1821477 - Assertion failure: !mRequestedCaptureInterval.IsZero(), at /builds/worker/checkouts/gecko/dom/media/systemservices/video_engine/desktop_capture_impl.cc:700

Status: VERIFIED FIXED

(Core :: WebRTC, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230301-0e5bee0c373f (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !mRequestedCaptureInterval.IsZero(), at /builds/worker/checkouts/gecko/dom/media/systemservices/video_engine/desktop_capture_impl.cc:700

#0 0x7f30e2f0364c in webrtc::DesktopCaptureImpl::InitOnThread(int) /builds/worker/checkouts/gecko/dom/media/systemservices/video_engine/desktop_capture_impl.cc:700:3
#1 0x7f30e2f19512 in operator() /builds/worker/checkouts/gecko/dom/media/systemservices/video_engine/desktop_capture_impl.cc:539:56
#2 0x7f30e2f19512 in mozilla::detail::RunnableFunction<webrtc::DesktopCaptureImpl::StartCapture(webrtc::VideoCaptureCapability const&)::$_23>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:547:5
#3 0x7f30dec7e622 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16
#4 0x7f30dec849ad in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
#5 0x7f30df8d878a in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#6 0x7f30df7f8fc8 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#7 0x7f30df7f8ed1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#8 0x7f30df7f8ed1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#9 0x7f30dec799c7 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#10 0x7f30f1e6dc86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#11 0x7f30f2716b42 in start_thread nptl/pthread_create.c:442:8
#12 0x7f30f27a89ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230309214328-8aea0e783414.
The bug appears to have been introduced in the following build range:

Start: 85c6be80e3615ad12a25c350772c8c1fa8bcb105 (20230228141206)
End: d245efcf2257c4c5ef75155f3645a1b1d49e3775 (20230228153217)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=85c6be80e3615ad12a25c350772c8c1fa8bcb105&tochange=d245efcf2257c4c5ef75155f3645a1b1d49e3775

Comment 2

[Dianna Smith [:diannaS]]

:pehrsons from the regression range, this looks like bug 1800213 in fx112

Comment 3

[Andreas Pehrson [:pehrsons] (PTO; back in Jan)]

We should wrap this TimeDuration in a Maybe instead of using 0 to denote whether it was set.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:pehrsons, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.

Comment 5

[Andreas Pehrson [:pehrsons] (PTO; back in Jan)]

Attachment: Bug 1821477 - Add crashtest. r?karlt!

Comment 6

[Andreas Pehrson [:pehrsons] (PTO; back in Jan)]

Attachment: Bug 1821477 - Use Maybe to denote whether mRequestedCaptureInterval is set. r?karlt!

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1800213

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1f46756106a4
Add crashtest. r=karlt
https://hg.mozilla.org/integration/autoland/rev/74f4c1f8e412
Use Maybe to denote whether mRequestedCaptureInterval is set. r=karlt

Comment 9

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/1f46756106a4
https://hg.mozilla.org/mozilla-central/rev/74f4c1f8e412

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230315162649-c67b17937a5e.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 11

[Andreas Pehrson [:pehrsons] (PTO; back in Jan)]

Comment on attachment 9322482 [details]
Bug 1821477 - Use Maybe to denote whether mRequestedCaptureInterval is set. r?karlt!

Beta/Release Uplift Approval Request

• User impact if declined: Assertion failure in the parent process can be triggered at will in debug builds, so probably mainly affecting fuzzing.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Adds a bool to say whether the value was set, and removes the offending assertion. It does introduce a release assertion if we access the value and it is not set, but this failure mode is what we really would like to know about. I have high confidence in it not happening, it is mostly there to catch regressions.
• String changes made/needed:
• Is Android affected?: No

Comment 12

[Dianna Smith [:diannaS]]

Comment on attachment 9322482 [details]
Bug 1821477 - Use Maybe to denote whether mRequestedCaptureInterval is set. r?karlt!

Approved for 112.0b3

Comment 13

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/c913f22c1ec9
https://hg.mozilla.org/releases/mozilla-beta/rev/7d48d258b795