Closed Bug 1918506 Opened 4 months ago Closed 4 months ago

Tab crashes with too deep recursion stack in AudioWorkletGlobalScope

Categories

(Core :: Audio/Video: Playback, defect)

Firefox 132
x86_64
Windows 10
defect

Tracking

()

RESOLVED FIXED
132 Branch
Tracking Status
firefox132 --- fixed

People

(Reporter: spesekspesek, Assigned: padenot)

References

Details

Attachments

(3 files)

Attached file bug.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0

Steps to reproduce:

I have a JavaScript code that recursively calculates time based on tempo changes. One file has around 2400 tempo changes and it crashes the tab.

I've narrowed the issue down to this basic example:

index.html
<!DOCTYPE html>
<html lang="en">
<body>
<button id="tester">Press to crash firefox</button>
<script>
document.getElementById("tester").onclick = async () => {
const context = new AudioContext();
await context.audioWorklet.addModule("worklet.js");
}
</script>
</body>
</html>

worklet.js:
function recursive(a)
{
if(a < 0) return 0;
return recursive(a - 1);
}

console.log(recursive(2400));

Actual results:

Gah! Your tab has just crashed. Tested on a Windows 10 64-bit Desktop and Laptop. With both stock firefox and the freshly installed Nightly version.

Chromium works fine.

Expected results:

It should work properly and return 0 like chromium, not crash the entire tab.

Component: Untriaged → JavaScript Engine
OS: Unspecified → Windows 10
Product: Firefox → Core
Hardware: Unspecified → x86_64

I couldnt get the testcase to work because of "CORS". Devs will be able to get it to work.
Tentatively moving to A/V.
cc :padenot.

Component: JavaScript Engine → Audio/Video: Playback

(In reply to Mayank Bansal from comment #1)

I couldnt get the testcase to work because of "CORS". Devs will be able to get it to work.
Tentatively moving to A/V.
cc :padenot.

Yes, I forgot to mention that the index.html has to be opened via a http server and not by double clicking, for example if you have node.js installed you can do:
npx http-Server -p 8000
And go to localhost:8000

Attached file crash.html

Test case, don't run because it crashes the tab

Assignee: nobody → padenot
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Pushed by padenot@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/e3de3b34123b Align stack sizes for AudioWorkletProcessor. r=karlt

Backed out for causing reftest failure on audioworkletprocessor-recursion.html

Backout link

Push with failures

Failure log

Flags: needinfo?(padenot)
See Also: → 1919300
Pushed by padenot@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/0106c8776628 Align stack sizes for AudioWorkletProcessor. r=karlt
Status: ASSIGNED → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → 132 Branch
Flags: needinfo?(padenot)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: