1907438 - Assertion failure: !aCopyToSpec.mFromScript, at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:435

Status: VERIFIED FIXED

(Core :: Audio/Video: Web Codecs, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240704-5b8afe1090fc (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !aCopyToSpec.mFromScript, at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:435

#0 0x708a4793b2f2 in void mozilla::dom::CopySamples<short, short>(mozilla::Span<short, 18446744073709551615ul>, mozilla::Span<short, 18446744073709551615ul>, unsigned int, mozilla::dom::AudioSampleFormat, mozilla::dom::CopyToSpec const&) /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:435:5
#1 0x708a478f5c40 in operator()<mozilla::Span<short, 18446744073709551615UL> > /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:524:7
#2 0x708a478f5c40 in match<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:523:17), mozilla::Variant<mozilla::Span<unsigned char, 18446744073709551615UL>, mozilla::Span<short, 18446744073709551615UL>, mozilla::Span<int, 18446744073709551615UL>, mozilla::Span<float, 18446744073709551615UL> > &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:266:16
#3 0x708a478f5c40 in match<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:523:17), mozilla::Variant<mozilla::Span<unsigned char, 18446744073709551615UL>, mozilla::Span<short, 18446744073709551615UL>, mozilla::Span<int, 18446744073709551615UL>, mozilla::Span<float, 18446744073709551615UL> > &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14
#4 0x708a478f5c40 in match<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:523:17)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:852:12
#5 0x708a478f5c40 in operator()<mozilla::Span<short, 18446744073709551615UL> > /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:523:11
#6 0x708a478f5c40 in match<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:522:17), mozilla::Variant<mozilla::Span<unsigned char, 18446744073709551615UL>, mozilla::Span<short, 18446744073709551615UL>, mozilla::Span<int, 18446744073709551615UL>, mozilla::Span<float, 18446744073709551615UL> > &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:266:16
#7 0x708a478f5c40 in match<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:522:17), mozilla::Variant<mozilla::Span<unsigned char, 18446744073709551615UL>, mozilla::Span<short, 18446744073709551615UL>, mozilla::Span<int, 18446744073709551615UL>, mozilla::Span<float, 18446744073709551615UL> > &> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:279:14
#8 0x708a478f5c40 in match<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:522:17)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:852:12
#9 0x708a478f5c40 in mozilla::dom::CopySamples(mozilla::Variant<mozilla::Span<unsigned char, 18446744073709551615ul>, mozilla::Span<short, 18446744073709551615ul>, mozilla::Span<int, 18446744073709551615ul>, mozilla::Span<float, 18446744073709551615ul>>&, mozilla::Variant<mozilla::Span<unsigned char, 18446744073709551615ul>, mozilla::Span<short, 18446744073709551615ul>, mozilla::Span<int, 18446744073709551615ul>, mozilla::Span<float, 18446744073709551615ul>>&, unsigned int, mozilla::dom::AudioSampleFormat, mozilla::dom::CopyToSpec const&) /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:522:11
#10 0x708a478f5fb3 in mozilla::dom::DoCopy(mozilla::Span<unsigned char, 18446744073709551615ul>, mozilla::Span<unsigned char, 18446744073709551615ul>, unsigned int, mozilla::dom::AudioSampleFormat, mozilla::dom::CopyToSpec const&) /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:535:3
#11 0x708a478f67c3 in operator() /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:593:5
#12 0x708a478f67c3 in CallProcessor<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:592:41)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:579:12
#13 0x708a478f67c3 in ProcessFixedData<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:592:41)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:685:12
#14 0x708a478f67c3 in operator()<mozilla::dom::ArrayBufferView_base<&JS_GetArrayBufferViewType> > /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1023:28
#15 0x708a478f67c3 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1022:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:938:1
#16 0x708a478f67c3 in Apply<(lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1022:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:952:19
#17 0x708a478f67c3 in ApplyToTypedArrays<mozilla::dom::MaybeSharedArrayBufferViewOrMaybeSharedArrayBuffer, (lambda at /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1022:15)> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:972:7
#18 0x708a478f67c3 in ProcessTypedArraysFixed<mozilla::dom::MaybeSharedArrayBufferViewOrMaybeSharedArrayBuffer, (lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:592:41), 0> /builds/worker/workspace/obj-build/dist/include/mozilla/dom/TypedArray.h:1021:10
#19 0x708a478f67c3 in mozilla::dom::AudioData::CopyTo(mozilla::dom::MaybeSharedArrayBufferViewOrMaybeSharedArrayBuffer const&, mozilla::dom::AudioDataCopyToOptions const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webcodecs/AudioData.cpp:592:3
#20 0x708a45937e2d in mozilla::dom::AudioData_Binding::copyTo(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./AudioDataBinding.cpp:745:24
#21 0x708a468236a7 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3268:13
#22 0x708a49baa774 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:491:13
#23 0x708a49ba9f5f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:585:12
#24 0x708a49bb9ff9 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:657:10
#25 0x708a49bb9ff9 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3394:16
#26 0x708a49ba96a6 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:463:13
#27 0x708a49baa058 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:617:13
#28 0x708a49bab55f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:684:8
#29 0x708a49caf6e7 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#30 0x708a46591b38 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
#31 0x708a46e07529 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#32 0x708a46e06607 in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:199:12
#33 0x708a46de0ded in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1345:22
#34 0x708a46de1ef4 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1662:12
#35 0x708a46de1769 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1559:35
#36 0x708a46dd572f in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:365:17
#37 0x708a46dd4da1 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:606:16
#38 0x708a46dd767f in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1221:11
#39 0x708a46dda8c3 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#40 0x708a46dac59b in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/DOMEventTargetHelper.cpp:153:17
#41 0x708a46de8962 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:214:13
#42 0x708a48568031 in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /builds/worker/checkouts/gecko/dom/workers/MessageEventRunnable.cpp:79:12
#43 0x708a485b550b in mozilla::dom::WorkerThreadRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/WorkerRunnable.cpp:443:12
#44 0x708a437ebbcc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1198:16
#45 0x708a437f273f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#46 0x708a485a0925 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3560:7
#47 0x708a48585248 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:2147:42
#48 0x708a437ebbcc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1198:16
#49 0x708a437f273f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#50 0x708a4434e6e5 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#51 0x708a442a41f1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#52 0x708a442a41f1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#53 0x708a437e6ec3 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:370:10
#54 0x708a526916ef in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#55 0x708a52094ac2 in start_thread nptl/pthread_create.c:442:8
#56 0x708a5212684f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Alastor Wu [:alwu]]

Web codecs audio issue, paul, is this something serious? If so, feel free to change the priority/severity. Thanks!

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240711215213-9881aaa9dcd6.
The bug appears to have been introduced in the following build range:

Start: 143c3925806ed35200c2a71e650e7e74f58520a7 (20240306140028)
End: 80c146334cd815908f83c30a8b660e50cb63e210 (20240306161516)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=143c3925806ed35200c2a71e650e7e74f58520a7&tochange=80c146334cd815908f83c30a8b660e50cb63e210

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1858958

Comment 4

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 5

[Paul Adenot (:padenot)]

Attachment: Bug 1907438 - Support planar -> interleaved copy. r?chunmin

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f909b8362033
Support planar -> interleaved copy. r=chunmin

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/47172 for changes under testing/web-platform/tests

Comment 8

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f909b8362033

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240717153113-7aa82d756333.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot