1937456 - MOZ_RELEASE_ASSERT(idx < storage_.size()) Firefox crashes in `RingBuffer::Read()` on NixOS with Discord

Status: UNCONFIRMED

(Core :: Audio/Video: MediaStreamGraph, defect)

Description

[Cool Guy]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0

Steps to reproduce:

1. Open Discord in Firefox
2. Click "User settings" iron on left-bottom side.
3. Click "Voice & Video" on the left menu, and it should get access to your 3. microphone and display the volume at real time in "Input sensitivity". It's working well yet.
4. Under "MIC TEST" and click "Let's check"

Actual results:

The tab crashed

Expected results:

The mic test audio should have played back

This issue has been mentioned here:
https://github.com/zen-browser/desktop/issues/1800
https://github.com/zen-browser/desktop/issues/394
https://github.com/NixOS/nixpkgs/issues/332540
https://www.reddit.com/r/firefox/comments/1hd6dwr/discord_voice_call_crashes_my_tab/

Issue occurs for me on Librewolf 133.0-1 and vanilla Firefox.
This issue did not occur to me on Firefox 131 (Librewolf fork) on Nixos, using the non binary variant. Based on the above mentioned posts, this also affects Jitsi

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video: Playback' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Andre Klapper]

Please follow the steps on https://support.mozilla.org/kb/troubleshoot-firefox-crashes-closing-or-quitting and provide your Report ID here. Thanks!

Comment 3

[Cool Guy]

c882f1b9-7d17-4138-babc-5c7010241219

Comment 4

[Cool Guy]

Same issue is described and solved in https://bugzilla.mozilla.org/show_bug.cgi?id=1938634 now

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimm, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Jim Mathies [:jimm]]

(In reply to Cool Guy from comment #3)

c882f1b9-7d17-4138-babc-5c7010241219

https://crash-stats.mozilla.org/report/index/c882f1b9-7d17-4138-babc-5c7010241219

Karl, this is crashing in build/firefox-133.0/dom/media/driftcontrol.. might be related to drift controller changes you've made?

Comment 7

[Karl Tomlinson (:karlt)]

The arguments to the problem CopySpan() call have the same lengths, which have passed verification against storage sizes.
The length is stored in a uint32_t stack variable. On amd64, this cannot be dynamic_extent which is std::numeric_limits<size_t>::max().
So I don't see how an iterator index could be out of range.

Comment 8

[Karl Tomlinson (:karlt)]

All similar crashes involving RingBuffer are on NixOS, so this does seem the same as bug 1938634.

Comment 11

[Karl Tomlinson (:karlt)]

Bug 1938634 identified an upgrade of the rust compiler from 1.77.2 to 1.78 as triggering the crash, and adding full to --enable-lto=cross as a workaround. The crash is not in rust code.

Attachment 9445727 [details] identifies different system packages affecting whether the crash occurs or not. They do not include rust but do include gcc library changes:

-gcc-13.3.0-lib
-gcc-13.3.0-libgcc
+gcc-14-20241116-lib
+gcc-14-20241116-libgcc