Assertion failure: (detail::IsInBounds<From, To>(aFrom)), at /builds/worker/workspace/obj-build/dist/include/mozilla/Casting.h:183
Categories
(Core :: Audio/Video: Playback, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr102 | --- | unaffected |
firefox113 | --- | unaffected |
firefox114 | --- | unaffected |
firefox115 | --- | fixed |
People
(Reporter: tsmith, Unassigned)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])
Attachments
(1 file)
(deleted),
video/mp4
|
Details |
Found while fuzzing m-c 20230518-016166a0aefa (--enable-debug --enable-fuzzing)
To reproduce via Grizzly Replay:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.mp4
Assertion failure: (detail::IsInBounds<From, To>(aFrom)), at /builds/worker/workspace/obj-build/dist/include/mozilla/Casting.h:183
#0 0x7f1ce34ef5dd in unsigned long mozilla::AssertedCast<unsigned long, double>(double) /builds/worker/workspace/obj-build/dist/include/mozilla/Casting.h:183:3
#1 0x7f1ce34ee85d in mozilla::MP4AudioInfo::Update(Mp4parseTrackInfo const*, Mp4parseTrackAudioInfo const*, mozilla::IndiceWrapper const*) /builds/worker/checkouts/gecko/dom/media/mp4/DecoderData.cpp:213:27
#2 0x7f1ce34f5156 in mozilla::MP4Metadata::GetTrackInfo(mozilla::TrackInfo::TrackType, unsigned long) const /builds/worker/checkouts/gecko/dom/media/mp4/MP4Metadata.cpp:381:18
#3 0x7f1ce34f27fe in mozilla::MP4Demuxer::Init() /builds/worker/checkouts/gecko/dom/media/mp4/MP4Demuxer.cpp:165:20
#4 0x7f1ce2cbd261 in operator() /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:784:47
#5 0x7f1ce2cbd261 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaFormatReader::DemuxerProxy::Init()::$_2, mozilla::MozPromise<mozilla::MediaResult, mozilla::MediaResult, false>>::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1696:29
#6 0x7f1cdeef23ec in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
#7 0x7f1cdef0f0c5 in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:343:14
#8 0x7f1cdef05f2a in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16
#9 0x7f1cdef0c3fd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:479:10
#10 0x7f1cdfb5059e in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#11 0x7f1cdfa70d21 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#12 0x7f1cdfa70d21 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#13 0x7f1cdef01346 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#14 0x7f1cf3311a0f in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#15 0x7f1cf3094b42 in start_thread nptl/pthread_create.c:442:8
#16 0x7f1cf31269ff misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
Comment 1•1 year ago
|
||
Verified bug as reproducible on mozilla-central 20230518213154-3a125a6b7c3a.
The bug appears to have been introduced in the following build range:
Start: b73c33aa86e6f1f38549530aecd999c7827d380e (20230517144015)
End: 488a1a8b33a0c427f85d10224a2f8db913e22b16 (20230517175836)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b73c33aa86e6f1f38549530aecd999c7827d380e&tochange=488a1a8b33a0c427f85d10224a2f8db913e22b16
Comment 2•1 year ago
|
||
Set release status flags based on info from the regressing bug 1817997
:padenot, since you are the author of the regressor, bug 1817997, could you take a look? Also, could you set the severity field?
For more information, please visit BugBot documentation.
Comment 3•1 year ago
|
||
Setting firefox115 to Fixed, the regressor Bug 1817997 was backed out of central.
Comment 4•1 year ago
|
||
Testcase crashes using the initial build (mozilla-central 20230518092544-016166a0aefa) but not with tip (mozilla-central 20230519115028-225c5ab0d999.)
The bug appears to have been fixed in the following build range:
Start: d976369464663a9147b82c82436afcaab1f61aec (20230519041011)
End: 225c5ab0d999e743db5298d125893ae0702884af (20230519115028)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=d976369464663a9147b82c82436afcaab1f61aec&tochange=225c5ab0d999e743db5298d125893ae0702884af
tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Updated•1 year ago
|
Reporter | ||
Updated•1 year ago
|
Description
•