1849271 - Crash in [@ mozilla::Maybe<T>::value | mozilla::dom::CreateVideoInfo]

Status: RESOLVED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Andrew McCreight [:mccr8]]

Crash report: https://crash-stats.mozilla.org/report/index/126a36df-a9dd-41e6-b423-d079c0230801

MOZ_CRASH Reason: MOZ_RELEASE_ASSERT(isSome())

Top 10 frames of crashing thread:

0  xul.dll  AnnotateMozCrashReason  mfbt/Assertions.h:46
0  xul.dll  mozilla::Maybe<mozilla::dom::VideoTransferCharacteristics>::value const  mfbt/Maybe.h:753
0  xul.dll  mozilla::dom::CreateVideoInfo  dom/media/webcodecs/VideoDecoder.cpp:301
0  xul.dll  mozilla::dom::VideoDecoder::ProcessConfigureMessage  dom/media/webcodecs/VideoDecoder.cpp:1346
1  xul.dll  mozilla::dom::VideoDecoder::ProcessControlMessageQueue  dom/media/webcodecs/VideoDecoder.cpp:1283
2  xul.dll  mozilla::dom::VideoDecoder::Configure  dom/media/webcodecs/VideoDecoder.cpp:924
3  xul.dll  mozilla::dom::VideoDecoder_Binding::configure  dom/bindings/VideoDecoderBinding.cpp:886
4  xul.dll  mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>  dom/bindings/BindingUtils.cpp:3327
5  xul.dll  CallJSNative  js/src/vm/Interpreter.cpp:486
5  xul.dll  js::InternalCallOrConstruct  js/src/vm/Interpreter.cpp:580

It is the end of my work day so maybe I'm confused here, but this code doesn't make sense to me.

    if (!colorSpace.mTransfer.isSome()) {
      vi->mTransferFunction.emplace(ToTransferFunction(colorSpace.mTransfer.value()));
    }

if mTransfer is NOT some, then we run this code, and call value() on it, but that will always fail. I looked at a handful of reports, and they were all on this specific code, but as far as I can see the three things before it have the same issue.

I think this is a regression from bug 1831451. Before that patch, the test for this code was !colorSpace.mTransfer.IsNull(), so we'd only enter if it WASN'T null, but now we only enter if it IS null. I think the ! needed to be dropped when the test was reversed.

Comment 1

[Andrew McCreight [:mccr8]]

The crashes are missing line numbers for the leaf frames, but this Linux crash looks basically the same: bp-6463866e-eb63-45ba-ab6f-760c30230817

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1831451

Comment 3

[Paul Adenot (:padenot)]

Attachment: Bug 1849271 - Flip test when checking for the presence of optional colorspace members on a VideoDecoderConfig. r?#media-playback-reviewers

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ca737b661c6e
Flip test when checking for the presence of optional colorspace members on a VideoDecoderConfig. r=media-playback-reviewers,alwu

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/ca737b661c6e

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:padenot, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox117 to wontfix.

For more information, please visit BugBot documentation.

Comment 7

[Paul Adenot (:padenot)]

We're not shipping Web Codecs in beta so we don't need to uplift this.