2016883 - Assertion failure: self->mProcessingMessage, at /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:671

Status: RESOLVED FIXED

(Core :: Audio/Video: Web Codecs, defect)

Description

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Found while fuzzing m-c 20260212-06d48ece4edf (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: self->mProcessingMessage, at /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:671

#0 0x7fffeab87d3f in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x7fffeab87d3f in mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::Reconfigure(RefPtr<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ConfigureMessage>)::'lambda'(mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue const&)::operator()(mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue const&) const /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:671:13
#2 0x7fffeab8794b in InvokeMethod<(lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:667:11), void ((lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:667:11)::*)(const mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue &) const, mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:669:14
#3 0x7fffeab8794b in InvokeCallbackMethod<false, mozilla::MozPromise<bool, mozilla::MediaResult, true>, (lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:667:11), void ((lambda at /builds/worker/checkouts/gecko/dom/media/webcodecs/EncoderTemplate.cpp:667:11)::*)(const mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue &) const, mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:683:7
#4 0x7fffeab8794b in mozilla::MozPromise<bool, mozilla::MediaResult, true>::ThenValue<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::Reconfigure(RefPtr<mozilla::dom::EncoderTemplate<mozilla::dom::VideoEncoderTraits>::ConfigureMessage>)::'lambda'(mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue const&)>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, mozilla::MediaResult, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:940:11
#5 0x7fffea314125 in mozilla::MozPromise<bool, mozilla::MediaResult, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:505:21
#6 0x7fffe61443a7 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:721:16
#7 0x7fffe613ea74 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1342:20
#8 0x7fffe613d6f7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:1165:15
#9 0x7fffe613db75 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:657:36
#10 0x7fffe614d686 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:349:37
#11 0x7fffe614d686 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:549:5
#12 0x7fffe615fc03 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1168:16
#13 0x7fffe616585f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:461:10
#14 0x7fffe6d55d07 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#15 0x7fffe6caea61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#16 0x7fffe6caea61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#17 0x7fffebe4eaf8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:152:27
#18 0x7fffebf1a2e4 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:555:33
#19 0x7fffecf640db in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:652:20
#20 0x7fffe6d56bb4 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#21 0x7fffe6caea61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#22 0x7fffe6caea61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#23 0x7fffecf6383f in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:590:34
#24 0x5555555d9f7c in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:465:22

Comment 1

[Tyson Smith [:tsmith] (PTO -> Sept/8)]

Attachment: testcase.html

Comment 2

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 2016883 using build mozilla-central 20260212213836-06d48ece4edf. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Paul Adenot (:padenot)]

Attachment: Bug 2016883 - Add crashtest for reset() racing with in-flight reconfigure. r?chunmin

The crash sequence:

1. configure(320x240) creates the encoder
2. configure(640x480) queues a reconfigure
3. flush() queues a flush
4. configure(320x240) queues another reconfigure
5. The 640x480 reconfigure completes, flush drains, queue unblocks, and
   the 320x240 reconfigure starts (mAgent->Reconfigure(), untracked in the
   original code)
6. flush().then() fires, enc.reset() clears mProcessingMessage and destroys
   mAgent, but can't disconnect the untracked reconfigure callback
7. The reconfigure callback fires, finds mProcessingMessage == null -> crash

Fixed by Bug 2016493 which adds ->Track(mReconfigureRequest) and disconnects
it in CancelPendingControlMessagesAndFlushPromises().

The fuzzer's test case had a typo (videoEncoder.reset() instead of enc.reset()),
which is why bugmon couldn't reproduce it.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/bce0fb0bdd95
https://hg.mozilla.org/integration/autoland/rev/796c2a86ddc1
Add crashtest for reset() racing with in-flight reconfigure. r=chunmin

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4d9692a48c06
https://hg.mozilla.org/integration/autoland/rev/b84534a0e942
Remove crashtests 2016504, 2016883 and 2016493 on Android

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/796c2a86ddc1
https://hg.mozilla.org/mozilla-central/rev/b84534a0e942