1748272 - Assertion failure: aGraph->GraphRate() == ctx->SampleRate(), at /dom/media/webaudio/AudioNodeExternalInputTrack.cpp:33

Status: VERIFIED FIXED

(Core :: Web Audio, defect, P1)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 1cb2015e6fbc (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 1cb2015e6fbc --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: aGraph->GraphRate() == ctx->SampleRate(), at /dom/media/webaudio/AudioNodeExternalInputTrack.cpp:33

    ==76589==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f377dcf2eea bp 0x7ffc385b84f0 sp 0x7ffc385b84c0 T76589)
    ==76589==The signal is caused by a WRITE memory access.
    ==76589==Hint: address points to the zero page.
        #0 0x7f377dcf2eea in mozilla::AudioNodeExternalInputTrack::Create(mozilla::MediaTrackGraph*, mozilla::AudioNodeEngine*) /dom/media/webaudio/AudioNodeExternalInputTrack.cpp:33:3
        #1 0x7f377dd2890c in mozilla::dom::MediaStreamAudioSourceNode::Init(mozilla::DOMMediaStream&, mozilla::ErrorResult&) /dom/media/webaudio/MediaStreamAudioSourceNode.cpp:69:12
        #2 0x7f377dd286f1 in mozilla::dom::MediaElementAudioSourceNode::Create(mozilla::dom::AudioContext&, mozilla::dom::MediaElementAudioSourceOptions const&, mozilla::ErrorResult&) /dom/media/webaudio/MediaElementAudioSourceNode.cpp:61:9
        #3 0x7f377dce4e12 in mozilla::dom::AudioContext::CreateMediaElementSource(mozilla::dom::HTMLMediaElement&, mozilla::ErrorResult&) /dom/media/webaudio/AudioContext.cpp:448:10
        #4 0x7f377bdc343e in mozilla::dom::AudioContext_Binding::createMediaElementSource(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/AudioContextBinding.cpp:492:94
        #5 0x7f377cfbd3f8 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3306:13
        #6 0x7f3780a167af in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:425:13
        #7 0x7f3780a15ead in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:512:12
        #8 0x7f3780a1798e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:572:10
        #9 0x7f3780a0d196 in CallFromStack /js/src/vm/Interpreter.cpp:576:10
        #10 0x7f3780a0d196 in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3309:16
        #11 0x7f3780a040b3 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:394:13
        #12 0x7f3780a15da8 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:544:13
        #13 0x7f3780a1798e in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /js/src/vm/Interpreter.cpp:572:10
        #14 0x7f3780a17b91 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:589:8
        #15 0x7f3780bd6fa1 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #16 0x7f377cd5af54 in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/FunctionBinding.cpp:50:8
        #17 0x7f377bbd9382 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject> >(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12
        #18 0x7f377bbd911d in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /dom/base/TimeoutHandler.cpp:167:29
        #19 0x7f377b8befa1 in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /dom/base/nsGlobalWindowInner.cpp:6291:38
        #20 0x7f377bbd5da3 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:893:44
        #21 0x7f377bbd4e00 in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #22 0x7f377bbd7209 in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #23 0x7f377bbd7209 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp
        #24 0x7f3779c5391d in operator() /xpcom/threads/nsTimerImpl.cpp:654:44
        #25 0x7f3779c5391d in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #26 0x7f3779c5391d in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:653:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #27 0x7f3779c5391d in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:653:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
        #28 0x7f3779c5391d in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:653:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:654:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:655:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:658:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:659:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
        #29 0x7f3779c5391d in nsTimerImpl::Fire(int) /xpcom/threads/nsTimerImpl.cpp:652:22
        #30 0x7f3779c2556e in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:265:11
        #31 0x7f3779c446ea in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:254:22
        #32 0x7f3779c41951 in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:81:15
        #33 0x7f3779c42a7e in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:468:16
        #34 0x7f3779c1c716 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:771:26
        #35 0x7f3779c1b3d8 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:607:15
        #36 0x7f3779c1b653 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:391:36
        #37 0x7f3779c46159 in operator() /xpcom/threads/TaskController.cpp:127:37
        #38 0x7f3779c46159 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:531:5
        #39 0x7f3779c31053 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1183:16
        #40 0x7f3779c382ba in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:467:10
        #41 0x7f377a6dab84 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #42 0x7f377a5fa0b7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #43 0x7f377a5f9fc2 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #44 0x7f377a5f9fc2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #45 0x7f377e8775a8 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #46 0x7f378089a333 in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:864:20
        #47 0x7f377a6dbaca in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #48 0x7f377a5fa0b7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:331:10
        #49 0x7f377a5f9fc2 in RunHandler /ipc/chromium/src/base/message_loop.cc:324:3
        #50 0x7f377a5f9fc2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:306:3
        #51 0x7f378089996b in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:701:34
        #52 0x56305066f029 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #53 0x56305066f029 in main /browser/app/nsBrowserApp.cpp:327:18
        #54 0x7f378eeda0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
        #55 0x56305064a7bc in _start (/home/jkratzer/builds/mc-debug/firefox-bin+0x157bc)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/media/webaudio/AudioNodeExternalInputTrack.cpp:33:3 in mozilla::AudioNodeExternalInputTrack::Create(mozilla::MediaTrackGraph*, mozilla::AudioNodeEngine*)
    ==76589==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220103215519-a6af5cff5adf.
Failed to bisect testcase (Testcase reproduces on start build!):

Start: 1d89f3cb5bb3e5a37b0249977838c4a98c162c80 (20210105043131)
End: 1cb2015e6fbc11f3a03137692fe60b111b94693a (20220103092929)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Comment 3

[Paul Adenot (:padenot)]

Attachment: Bug 1748272 - Compare graphs instead of sample-rates when creating an AudioNodeExternalInputTrack. r?karlt

What is happening here is that the left hand side operand of the equality
operator is an integer, and the right hand side operand is a float, that has a
fractional value that is not null. The left hand side gets promoted to a float
and the equality check fails.

In practice, the graph is always instantiated with a sample-rate that is an
integer, and this conversion happens without explicit rounding, so it's a floor
operation. However, the sample-rate of an AudioContext is a float, so there is
an edge case where the graph and the AudioContext don't have the same
sample-rate.

I don't think this matters in practice.

Switching to comparing that the graph passed as a parameter is the same as the
graph the AudioNode is in is enough to assert here and doesn't suffer from the
sample-rate problem.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ace01ed41aca
Compare graphs instead of sample-rates when creating an AudioNodeExternalInputTrack. r=karlt

Comment 5

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/ace01ed41aca

Comment 6

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220105170324-138105a14659.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

:padenot, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Comment 8

[Marco Castelluccio [:marco]]

Sorry, bug in the bot.