1869145 - Assertion failure: *mRequestedCapability == aCapability, at /dom/media/systemservices/video_engine/desktop_capture_impl.cc:547

Status: ASSIGNED

(Core :: WebRTC: Audio/Video, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 31a6430ad25b (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 31a6430ad25b --debug --fuzzing  -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.zip

Assertion failure: *mRequestedCapability == aCapability, at /dom/media/systemservices/video_engine/desktop_capture_impl.cc:547

    r10 = 0x00007ff8cf5f0000	r11 = 0x000000fa3978e440	r12 = 0x00000248357045b0
    r13 = 0x00000248357045b0	r14 = 0x000000fa3978efd0	r15 = 0x000002484ca42f88
     r8 = 0x000000000000000e	 r9 = 0x00007ff8cf77ebf8	rax = 0x00007ff85beb14ad
    rbp = 0x0000000000000000	rbx = 0x000002484ca43000	rcx = 0x00007ff87ff66d78
    rdi = 0x000002484ca42f88	rdx = 0x0000000000000000	rip = 0x00007ff8555a20c0
    rsi = 0x000000fa3978efb0	rsp = 0x000000fa3978ee90
    OS|Windows NT|10.0.22621
    CPU|amd64|family 6 model 186 stepping 2|6
    Crash|EXCEPTION_BREAKPOINT|0x00007ff8555a20c0|69
    69|0|xul.dll|webrtc::DesktopCaptureImpl::StartCapture(webrtc::VideoCaptureCapability const&)|hg:hg.mozilla.org/mozilla-central:dom/media/systemservices/video_engine/desktop_capture_impl.cc:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|547|0xa0
    69|1|xul.dll|std::_Func_impl_no_alloc<`lambda at /dom/media/systemservices/CamerasParent.cpp:912:37',void,mozilla::camera::VideoEngine::CaptureEntry &>::_Do_call(mozilla::camera::VideoEngine::CaptureEntry&)|/builds/worker/fetches/vs/VC/Tools/MSVC/14.29.30133/include/functional|822|0x70d
    69|2|xul.dll|mozilla::camera::VideoEngine::WithEntry(const int, std::function<void (mozilla::camera::VideoEngine::CaptureEntry &)> const&&)|hg:hg.mozilla.org/mozilla-central:dom/media/systemservices/VideoEngine.cpp:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|201|0xfa
    69|3|xul.dll|mozilla::detail::ProxyFunctionRunnable<`lambda at /dom/media/systemservices/CamerasParent.cpp:898:7',mozilla::MozPromise<int,bool,1> >::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|1690|0x1a4
    69|4|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|1193|0xa60
    69|5|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|480|0x44
    69|6|xul.dll|mozilla::ipc::MessagePumpForNonMainUIThreads::DoRunLoop()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump_windows.cpp:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|38|0x18d
    69|7|xul.dll|base::MessagePumpWin::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_win.h:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|79|0x66
    69|8|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|363|0x4f
    69|9|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|345|0x6e
    69|10|xul.dll|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|370|0x15a
    69|11|nss3.dll|_PR_NativeRunThread(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/combined/pruthr.c:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|399|0x120
    69|12|nss3.dll|pr_root(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/md/windows/w95thred.c:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|139|0x10
    69|13|ucrtbase.dll||||
    69|14|KERNELBASE.dll||||
    69|15|kernel32.dll||||
    69|16|mozglue.dll|patched_BaseThreadInitThunk(int, void*, void*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:31a6430ad25b20a75a4b299efea5d8ca94c2dfe9|561|0x93
    69|17|ntdll.dll||||
    69|18|KERNELBASE.dll||||
    69|19|setupapi.dll||||

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231211095040-e84648aa607a.
The bug appears to have been introduced in the following build range:

Start: f1f7caea5de843c79770015a8acb658432768bf5 (20230523025255)
End: 3c72ca1b13e121d9718937311ecced167ed7e93d (20230523061907)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f1f7caea5de843c79770015a8acb658432768bf5&tochange=3c72ca1b13e121d9718937311ecced167ed7e93d

Comment 3

[az [:az]]

Looks like the assert itself was added in this patch. Would you have any thoughts here :pehrsons?

Comment 4

[Andreas Pehrson [:pehrsons]]

Thanks, I'll take a look!

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1809672