Open
Bug 1882924
Opened 1 year ago
Updated 1 year ago
Crash in [@ mozilla::MediaTrackGraphImpl::OneIterationImpl]
Categories
(Core :: Audio/Video: Playback, defect)
Tracking
()
NEW
People
(Reporter: mccr8, Unassigned)
Details
(Keywords: crash)
Crash Data
Attachments
(3 files)
Crash report: https://crash-stats.mozilla.org/report/index/8fd7677f-77b2-4d20-a648-0f72e0240229
MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(mLifecycleState <= LIFECYCLE_RUNNING)
Top 10 frames of crashing thread:
0 xul.dll mozilla::MediaTrackGraphImpl::OneIterationImpl dom/media/MediaTrackGraph.cpp:1608
1 xul.dll mozilla::GraphRunner::Run dom/media/GraphRunner.cpp:141
2 xul.dll nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1193
2 xul.dll NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:480
3 xul.dll mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:300
4 xul.dll MessageLoop::RunInternal ipc/chromium/src/base/message_loop.cc:370
4 xul.dll MessageLoop::RunHandler ipc/chromium/src/base/message_loop.cc:363
5 xul.dll MessageLoop::Run ipc/chromium/src/base/message_loop.cc:345
5 xul.dll nsThread::ThreadFunc xpcom/threads/nsThread.cpp:370
6 nss3.dll _PR_NativeRunThread nsprpub/pr/src/threads/combined/pruthr.c:399
|
||
Updated•1 year ago
|
Severity: -- → S3
Hey, I also found this bug in version 125, but I couldn't reproduce it in version 126. I'm not sure if it's because the bug has been fixed.
UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
- use fuzzfetch get firefox(m-c-20240223034030-asan-opt) or compile 125.0a1 version.
- serve poc.html and assets at port 8080.
- set user_prefs: media.autoplay.default=0
- run command "./firefox http://127.0.0.1:8080/poc.html".
poc.html
<!DOCTYPE html>
<html>
<body>
<script>
async function crash() {
let video = document.createElement('video');
video.src = "http://127.0.0.1:8080/video.mp4";
video.play().then(_=>{
video.mozCaptureStream();
let audio = document.createElement('audio');
audio.src = "http://127.0.0.1:8080/audio.mp3";
audio.play().then(_=>{
audio.mozCaptureStream();
})
})
setTimeout(_=>location.reload(), 500);
}
let htmlSource = `
<html>
<body>
<script>
${crash.toString()} ${crash.name}();
<\/script>
<\/body>
<\/html>`;
let frameUrl = URL.createObjectURL(new Blob([htmlSource], { type: 'text/html' }));
for(let i=0; i<8; i++){
let iframe = document.createElement('iframe');
iframe.src = frameUrl;
document.body.appendChild(iframe);
}
</script>
</body>
</html>
You need to log in
before you can comment on or make changes to this bug.
Description
•