1717660 - Assertion failure: aTimeThreshold >= TimeUnit::Zero(), at /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:1345

Status: RESOLVED DUPLICATE of bug 1716474

(Core :: Audio/Video, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.zip

Testcase found while fuzzing mozilla-central rev 997f00815e6b (built with --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 997f00815e6b --debug --fuzzing -n mc-debug
$ python -m grizzly.replay ./mc-debug/firefox ./testcase.zip

Assertion failure: aTimeThreshold >= TimeUnit::Zero(), at /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:1345

    #0 0x7f294cf7f07b in mozilla::MediaFormatReader::ShouldSkip(mozilla::media::TimeUnit, bool) /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:1345:3
    #1 0x7f294cf7f614 in mozilla::MediaFormatReader::RequestVideoData(mozilla::media::TimeUnit const&, bool) /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:1392:11
    #2 0x7f294d14beea in applyImpl<mozilla::MediaFormatReader, RefPtr<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true> > (mozilla::MediaFormatReader::*)(const mozilla::media::TimeUnit &, bool), StoreCopyPassByRRef<mozilla::media::TimeUnit>, StoreCopyPassByRRef<bool> , 0, 1> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1150:12
    #3 0x7f294d14beea in apply<mozilla::MediaFormatReader, RefPtr<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true> > (mozilla::MediaFormatReader::*)(const mozilla::media::TimeUnit &, bool)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1156:12
    #4 0x7f294d14beea in Invoke /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1516:47
    #5 0x7f294d14beea in mozilla::detail::ProxyRunnable<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true>, RefPtr<mozilla::MozPromise<RefPtr<mozilla::VideoData>, mozilla::MediaResult, true> > (mozilla::MediaFormatReader::*)(mozilla::media::TimeUnit const&, bool), mozilla::MediaFormatReader, StoreCopyPassByRRef<mozilla::media::TimeUnit>, StoreCopyPassByRRef<bool> >::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1536:42
    #6 0x7f2949859ff8 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/TaskDispatcher.h:227:35
    #7 0x7f2949860d36 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:208:20
    #8 0x7f2949878f7b in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:303:14
    #9 0x7f294986fc28 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1146:16
    #10 0x7f294987679a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #11 0x7f294a18099b in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
    #12 0x7f294a0e7527 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
    #13 0x7f294a0e7442 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
    #14 0x7f294a0e7442 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
    #15 0x7f294986c3ff in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:392:10
    #16 0x7f295eacaac7 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #17 0x7f295f83e608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
    #18 0x7f295f406292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[John Lin [:jhlin][:jolin]]

The assertion has been removed in bug 1716474. Marking as dup.

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
No valid actions for resolution (DUPLICATE)
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.