1848669 - Assertion failure: mStart <= mEnd (Invalid Interval), at /builds/worker/workspace/obj-build/dist/include/Intervals.h:48

Status: VERIFIED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.zip

Found while fuzzing m-c 20230808-b19ed5a6579d (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: mStart <= mEnd (Invalid Interval), at /builds/worker/workspace/obj-build/dist/include/Intervals.h:48

#0 0x7f9972ac6745 in Interval<mozilla::media::TimeUnit &, mozilla::media::TimeUnit> /builds/worker/workspace/obj-build/dist/include/Intervals.h:48:5
#1 0x7f9972ac6745 in mozilla::AudioTrimmer::PrepareTrimmers(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/AudioTrimmer.cpp:206:14
#2 0x7f9972ac594a in mozilla::AudioTrimmer::Decode(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/AudioTrimmer.cpp:32:3
#3 0x7f9972ae2649 in operator() /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaDataDecoderProxy.cpp:31:33
#4 0x7f9972ae2649 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaDataDecoderProxy::Decode(mozilla::MediaRawData*)::$_0, mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData>>, mozilla::MediaResult, true>>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1690:29
#5 0x7f996e724d1b in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:257:20
#6 0x7f996e74edf5 in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14
#7 0x7f996e74530d in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1193:16
#8 0x7f996e74c0ad in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#9 0x7f996f3f712e in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#10 0x7f996f310121 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#11 0x7f996f310121 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#12 0x7f996e740996 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#13 0x7f9983bd09ef in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#14 0x7f9983894b42 in start_thread nptl/pthread_create.c:442:8
#15 0x7f99839269ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Mayank Bansal]

Got a crash from the testcase: https://crash-stats.mozilla.org/report/index/d9fea6c7-193a-4b72-96fe-24b500230814

Comment 2

[Mayank Bansal]

Regression range: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=d1fbe6c1f87656fb4f55677904f55f6df433ea9a&tochange=e78e15a11c7c9c583172c6dc65f25fc847c46f5f

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230814214038-27c67d619752.
The bug appears to have been introduced in the following build range:

Start: d1fbe6c1f87656fb4f55677904f55f6df433ea9a (20230808155443)
End: 062a5e5729067f579bd6d1ab2f1a3021d7fd291a (20230808122031)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d1fbe6c1f87656fb4f55677904f55f6df433ea9a&tochange=062a5e5729067f579bd6d1ab2f1a3021d7fd291a

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1839391

Comment 5

[Takanori MATSUURA]

Dup. of bug 1741768?

Comment 6

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 7

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

:padenot, since you are the author of the regressor, bug 1839391, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 9

[Paul Adenot (:padenot)]

Attachment: Bug 1848669 - Handle invalid duration in OGG files gracefully. r?alwu

Depends on D186346

Comment 10

[Paul Adenot (:padenot)]

Attachment: Bug 1848669 - Fix clang-tidy warnings in OggDemuxer.cpp. r?alwu

Depends on D186356

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/17485580fa8a
Handle invalid duration in OGG files gracefully. r=alwu
https://hg.mozilla.org/integration/autoland/rev/939dacb7eea3
Fix clang-tidy warnings in OggDemuxer.cpp. r=alwu

Comment 12

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/17485580fa8a
https://hg.mozilla.org/mozilla-central/rev/939dacb7eea3

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230823042133-d44458b9c71f.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.