Closed Bug 1923777 Opened 8 months ago Closed 7 months ago

AssertedCast error: Cannot cast 18446744073709551613 from uint64_t to int32_t: out of range

Categories

(Core :: Audio/Video: Playback, defect)

Unspecified
Windows
defect

Tracking

()

RESOLVED FIXED
134 Branch
Tracking Status
firefox-esr115 --- unaffected
firefox-esr128 --- wontfix
firefox131 --- wontfix
firefox132 --- wontfix
firefox133 --- wontfix
firefox134 --- verified

People

(Reporter: tsmith, Assigned: padenot)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Attached video testcase.mp4

Found while fuzzing m-c 20240820-287e498f8f8c (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

AssertedCast error: Cannot cast 18446744073709551613 from uint64_t to int32_t: out of range

37|0|xul.dll|mozilla::MediaFormatReader::GetDebugInfo(mozilla::dom::MediaFormatReaderDebugInfo&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaFormatReader.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|3390|0x13e9
37|1|xul.dll|mozilla::MediaFormatReader::RequestDebugInfo(mozilla::dom::MediaFormatReaderDebugInfo&)|hg:hg.mozilla.org/mozilla-central:dom/media/MediaFormatReader.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|3312|0x3c
37|2|xul.dll|mozilla::detail::ProxyFunctionRunnable<`lambda at /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:3308:24',mozilla::MozPromise<bool,nsresult,1> >::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|1816|0x44
37|3|xul.dll|mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskDispatcher.h:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|230|0x2bd
37|4|xul.dll|mozilla::TaskQueue::Runner::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskQueue.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|257|0x373
37|5|xul.dll|nsThreadPool::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadPool.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|456|0x95b
37|6|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|1149|0x968
37|7|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|480|0x6c
37|8|xul.dll|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|299|0xad
37|9|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|362|0x4c
37|10|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|344|0x6e
37|11|xul.dll|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|366|0x15a
37|12|nss3.dll|_PR_NativeRunThread(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/combined/pruthr.c:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|382|0x120
37|13|nss3.dll|pr_root(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/md/windows/w95thred.c:8f29f058e4bd8dae6b62919c609ddbfc46cb6692|129|0x10
Flags: in-testsuite?
Assignee: nobody → padenot
Keywords: pernosco-wanted

The severity field is not set for this bug.
:jimm, could you have a look please?

For more information, please visit BugBot documentation.

Flags: needinfo?(jmathies)

Verified bug as reproducible on mozilla-central 20241024094434-7936ca01a900.
The bug appears to have been introduced in the following build range:

Start: b1212fb9438edc5930a3e8228dd52ff3c068031c (20240402165117)
End: bfdc9733f80bab4558cf720975c00e2658b9b8c0 (20240402231401)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b1212fb9438edc5930a3e8228dd52ff3c068031c&tochange=bfdc9733f80bab4558cf720975c00e2658b9b8c0

Pernosco is only supported for Linux x86_64 bugs.

Whiteboard: [bugmon:bisected,confirmed]

Simple one in your patch I think.

Flags: needinfo?(jmathies) → needinfo?(alwu)

Setting Bug 1888265 as the regressor based on the pushlog from comment 2. Please correct if needed.

We should represent those values in real even if the value might be
garbage, no need to perform casting.

Set release status flags based on info from the regressing bug 1888265

Pushed by alwu@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b0fe08adeda4 make webidl members' type indentical with the acutal types r=webidl,media-playback-reviewers,saschanaz,aosmond
Flags: needinfo?(alwu)
Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → FIXED
Target Milestone: --- → 134 Branch

Bug appears to be fixed on mozilla-central 20241031045112-b584d7d6324f but BugMon was unable to find a usable build for 287e498f8f8c.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

The patch landed in nightly and beta is affected.
:padenot, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox133 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(padenot)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: