Assertion failure: !Ended(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:376
Categories
(Core :: Audio/Video: Recording, defect, P2)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr60 | --- | unaffected |
firefox-esr68 | --- | unaffected |
firefox68 | --- | unaffected |
firefox69 | --- | unaffected |
firefox70 | --- | fixed |
People
(Reporter: jkratzer, Assigned: pehrsons)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, testcase)
Attachments
(4 files)
Testcase found while fuzzing mozilla-central rev 58400ee2747a.
Assertion failure: !Ended(), at /builds/worker/workspace/build/src/dom/media/MediaStreamTrack.cpp:376
rax = 0x000055de0edd71a0 rdx = 0x0000000000000000
rcx = 0x00007f11d1b2036f rbx = 0x00007f11c2e1b7a0
rsi = 0x00007f11dd3fe8b0 rdi = 0x00007f11dd3fd680
rbp = 0x00007fffbc8d17c0 rsp = 0x00007fffbc8d17c0
r8 = 0x00007f11dd3fe8b0 r9 = 0x00007f11de568780
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x0000000000000003 r13 = 0x00007fffbc8d17f0
r14 = 0x00007f11c34e5e30 r15 = 0x00007f11c2e67f18
rip = 0x00007f11cdb47d38
OS|Linux|0.0.0 Linux 4.18.0-25-generic #26~18.04.1-Ubuntu SMP Thu Jun 27 07:28:31 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::MediaStreamTrack::Graph() const|hg:hg.mozilla.org/mozilla-central:dom/media/MediaStreamTrack.cpp:58400ee2747af785469bbecf414d0d739591615c|376|0x2b
0|1|libxul.so|mozilla::dom::MediaRecorder::Session::MediaStreamReady()|hg:hg.mozilla.org/mozilla-central:dom/media/MediaRecorder.cpp:58400ee2747af785469bbecf414d0d739591615c|694|0x23
0|2|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::dom::MediaRecorder::Session*, void (mozilla::dom::MediaRecorder::Session::*)(), true, (mozilla::RunnableKind)0>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:58400ee2747af785469bbecf414d0d739591615c|1176|0x13
0|3|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:58400ee2747af785469bbecf414d0d739591615c|1225|0x15
0|4|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:58400ee2747af785469bbecf414d0d739591615c|486|0x11
0|5|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:58400ee2747af785469bbecf414d0d739591615c|88|0xa
0|6|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|315|0x17
0|7|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|290|0x8
0|8|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:58400ee2747af785469bbecf414d0d739591615c|137|0xd
0|9|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:58400ee2747af785469bbecf414d0d739591615c|934|0x11
0|10|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:58400ee2747af785469bbecf414d0d739591615c|238|0x5
0|11|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|315|0x17
0|12|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:58400ee2747af785469bbecf414d0d739591615c|290|0x8
0|13|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:58400ee2747af785469bbecf414d0d739591615c|769|0xc
0|14|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:58400ee2747af785469bbecf414d0d739591615c|56|0x14
0|15|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:58400ee2747af785469bbecf414d0d739591615c|267|0x12
0|16|libc-2.27.so||||0x21b97
0|17|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:58400ee2747af785469bbecf414d0d739591615c|184|0x5
Comment 1•5 years ago
|
||
Andreas, would you mind taking a first triage pass on this?
Assignee | ||
Updated•5 years ago
|
Assignee | ||
Comment 2•5 years ago
|
||
This is almost trivial to fix, with a heavily timing-dependent testcase, and the patches in bug 1514158 to bring MediaRecorder to spec will permanently close this hole. I'll not bother with landing a crashtest for this, but push a fix since bug 1514158 won't land until 71.
Updated•5 years ago
|
Assignee | ||
Comment 3•5 years ago
|
||
Jason, FYI, to properly repro this (would be nice to manually verify the fix) we're lacking tmp-46407S3FMpBhIBRAO.webm as referenced by the test.
Assignee | ||
Comment 4•5 years ago
|
||
Reporter | ||
Comment 5•5 years ago
|
||
My apologies. Here's the missing media file referenced by the testcase.
Assignee | ||
Comment 6•5 years ago
|
||
I still failed to reproduce and just noticed it references a different file too; tmp-46407JSGGIASh6HY3.mp4. Sorry for not catching this earlier. Jason, is this file also required to reproduce?
Reporter | ||
Comment 8•5 years ago
|
||
My apologies - here's the other required media file.
Assignee | ||
Comment 9•5 years ago
|
||
Thanks! I can reproduce now, and the pushed fix does indeed fix this.
Comment 10•5 years ago
|
||
bugherder |
Description
•