2014860 - Assertion failure: !mWorkletParamDescriptors.Contains(aName), at /dom/media/webaudio/AudioContext.cpp:1259

Status: VERIFIED FIXED

(Core :: Web Audio, defect)

Description

[Tyson Smith [:tsmith]]

Reproduced on mozilla-central rev ed1c0b4f0bbe (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build ed1c0b4f0bbe --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Assertion failure: !mWorkletParamDescriptors.Contains(aName), at /dom/media/webaudio/AudioContext.cpp:1259

    ==27761==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x765fbb0d287d bp 0x7ffd99a018d0 sp 0x7ffd99a01860 T27761)
    ==27761==The signal is caused by a WRITE memory access.
    ==27761==Hint: address points to the zero page.
        #0 0x765fbb0d287d in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
        #1 0x765fbb0d287d in mozilla::dom::AudioContext::SetParamMapForWorkletName(nsTSubstring<char16_t> const&, nsTArray<mozilla::dom::AudioParamDescriptor>*) /dom/media/webaudio/AudioContext.cpp:1259:3
        #2 0x765fbb107b39 in operator() /dom/media/webaudio/AudioWorkletGlobalScope.cpp:193:37
        #3 0x765fbb107b39 in mozilla::detail::RunnableFunction<mozilla::dom::AudioWorkletGlobalScope::RegisterProcessor(JSContext*, nsTSubstring<char16_t> const&, mozilla::dom::AudioWorkletProcessorConstructor&, mozilla::ErrorResult&)::$_0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:549:5
        #4 0x765fb6744497 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:705:16
        #5 0x765fb673eb64 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1325:20
        #6 0x765fb673d7e7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:1148:15
        #7 0x765fb673dc65 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:641:36
        #8 0x765fb674d776 in operator() /xpcom/threads/TaskController.cpp:333:37
        #9 0x765fb674d776 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:549:5
        #10 0x765fb675fcf3 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1168:16
        #11 0x765fb676594f in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:461:10
        #12 0x765fb7355287 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:85:21
        #13 0x765fb72ae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #14 0x765fb72ae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #15 0x765fbc465a68 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:152:27
        #16 0x765fbc531484 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:555:33
        #17 0x765fbd5794eb in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:652:20
        #18 0x765fb7356134 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #19 0x765fb72ae691 in RunHandler /ipc/chromium/src/base/message_loop.cc:366:3
        #20 0x765fb72ae691 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:348:3
        #21 0x765fbd578c4f in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:590:34
        #22 0x583e58f85f8c in main /browser/app/nsBrowserApp.cpp:465:22
        #23 0x765fc802a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #24 0x765fc802a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #25 0x583e58f59de8 in _start ??:0:0
    
    ==27761==Register values:
    rax = 0x0000000000000000  rbx = 0x0000765f3406d450  rcx = 0x00000000000004eb  rdx = 0x0000765fc8204563
    rdi = 0x0000765fc8205700  rsi = 0x0000000000000000  rbp = 0x00007ffd99a018d0  rsp = 0x00007ffd99a01860
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x000000000000002e  r13 = 0x0000765fc54da561  r14 = 0x0000765f84007648  r15 = 0x0000765f3406d460
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/user/workspace/browsers/m-c-20260205163736-fuzzing-debug/libxul.so+0x92d287d) (BuildId: 0b411186bb9521ab7e302998bc6191dc011c2d12)
    ==27761==ABORTING

Comment 1

[Tyson Smith [:tsmith]]

Attachment: Detailed Crash Information

Comment 2

[Tyson Smith [:tsmith]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260205213633-279b57ef4bf0.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: ce0f77cae5a91e2cb4b1ec859117e08aa1182c52 (20250207164009)
End: ed1c0b4f0bbef7e458685d5f4743c73ae66cc3fd (20260205163736)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False, searchfox=False, afl=False)

Comment 4

[Paul Adenot (:padenot)]

Attachment: (secure)

JavaScript code can call registerProcessor() reentrantly during property
access (e.g., when getting parameterDescriptors). This causes an assertion
failure in AudioContext::SetParamMapForWorkletName when both calls try to
register the same processor name.

The fix inserts the processor name into mNameToProcessorMap immediately after
the duplicate check, before any JavaScript code can execute. A ScopeExit guard
ensures the entry is removed if subsequent validation steps fail. This prevents
the reentrancy issue while maintaining proper cleanup on error paths.

Comment 5

[Karl Tomlinson (:karlt)]

The assertion failure does not indicate an exploitable flaw.
mNameToProcessorMap and mWorkletParamDescriptors are each used on only one thread.
Reads of mWorkletParamDescriptors do not hold a pointer across JS execution.
The read of mNameToProcessorMap holds a strong reference.

Comment 6

[Paul Adenot (:padenot)]

Agreed.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1e04dc3b6a72
https://hg.mozilla.org/integration/autoland/rev/6590b6266b78
Prevent reentrancy in AudioWorkletGlobalScope::RegisterProcessor. r=karlt,media-playback-reviewers

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/6590b6266b78

Comment 9

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260215214423-7edce67f9460.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.