1905399 - Assertion failure: frames == computedFrames, at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:698

Status: VERIFIED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240613-bfd01427a5e8 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: frames == computedFrames, at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:698

#0 0x76ac3132e5b6 in mozilla::dom::AudioData::ToAudioData() const /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:698:3
#1 0x76ac31356967 in CreateInputInternal /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioEncoder.cpp:357:17
#2 0x76ac31356967 in mozilla::dom::EncoderTemplate<mozilla::dom::AudioEncoderTraits>::EncodeAudioData(mozilla::dom::AudioData&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:158:7
#3 0x76ac2f185ad5 in mozilla::dom::AudioEncoder_Binding::encode(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./AudioEncoderBinding.cpp:1188:38
#4 0x76ac30139157 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3268:13
#5 0x76ac33907f04 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:487:13
#6 0x76ac339076ef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:581:12
#7 0x76ac3443c466 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jit/BaselineIC.cpp:1670:10
#8 0x8dfdb635a5e  ([anon:js-executable-memory]+0x2ba5e)

Comment 1

[Mayank Bansal]

Got a crash from the latest Nightly on the testcase: https://crash-stats.mozilla.org/report/index/b290e2c4-5e5c-428d-9ab8-99a1c0240629

Comment 2

[Paul Adenot (:padenot)]

Attachment: Bug 1905399 - Properly handle floating point sample rate in AudioData ctor when it is < 1.0. r?chunmin

Comment 3

[Paul Adenot (:padenot)]

Attachment: Bug 1905399 - Introduce SaturatedCast<>. r?nbp

Comment 4

[Paul Adenot (:padenot)]

Attachment: Bug 1905399 - Properly convert the sample-rate to integer when constructing an AudioData. r?chunmin

Comment 5

[Paul Adenot (:padenot)]

Attachment: Bug 1905399 - Allow constructing an AudioData from a buffer that is larger than strictly needed. r?chunmin

Comment 6

[Paul Adenot (:padenot)]

Attachment: Bug 1905399 - Convert the fuzzing testcase into a crashtest. r?chunmin

Comment 7

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240708220117-162448b8b7cd.
The bug appears to have been introduced in the following build range:

Start: f8ac03b3c764017d5704deed413c8d35c99978fd (20240327214448)
End: 58dd31405d200bdd0a2d81caa466c16bcb43b84b (20240327155832)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f8ac03b3c764017d5704deed413c8d35c99978fd&tochange=58dd31405d200bdd0a2d81caa466c16bcb43b84b

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dcbe5bbf111b
Introduce SaturatedCast<>. r=nbp
https://hg.mozilla.org/integration/autoland/rev/e7ad55566453
Properly convert the sample-rate to integer when constructing an AudioData. r=chunmin
https://hg.mozilla.org/integration/autoland/rev/5684c604d1f2
Allow constructing an AudioData from a buffer that is larger than strictly needed. r=chunmin
https://hg.mozilla.org/integration/autoland/rev/19898505b953
Convert the fuzzing testcase into a crashtest. r=chunmin

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/336d18e0fd55
Hand hold GCC into understanding the types are of the same signedness statically. CLOSED TREE

Comment 10

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/dcbe5bbf111b
https://hg.mozilla.org/mozilla-central/rev/e7ad55566453
https://hg.mozilla.org/mozilla-central/rev/5684c604d1f2
https://hg.mozilla.org/mozilla-central/rev/19898505b953
https://hg.mozilla.org/mozilla-central/rev/336d18e0fd55

Comment 11

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240712220645-c2bbd19af8dc.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.