1680314 - Assertion failure: !mMaster->OutOfDecodedVideo() || mMaster->IsRequestingVideoData() || mMaster->IsWaitingVideoData(), at /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:2598

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect)

Description

[Tyson Smith [:tsmith]]

This was first reported by fuzzers with m-c 20201007-a42aa9514794.

Assertion failure: !mMaster->OutOfDecodedVideo() || mMaster->IsRequestingVideoData() || mMaster->IsWaitingVideoData(), at /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:2598

#0 0x7fb61d7344af in mozilla::MediaDecoderStateMachine::BufferingState::Step() /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:2596:5
#1 0x7fb61d7457bf in mozilla::MediaDecoderStateMachine::RunStateMachine() /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:3526:14
#2 0x7fb61d844926 in operator() /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:3649:15
#3 0x7fb61d844926 in InvokeMethod<(lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:3647:7), void ((lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:3647:7)::*)() const, bool> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:560:12
#4 0x7fb61d844926 in InvokeCallbackMethod<false, (lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:3647:7), void ((lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoderStateMachine.cpp:3647:7)::*)() const, bool, RefPtr<mozilla::MozPromise<bool, bool, true>::Private> > /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:584:5
#5 0x7fb61d844926 in mozilla::MozPromise<bool, bool, true>::ThenValue<mozilla::MediaDecoderStateMachine::ScheduleStateMachineIn(mozilla::media::TimeUnit const&)::$_34, mozilla::MediaDecoderStateMachine::ScheduleStateMachineIn(mozilla::media::TimeUnit const&)::$_35>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, bool, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:769:9
#6 0x7fb61bdd30e3 in mozilla::MozPromise<bool, bool, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:410:21
#7 0x7fb61a1929a2 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:158:20
#8 0x7fb61a1aa4e4 in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:299:14
#9 0x7fb61a1a2271 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1197:14
#10 0x7fb61a1a7d7a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
#11 0x7fb61aa99066 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:332:5
#12 0x7fb61aa0a663 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
#13 0x7fb61aa0a57d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
#14 0x7fb61aa0a57d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
#15 0x7fb61a19e97e in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:442:10
#16 0x7fb62f3daabb in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#17 0x7fb62f954608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477:8
#18 0x7fb62f51d292 in clone /build/glibc-ZN95T4/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Bryce Seager van Dyk [:bryce] (he/him) - Not reading bugmail]

Tyson, do you have a test case we could use to repro?

Alastor, are you familiar with this code? Could you help take a look?

Comment 2

[Alastor Wu [:alwu]]

From [1], we can know there are two situations we would go into BufferingState. From the callstack, that shows we enter the situation where the reader is not using BufferingHeuristics [2] which indicates the reason of going to BufferingState is we're still waiting for data.

If the then for WaitForData is executed before BufferingState::Step() and we receive a rejection, then at the time BufferingState::Step() is running, it's possible to hit that assertion, because (1) we don't have any video data, (2) we are not requesting video data, (3) we are not waiting video data.

But that is just an assumption, let see if we can have a test case to verify if my assumption is correct or not.

[1] https://searchfox.org/mozilla-central/rev/6bb59b783b193f06d6744c5ccaac69a992e9ee7b/dom/media/MediaDecoderStateMachine.cpp#2467-2477
[2] https://searchfox.org/mozilla-central/rev/6bb59b783b193f06d6744c5ccaac69a992e9ee7b/dom/media/MediaDecoderStateMachine.cpp#2588-2590
[3] https://searchfox.org/mozilla-central/rev/6bb59b783b193f06d6744c5ccaac69a992e9ee7b/dom/media/MediaDecoderStateMachine.cpp#3330-3344

Comment 3

[Tyson Smith [:tsmith]]

This issue is no longer reproducible. It was last reported while fuzzing m-c 20201221-2c9db4cd3d89. None of the test cases we have locally will reproduce the issue either.