Testcase found while fuzzing mozilla-central rev 19e273db8019 (built with --enable-debug).

Assertion failure: ms.mLiveTracks.Length() == length - 1, at /builds/worker/checkouts/gecko/dom/html/HTMLMediaElement.cpp:3538

rax = 0x00007f26c97405ff   rdx = 0x0000000000000000
rcx = 0x000055d45ac76a48   rbx = 0x0000000000000000
rsi = 0x00007f26da6ad8b0   rdi = 0x00007f26da6ac680
rbp = 0x00007ffeefdd8300   rsp = 0x00007ffeefdd8040
r8 = 0x00007f26da6ad8b0    r9 = 0x00007f26db813780
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x000055d45c277280   r13 = 0x0000000000000000
r14 = 0x000055d45c410150   r15 = 0x0000000000000000
rip = 0x00007f26c397ccf5
OS|Linux|0.0.0 Linux 5.3.0-46-generic #38~18.04.1-Ubuntu SMP Tue Mar 31 04:17:56 UTC 2020 x86_64
CPU|amd64|family 6 model 94 stepping 3|8
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::dom::HTMLMediaElement::UpdateOutputTrackSources()|hg:hg.mozilla.org/mozilla-central:dom/html/HTMLMediaElement.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|3538|0x0
0|1|libxul.so|mozilla::detail::RunnableFunction<mozilla::WatchManager<mozilla::dom::HTMLMediaElement>::PerCallbackWatcher::Notify()::{lambda()#1}>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:19e273db80195cc5de59647fcaf16bafad9bbcce|557|0x43
0|2|libxul.so|mozilla::AutoTaskDispatcher::DrainDirectTasks()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskDispatcher.h:19e273db80195cc5de59647fcaf16bafad9bbcce|99|0x11
0|3|libxul.so|mozilla::XPCOMThreadWrapper::MaybeFireTailDispatcher()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/AbstractThread.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|115|0x11
0|4|libxul.so|non-virtual thunk to mozilla::XPCOMThreadWrapper::AfterProcessNextEvent(nsIThreadInternal*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/AbstractThread.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|0|0xd
0|5|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|1216|0x42
0|6|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|481|0xc
0|7|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|87|0x7
0|8|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:19e273db80195cc5de59647fcaf16bafad9bbcce|315|0x17
0|9|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:19e273db80195cc5de59647fcaf16bafad9bbcce|290|0x8
0|10|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|137|0xd
0|11|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|909|0xe
0|12|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|237|0x5
0|13|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:19e273db80195cc5de59647fcaf16bafad9bbcce|315|0x17
0|14|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:19e273db80195cc5de59647fcaf16bafad9bbcce|290|0x8
0|15|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|740|0x5
0|16|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|56|0x11
0|17|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:19e273db80195cc5de59647fcaf16bafad9bbcce|303|0x20
0|18|libc.so.6||||0x21b97
0|19|firefox-bin|<name omitted>|hg:hg.mozilla.org/mozilla-central:mfbt/UniquePtr.h:19e273db80195cc5de59647fcaf16bafad9bbcce|253|0x17

Because this bug's Severity is normal and has not been changed, and this bug's priority is -- (none,) indicating it has has not been previously triaged, the bug's Severity is being updated to -- (default, untriaged.)

Paul, you reviewed bug 1592289, care to take a look?

I can reproduce, I asked Paul offline and I will take a look at it.

The problem here is that the stream is captured from the element and it is driven to the srcObject attribute of the same media element. Our code does not expect that and it crashes as a side effect. Unfortunately, the spec does not mention anything about that case. I will open an issue in the spec. In the meantime I will create a patch that will not allow setting the captured stream to the capture from element.

Feeding a media element with the captured stream from the same media element does not make sense. Currently the spec does not mention anything about it. I'll clarify the case in the spec. In the meantime, when a cycle is detected, the setting of the srcObject is ignored and a warning is produced in the console.

https://hg.mozilla.org/mozilla-central/rev/01f96c18970f