1697521 - Assertion failure: mEncoder, at /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:783 in Session::RequestData()

Status: VERIFIED FIXED

(Core :: Audio/Video: Recording, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev 056c2a428e2d (built with --enable-debug --enable-fuzzing).

Assertion failure: mEncoder, at /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:783

    #0 0x7f289411c0bf in mozilla::dom::MediaRecorder::Session::RequestData() /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:783:5
    #1 0x7f289411bb0f in mozilla::dom::MediaRecorder::RequestData(mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/MediaRecorder.cpp:1491:28
    #2 0x7f2892b7e933 in mozilla::dom::MediaRecorder_Binding::requestData(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/MediaRecorderBinding.cpp:1078:24
    #3 0x7f28939f9c5d in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3238:13
    #4 0x7f2896ab84e0 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:435:13
    #5 0x7f2896ab7c4c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:520:12
    #6 0x7f2896ab9449 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:10
    #7 0x7f2896aadfbf in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:584:10
    #8 0x7f2896aadfbf in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3244:16
    #9 0x7f2896aa5471 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:405:13
    #10 0x7f2896ab7c69 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:552:13
    #11 0x7f2896ab9449 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:10
    #12 0x7f2896ab966f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:8
    #13 0x7f2896e4cfee in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/SelfHosting.cpp:1642:10
    #14 0x7f2896c2129c in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/AsyncFunction.cpp:129:8
    #15 0x7f2896ce5512 in AsyncFunctionPromiseReactionJob /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:1703:10
    #16 0x7f2896ce5512 in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:1855:12
    #17 0x7f2896ab84e0 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:435:13
    #18 0x7f2896ab7c4c in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:520:12
    #19 0x7f2896ab9449 in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:580:10
    #20 0x7f2896ab966f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:597:8
    #21 0x7f289702e8eb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2856:10
    #22 0x7f2892d2f740 in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:30:8
    #23 0x7f28909135dc in mozilla::dom::PromiseJobCallback::Call(mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:90:12
    #24 0x7f2890912973 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:103:12
    #25 0x7f2890912973 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:212:18
    #26 0x7f28908ff1d7 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:647:17
    #27 0x7f2893a0d741 in LeaveMicroTask /builds/worker/workspace/obj-build/dist/include/mozilla/CycleCollectedJSContext.h:233:7
    #28 0x7f2893a0d741 in mozilla::dom::CallbackObject::CallSetup::~CallSetup() /builds/worker/checkouts/gecko/dom/bindings/CallbackObject.cpp:393:11
    #29 0x7f2892728590 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject> >(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:73:3
    #30 0x7f28927281f8 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /builds/worker/checkouts/gecko/dom/base/TimeoutHandler.cpp:167:29
    #31 0x7f289252ab75 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /builds/worker/checkouts/gecko/dom/base/nsGlobalWindowInner.cpp:6245:38
    #32 0x7f2892725e22 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /builds/worker/checkouts/gecko/dom/base/TimeoutManager.cpp:900:44
    #33 0x7f2892725564 in mozilla::dom::TimeoutExecutor::MaybeExecute() /builds/worker/checkouts/gecko/dom/base/TimeoutExecutor.cpp:179:11
    #34 0x7f2892726b62 in Notify /builds/worker/checkouts/gecko/dom/base/TimeoutExecutor.cpp:246:5
    #35 0x7f2892726b62 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /builds/worker/checkouts/gecko/dom/base/TimeoutExecutor.cpp
    #36 0x7f2890a09eac in nsTimerImpl::Fire(int) /builds/worker/checkouts/gecko/xpcom/threads/nsTimerImpl.cpp:565:39
    #37 0x7f2890a09b28 in nsTimerEvent::Run() /builds/worker/checkouts/gecko/xpcom/threads/TimerThread.cpp:252:11
    #38 0x7f2890a2b2cc in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /builds/worker/checkouts/gecko/xpcom/threads/ThrottledEventQueue.cpp:254:22
    #39 0x7f2890a25e01 in mozilla::ThrottledEventQueue::Inner::Executor::Run() /builds/worker/checkouts/gecko/xpcom/threads/ThrottledEventQueue.cpp:81:15
    #40 0x7f28909fe88f in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:472:16
    #41 0x7f28909fce00 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:760:26
    #42 0x7f28909fbbc4 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:611:15
    #43 0x7f28909fbd77 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:395:36
    #44 0x7f2890a02719 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:136:37
    #45 0x7f2890a02719 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
    #46 0x7f2890a13b97 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1158:16
    #47 0x7f2890a1a5aa in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #48 0x7f2891340a44 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:109:5
    #49 0x7f28912abee3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #50 0x7f28912abdfd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #51 0x7f28912abdfd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #52 0x7f2895128788 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #53 0x7f2896980a33 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:902:20
    #54 0x7f289134197c in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #55 0x7f28912abee3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #56 0x7f28912abdfd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #57 0x7f28912abdfd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #58 0x7f2896980608 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:733:34
    #59 0x560797657fa6 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #60 0x560797657fa6 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:309:18
    #61 0x7f28a5b110b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210310215846-db7158dfb86d.
The bug appears to have been introduced in the following build range:

Start: 160b47b7163e1a80ac366e0ef9fc10b631c35c03 (20210211154112)
End: c5a7e3ee7a6307a61d4fa7f2bda6ca5345d284ea (20210211135354)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=160b47b7163e1a80ac366e0ef9fc10b631c35c03&tochange=c5a7e3ee7a6307a61d4fa7f2bda6ca5345d284ea

Comment 2

[John Lin [:jhlin][:jolin]]

Moving the bug to the recording component for it crashed in MediaRecoder code.

Comment 3

[Karl Tomlinson (:karlt)]

https://hg.mozilla.org/mozilla-central/annotate/056c2a428e2d/dom/media/MediaRecorder.cpp#l783

The assertion and apparently the related use of mEncoder was introduced in https://hg.mozilla.org/mozilla-central/rev/28563731435bbb037be242d98b83d5b556e8cf05#l1.118

Andreas, can you triage this please?

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1464268

Comment 5

[Julien Cristau [:jcristau] (back April 22)]

Paul would you mind setting a priority/severity on this bug?

Comment 6

[Paul Adenot (:padenot)]

I've submitted it to pernosco, I'll have a look monday. It's probably a case where we should early return and throw or something.

Comment 7

[Paul Adenot (:padenot)]

https://pernos.co/debug/SRTqHGwZ15tNwcXTM4ogHA/index.html

Comment 8

[Andreas Pehrson [:pehrsons]]

Thanks for the pernosco recording!

In this test case we try to record two video tracks. That is not allowed so we exit before having created a MediaEncoder.

In MediaRecorder::RequestData we have a guard looking at the state attribute when judging whether we can request data from the encoder.

Because in the spec, in start() the state attribute is set to "recording" synchronously, but once started it is only unset asynchronously ("in parallel"). If requestData() happens in between those, we assume an encoder is present. But we do the multi-tracks check after setting the state attribute to "recording" but before creating an encoder, so in that sense we are already in the "in parallel" section... and the exception and resetting of the state attribute are async.

There is however a step in start() prior to setting the state attribute to "recording" that allows for throwing if we'll be unable to record any of the tracks. We should use that.

Comment 10

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1697521 - Add crashtest. r?padenot

Comment 11

[Andreas Pehrson [:pehrsons]]

Attachment: Bug 1697521 - In MediaRecorder check for multiple tracks synchronously, per spec. r?padenot

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eeb37d5b63fc
Add crashtest. r=padenot
https://hg.mozilla.org/integration/autoland/rev/eda8b31c7659
In MediaRecorder check for multiple tracks synchronously, per spec. r=padenot

Comment 13

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/eeb37d5b63fc
https://hg.mozilla.org/mozilla-central/rev/eda8b31c7659

Comment 14

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20210406152948-b85e871f6a8d.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.