Closed Bug 1890432 Opened 1 year ago Closed 1 year ago

Assertion failure: info.HasVideo(), at /builds/worker/checkouts/gecko/dom/media/utils/TelemetryProbesReporter.cpp:300

Categories

(Core :: Audio/Video: Playback, defect)

defect

Tracking

()

VERIFIED FIXED
126 Branch
Tracking Status
firefox-esr115 --- unaffected
firefox124 --- unaffected
firefox125 --- unaffected
firefox126 --- verified

People

(Reporter: tsmith, Assigned: alwu)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Attached file testcase.html

Found while fuzzing m-c 20240403-c720e2e99bf3 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid> --repeat 10 --relaunch 1

Assertion failure: info.HasVideo(), at /builds/worker/checkouts/gecko/dom/media/utils/TelemetryProbesReporter.cpp:300

#0 0x715d013ec74a in mozilla::TelemetryProbesReporter::OntFirstFrameLoaded(double, double, double, double, mozilla::EnumSet<mozilla::TelemetryProbesReporter::FirstFrameLoadedFlag, unsigned char>) /builds/worker/checkouts/gecko/dom/media/utils/TelemetryProbesReporter.cpp:300:3
#1 0x715d00d7db1f in operator() /builds/worker/checkouts/gecko/dom/media/MediaDecoder.cpp:929:37
#2 0x715d00d7db1f in InvokeMethod<(lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoder.cpp:899:9), void ((lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoder.cpp:899:9)::*)(mozilla::MozPromise<bool, nsresult, true>::ResolveOrRejectValue &&), mozilla::MozPromise<bool, nsresult, true>::ResolveOrRejectValue> /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:651:12
#3 0x715d00d7db1f in InvokeCallbackMethod<false, (lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoder.cpp:899:9), void ((lambda at /builds/worker/checkouts/gecko/dom/media/MediaDecoder.cpp:899:9)::*)(mozilla::MozPromise<bool, nsresult, true>::ResolveOrRejectValue &&), mozilla::MozPromise<bool, nsresult, true>::ResolveOrRejectValue, RefPtr<mozilla::MozPromise<bool, nsresult, true>::Private> > /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:682:5
#4 0x715d00d7db1f in mozilla::MozPromise<bool, nsresult, true>::ThenValue<mozilla::MediaDecoder::FirstFrameLoaded(mozilla::UniquePtr<mozilla::MediaInfo, mozilla::DefaultDelete<mozilla::MediaInfo>>, mozilla::MediaDecoderEventVisibility)::$_0>::DoResolveOrRejectInternal(mozilla::MozPromise<bool, nsresult, true>::ResolveOrRejectValue&) /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:921:7
#5 0x715cfd238dd3 in mozilla::MozPromise<bool, nsresult, true>::ThenValueBase::ResolveOrRejectRunnable::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:487:21
#6 0x715cfcf27577 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:578:16
#7 0x715cfcf1cbe6 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:905:26
#8 0x715cfcf1b3c7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:728:15
#9 0x715cfcf1b845 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:514:36
#10 0x715cfcf2b516 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:232:37
#11 0x715cfcf2b516 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#12 0x715cfcf40842 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#13 0x715cfcf4798d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#14 0x715cfdc2d9d5 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#15 0x715cfdb43931 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#16 0x715cfdb43931 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#17 0x715d025ec1a8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#18 0x715d026afdc8 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#19 0x715d044eb6cb in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:712:20
#20 0x715cfdc2e8b6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#21 0x715cfdb43931 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#22 0x715cfdb43931 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#23 0x715d044eaef2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:647:34
#24 0x58229e5965c6 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#25 0x58229e5965c6 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#26 0x715d11c29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#27 0x715d11c29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#28 0x58229e56c2f8 in _start (/home/user/workspace/browsers/m-c-20240408161942-fuzzing-debug/firefox-bin+0x592f8) (BuildId: 6799584445c3ec522825d0e835225e91811d1218)
Assignee: nobody → alwu

Verified bug as reproducible on mozilla-central 20240408215259-79551503d77c.
The bug appears to have been introduced in the following build range:

Start: af163918fc004caebd579a94d5c88120181b6789 (20240402211108)
End: bfdc9733f80bab4558cf720975c00e2658b9b8c0 (20240402231401)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=af163918fc004caebd579a94d5c88120181b6789&tochange=bfdc9733f80bab4558cf720975c00e2658b9b8c0

Keywords: regression
Whiteboard: [bugmon:bisected,confirmed]

As now OntFirstFrameLoaded() would be triggered asynchrously, at the
time it's called, the owner (HTMLMediaElement) might already clear its
media info, so we should pass the media info directly when calling the
method.

Regressed by: 1888265

Set release status flags based on info from the regressing bug 1888265

Attachment #9395673 - Attachment description: Bug 1890432 - pass MediaInfo to 'OntFirstFrameLoaded()'. → Bug 1890432 - pass MediaInfo to 'OnFirstFrameLoaded()'.
Pushed by alwu@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/37be2036653f pass MediaInfo to 'OnFirstFrameLoaded()'. r=media-playback-reviewers,padenot
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 126 Branch

Verified bug as fixed on rev mozilla-central 20240410094541-e21f6f5c4e95.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: