This bug is for crash report bp-82284bac-607d-4d7b-be78-fc9900190801.

Top 10 frames of crashing thread:

0 libxul.so mozilla::dom::MediaStreamTrack::Graph const dom/media/MediaStreamTrack.cpp:372
1 libxul.so mozilla::dom::MediaStreamAudioSourceNode::AttachToTrack dom/media/webaudio/MediaStreamAudioSourceNode.cpp:104
2 libxul.so mozilla::dom::MediaStreamAudioSourceNode::AttachToRightTrack dom/media/webaudio/MediaStreamAudioSourceNode.cpp:165
3 libxul.so mozilla::dom::MediaStreamAudioSourceNode::Init dom/media/webaudio/MediaStreamAudioSourceNode.cpp:82
4 libxul.so mozilla::dom::MediaStreamAudioSourceNode::Create dom/media/webaudio/MediaStreamAudioSourceNode.cpp:58
5 libxul.so mozilla::dom::AudioContext::CreateMediaStreamSource dom/media/webaudio/AudioContext.cpp:424
6 libxul.so mozilla::dom::AudioContext_Binding::createMediaStreamSource dom/bindings/AudioContextBinding.cpp:687
7 libxul.so bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3181
8 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:540
9 libxul.so Interpret js/src/vm/Interpreter.cpp:595

There are 3 crashes (from 1 installation) in nightly 70 with buildid 20190731215544. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1493613.

[1] https://hg.mozilla.org/mozilla-central/rev?node=c54cb3c10992

This could happen if the track has ended (mStream get reset to nullptr), and there's a path where we could call this on an ended track if mBehavior is not FollowChanges.

That this can crash after a track has ended is new behavior in bug 1493613, so the regression is correct.

I'm adding some asserts and an extra guard for this use case.

https://hg.mozilla.org/mozilla-central/rev/09f4a86bd1e7