1839193 - Assertion failure: mBase > 0, at /builds/worker/workspace/obj-build/dist/include/TimeUnits.h:84

Status: VERIFIED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.aac

Found while fuzzing m-c 20230618-1634cff61cb0 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.aac

Assertion failure: mBase > 0, at /builds/worker/workspace/obj-build/dist/include/TimeUnits.h:84

#0 0x7f5fc8066cc9 in TimeUnit /builds/worker/workspace/obj-build/dist/include/TimeUnits.h:84:5
#1 0x7f5fc8066cc9 in mozilla::FFmpegAudioDecoder<58>::DoDecode(mozilla::MediaRawData*, unsigned char*, int, bool*, nsTArray<RefPtr<mozilla::MediaData>>&) /builds/worker/checkouts/gecko/dom/media/platforms/ffmpeg/FFmpegAudioDecoder.cpp:350:34
#2 0x7f5fc8069c72 in mozilla::FFmpegDataDecoder<58>::DoDecode(mozilla::MediaRawData*, bool*, nsTArray<RefPtr<mozilla::MediaData>>&) /builds/worker/checkouts/gecko/dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp:204:10
#3 0x7f5fc8069314 in mozilla::FFmpegDataDecoder<58>::ProcessDecode(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp:158:20
#4 0x7f5fc808935b in operator()<StoreRefPtrPassByPtr<mozilla::MediaRawData> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
#5 0x7f5fc808935b in __invoke_impl<RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> >, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), StoreRefPtrPassByPtr<mozilla::MediaRawData> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#6 0x7f5fc808935b in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), StoreRefPtrPassByPtr<mozilla::MediaRawData> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#7 0x7f5fc808935b in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<StoreRefPtrPassByPtr<mozilla::MediaRawData> > &, 0UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#8 0x7f5fc808935b in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<StoreRefPtrPassByPtr<mozilla::MediaRawData> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#9 0x7f5fc808935b in apply<mozilla::FFmpegDataDecoder<58>, RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> > (mozilla::FFmpegDataDecoder<58>::*)(mozilla::MediaRawData *)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#10 0x7f5fc808935b in Invoke /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1569:47
#11 0x7f5fc808935b in mozilla::detail::ProxyRunnable<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData>>, mozilla::MediaResult, true>, RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData>>, mozilla::MediaResult, true>> (mozilla::FFmpegDataDecoder<58>::*)(mozilla::MediaRawData*), mozilla::FFmpegDataDecoder<58>, mozilla::MediaRawData*>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1589:42
#12 0x7f5fbf285880 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
#13 0x7f5fbf2d90dc in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14
#14 0x7f5fbf2c7639 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1193:16
#15 0x7f5fbf2d4d14 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#16 0x7f5fc0edd2e1 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#17 0x7f5fc0d04e3a in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370:10
#18 0x7f5fc0d04e3a in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#19 0x7f5fc0d04e3a in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#20 0x7f5fbf2be69a in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#21 0x7f5fe6103b3f in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#22 0x7f5fe5e94b42 in start_thread nptl/pthread_create.c:442:8
#23 0x7f5fe5f269ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1839193 using build mozilla-central 20230618205154-1634cff61cb0. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimm, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Jim Mathies [:jimm]]

Possible timing changes related. Paul, thoughts?

Comment 4

[Paul Adenot (:padenot)]

I can't repro, I'll try again.

Comment 5

[chylex]

https://crash-stats.mozilla.org/report/index/b365aac8-d8f2-41b3-a0a1-82ecc0230828

This issue was linked in the crash report. The crash happens to me consistently every time I seek a track from the Hades game OST. I will attach a short track from the OST to the issue, hopefully that's okay.

1. Drag the file into Firefox
2. When it starts playing, click the seek bar

Happens with the integrated audio controls, initially discovered with Airsonic.

Comment 6

[chylex]

Attachment: 18.flac

Track 18 of the official Hades game OST from Steam. Seeking it (or any other track from this OST) reproduces the crash.

Comment 7

[Tyson Smith [:tsmith]]

(In reply to chylex from comment #5)

https://crash-stats.mozilla.org/report/index/b365aac8-d8f2-41b3-a0a1-82ecc0230828

Thanks for the report. This stack looks different, I've open bug 1850453 for this flac related issue.

Comment 8

[Tyson Smith [:tsmith]]

Attachment: testcase.zip

Repackaged test case to make it bugmon friendly.

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230828212120-18ac70a5128d.
The bug appears to have been introduced in the following build range:

Start: 9fa4a7ae19238256fcd261c727ad2b08c6f1a4fd (20230524162134)
End: 6a96bb1f430f92b83cc31f74db4e4c1f71e155e5 (20230524133440)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9fa4a7ae19238256fcd261c727ad2b08c6f1a4fd&tochange=6a96bb1f430f92b83cc31f74db4e4c1f71e155e5

Comment 10

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 11

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 12

[Paul Adenot (:padenot)]

This doesn't reproduce on current tip. This has been fixed by the ffmpeg changes in https://lando.services.mozilla.com/D185170/

Comment 13

[Bugmon [:jkratzer for issues]]

Bug marked as FIXED but still reproduces on mozilla-central 20230912041249-3cf19f416a7b. If you believe this to be incorrect, please remove the bugmon keyword to prevent further analysis.

Comment 14

[Donal Meehan [:dmeehan]]

See Comment 13

Comment 15

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 16

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 17

[Paul Adenot (:padenot)]

Attachment: Bug 1839193 - Prefer using the sample-rate and channel count from the instance. r?alwu

Comment 18

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d881fdf179d0
Prefer using the sample-rate and channel count from the instance. r=alwu

Comment 19

[Noemi Erli[:noemi_erli]]

Backed out changeset d881fdf179d0 (Bug 1839193) for causing crashtest failures CLOSED TREE

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&collapsedPushes=842382&selectedTaskRun=b3SANovtQIOulZBlyuz_ww.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=d881fdf179d007c14151adff98cb7ce631ef623d

Log: https://treeherder.mozilla.org/logviewer?job_id=429792211&repo=autoland&lineNumber=4920
https://treeherder.mozilla.org/logviewer?job_id=429798834&repo=autoland&lineNumber=11198
https://treeherder.mozilla.org/logviewer?job_id=429796026&repo=autoland&lineNumber=7914
https://treeherder.mozilla.org/logviewer?job_id=429802896&repo=autoland&lineNumber=3665
https://treeherder.mozilla.org/logviewer?job_id=429804352&repo=autoland&lineNumber=3841

Backout: https://hg.mozilla.org/integration/autoland/rev/9f1523c5f6c16abe581d74d0cd8375b9b27d81a2

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d61a99de0775
Prefer using the sample-rate and channel count from the instance. r=alwu

Comment 21

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/d61a99de0775

Comment 22

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230921032132-137b5966e6ec.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.