1934334 - AssertedCast error: Cannot cast -17.7571 from double to uint8_t: out of range [@ mozilla::dom::VideoEncoderConfigInternal::ToEncoderConfig]

Status: VERIFIED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20241129-ed73389dc144 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

AssertedCast error: Cannot cast -17.7571 from double to uint8_t: out of range

#0 0x724f0a09ca23 in AssertedCast<unsigned char, double> /builds/worker/workspace/obj-build/dist/include/mozilla/Casting.h:244:5
#1 0x724f0a09ca23 in mozilla::dom::VideoEncoderConfigInternal::ToEncoderConfig() const /builds/worker/checkouts/gecko/dom/media/webcodecs/VideoEncoder.cpp:281:24
#2 0x724f0a0c23cf in bool mozilla::EncoderSupport::Supports<mozilla::dom::VideoEncoderConfigInternal>(RefPtr<mozilla::dom::VideoEncoderConfigInternal> const&) /builds/worker/workspace/obj-build/dist/include/EncoderTraits.h:18:50
#3 0x724f0a0b2b8d in mozilla::dom::CanEncode(RefPtr<mozilla::dom::VideoEncoderConfigInternal> const&) /builds/worker/checkouts/gecko/dom/media/webcodecs/VideoEncoder.cpp:359:10
#4 0x724f0a099f47 in mozilla::dom::VideoEncoderTraits::IsSupported(mozilla::dom::VideoEncoderConfigInternal const&) /builds/worker/checkouts/gecko/dom/media/webcodecs/VideoEncoder.cpp:405:10
#5 0x724f0a098ac5 in mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ProcessConfigureMessage(RefPtr<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ConfigureMessage>) /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:566:20
#6 0x724f0a096a6b in mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ProcessControlMessageQueue() /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:489:11
#7 0x724f0a0962fe in mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::Configure(mozilla::dom::VideoEncoderConfig const&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:134:3
#8 0x724f085cd0af in mozilla::dom::VideoEncoder_Binding::configure(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./VideoEncoderBinding.cpp:1600:24
#9 0x724f08c6c4c7 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3290:13
#10 0x724f0c43ffe4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:532:13
#11 0x724f0c43f7c8 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:628:12
#12 0x724f0c4522f3 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:700:10
#13 0x724f0c4522f3 in js::Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3329:16
#14 0x724f0c43ec25 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:502:13
#15 0x724f0c43f69b in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:660:13
#16 0x724f0c440d48 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:727:8
#17 0x724f0c5289cb in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:119:10
#18 0x724f08987088 in mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./EventHandlerBinding.cpp:65:37
#19 0x724f09540579 in void mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget>>(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventHandlerBinding.h:82:12
#20 0x724f0953f65e in mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*) /builds/worker/checkouts/gecko/dom/events/JSEventHandler.cpp:200:12
#21 0x724f09519a57 in mozilla::EventListenerManager::HandleEventSingleListener(mozilla::EventListenerManager::Listener*, nsAtom*, mozilla::WidgetEvent*, mozilla::dom::Event*, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1346:22
#22 0x724f0951ab64 in mozilla::EventListenerManager::HandleEventWithListenerArray(mozilla::EventListenerManager::ListenerArray*, nsAtom*, mozilla::EventMessage, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1663:12
#23 0x724f0951a3d9 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1560:35
#24 0x724f0950e38f in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:365:17
#25 0x724f0950da01 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:606:16
#26 0x724f09510288 in mozilla::EventDispatcher::Dispatch(mozilla::dom::EventTarget*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1221:11
#27 0x724f095134e3 in mozilla::EventDispatcher::DispatchDOMEvent(mozilla::dom::EventTarget*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#28 0x724f094e4adb in mozilla::DOMEventTargetHelper::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/DOMEventTargetHelper.cpp:152:17
#29 0x724f09521602 in mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/events/EventTarget.cpp:214:13
#30 0x724f0ada68b1 in mozilla::dom::MessageEventRunnable::DispatchDOMEvent(JSContext*, mozilla::dom::WorkerPrivate*, mozilla::DOMEventTargetHelper*, bool) /builds/worker/checkouts/gecko/dom/workers/MessageEventRunnable.cpp:79:12
#31 0x724f0adf4bfb in mozilla::dom::WorkerThreadRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/WorkerRunnable.cpp:443:12
#32 0x724f05a0b776 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16
#33 0x724f05a1225f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#34 0x724f0addff15 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /builds/worker/checkouts/gecko/dom/workers/WorkerPrivate.cpp:3623:7
#35 0x724f0adc3ee5 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /builds/worker/checkouts/gecko/dom/workers/RuntimeService.cpp:2154:42
#36 0x724f05a0b776 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16
#37 0x724f05a1225f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#38 0x724f065a865c in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20
#39 0x724f064fa271 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#40 0x724f064fa271 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#41 0x724f05a06ca3 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1934334 using build mozilla-central 20241129053238-ed73389dc144. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[Tyson Smith [:tsmith]]

Bugmon failed due to the build format change in bug 1710599. I've re-enabled bugmon now that this has been fixed.

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20241204215713-9a8cc59e9dab.
The bug appears to have been introduced in the following build range:

Start: 8989af6649bfc887cb1a9cc9105158a806a9b39f (20231222213932)
End: e5bb9cc6a82a62a1e7296f15b1393f3de4a2ddf9 (20231222224546)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=8989af6649bfc887cb1a9cc9105158a806a9b39f&tochange=e5bb9cc6a82a62a1e7296f15b1393f3de4a2ddf9

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1749047

:padenot, since you are the author of the regressor, bug 1749047, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 5

[Paul Adenot (:padenot)]

Attachment: Bug 1934334 - Use a larger type for a video encoder framerate, clamp the frame rate to positive value. r?#media-playback-reviewers

There is no reason the frame rate can't be greater than 255.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6a5e30554cb7
Use a larger type for a video encoder framerate, clamp the frame rate to positive value. r=media-playback-reviewers,aosmond

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/6a5e30554cb7

Comment 8

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250108044202-810abd1d3a1b.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.