1982612 - Assertion failure: self->mState != CodecState::Closed, at /dom/media/webcodecs/EncoderTemplate.cpp:833

Status: NEW

(Core :: Audio/Video: Web Codecs, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 7d880ff29269 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 7d880ff29269 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: self->mState != CodecState::Closed, at /dom/media/webcodecs/EncoderTemplate.cpp:833

    ==2255770==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x78e58cd794be bp 0x78e51ecfd640 sp 0x78e51ecfd640 T2255812)
    ==2255770==The signal is caused by a WRITE memory access.
    ==2255770==Hint: address points to the zero page.
        #0 0x78e58cd794be in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
        #1 0x78e58cd794be in operator() /dom/media/webcodecs/EncoderTemplate.cpp:833:24
        #2 0x78e58cd794be in mozilla::detail::RunnableFunction<mozilla::dom::EncoderTemplate<mozilla::dom::AudioEncoderTraits>::Configure(RefPtr<mozilla::dom::EncoderTemplate<mozilla::dom::AudioEncoderTraits>::ConfigureMessage>)::'lambda'(mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue const&)::operator()(mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue const&)::'lambda'()>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:548:5
        #3 0x78e5885f5e1a in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1153:16
        #4 0x78e5885fc37f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #5 0x78e58dac1254 in mozilla::dom::WorkerPrivate::DoRunLoop(JSContext*) /dom/workers/WorkerPrivate.cpp:3954:7
        #6 0x78e58daa40c0 in mozilla::dom::workerinternals::(anonymous namespace)::WorkerThreadPrimaryRunnable::Run() /dom/workers/RuntimeService.cpp:2265:42
        #7 0x78e5885f5e1a in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1153:16
        #8 0x78e5885fc37f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #9 0x78e5891b8258 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #10 0x78e5891116b1 in RunHandler /ipc/chromium/src/base/message_loop.cc:367:3
        #11 0x78e5891116b1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:349:3
        #12 0x78e5885f178e in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:366:10
        #13 0x78e599248a1f in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #14 0x78e5992edaa3 in start_thread nptl/pthread_create.c:447:8
        #15 0x78e59937ac3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
    
    ==2255770==Register values:
    rax = 0x0000000000000000  rbx = 0x00005dfb217e2ff0  rcx = 0x0000000000000341  rdx = 0x000078e599455563  
    rdi = 0x000078e599456700  rsi = 0x0000000000000000  rbp = 0x000078e51ecfd640  rsp = 0x000078e51ecfd640  
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000000  r11 = 0x0000000000000293  
    r12 = 0x0001719b97d71b53  r13 = 0x00005dfb217e30f8  r14 = 0x0000000000000000  r15 = 0x0000000000000001  
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence
    ==2255770==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250812094605-68d37f9acbd4.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 6a2726e60f57ab0a4179b75d229a1c483d207179 (20240813093307)
End: 7d880ff29269122bc521b3f69a643a3b7158a8eb (20250812035342)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 3

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:padenot, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Karl Tomlinson (:karlt)]

I wonder whether pernosco didn't respond to the trace upload. Trying again.

Comment 6

[Jason Kratzer [:jkratzer]]

:karlt, it could have gotta stuck in the pernosco processing pipeline. If you ever see this again, feel free to NI me and I'll track it down.

Comment 7

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 8

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 9

[Karl Tomlinson (:karlt)]

Chun-min, this may be of interest to you. IIUC Paul was saying that you might be redoing this code.

Comment 10

[Paul Adenot (:padenot)]

I was mistaken, it's not exactly in the same location, but bug 1978232 is adjacent.

Comment 11

[C.M.Chang[:chunmin]]

The assertion failure is here on Linux. It doesn't looks like it's related to bug 1978232 since the code there doesn't and won't touch anything about configure and it's mainly for Windows.

The configuration error is probably from the FFmpeg encoder (since gmp encoder is disabled by default). I'll check this. Maybe we have the same issues on decoder side as well.

Comment 12

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20250812035342-7d880ff29269) but not with tip (mozilla-central 20260221090124-501ded2d35df.)

The bug appears to have been fixed in the following build range:

Start: 4440f2feb2cc270b424e3eddf063c05b92a5e52a (20260216213417)
End: 3ace307f44a058fd8f0836bf7c9252062f861acd (20260216222848)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=4440f2feb2cc270b424e3eddf063c05b92a5e52a&tochange=3ace307f44a058fd8f0836bf7c9252062f861acd

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 13

[Jason Kratzer [:jkratzer]]

This seems to be a bogus bisection range. I'll leave it disabled for now.