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|290|0x8
36|10|libxul.so|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|444|0x8
36|11|libnspr4.so|_pt_root|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f|201|0x7
36|12|libpthread.so.0||||0x76db
36|13|libc.so.6||||0x12188f

Comment 1

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Failed to identify testcase.  Please ensure that the testcase meets the requirements identified here: https://github.com/MozillaSecurity/bugmon#testcase-identification
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Comment 3

[Jason Kratzer [:jkratzer]]

Attachment: 6ecd0a5ace7c998c7c9b4d7fcad6e8630efbf2f2.mp4

Comment 4

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200528032513-cfa4bd8e6f78.
Failed to bisect testcase (Start build crashes!):
> Start: 73c98da145a7c0ef518404493b23a979f328768e (20190530034755)
> End: cfa4bd8e6f789fcca1de2272f0d5b11c0ded913f (20200528032513)
> BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=False, coverage=False, valgrind=False)

Comment 5

[Tyson Smith [:tsmith]]

Andreas: I was able to reproduce this issue with that attached test case but I was unable to reproduce it under rr.

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1641585 using build mozilla-central 20201205093858-7ce95b6cde26. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1641585 using build mozilla-central 20201205093858-7ce95b6cde26. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Andreas Pehrson [:pehrsons]]

gUM and audioCapture are involved. karl, since you've been working in gUM-land could you have fixed this by accident?

Comment 9

[Karl Tomlinson (:karlt)]

The use of getUserMedia() in the testcase now requires a recent user gesture, so the reported crash bug may still exist.

Comment 10

[Karl Tomlinson (:karlt)]

This would also have been affected by removing the "media.getusermedia.audiocapture.enabled" pref from fuzzing.