Tyson Smith [:tsmith] Reporter
	Description • 6 years ago

The fuzzers haven been seeing this release assertion for a while now (for months about 2x a day) but I can never find a reliable testcase. The best I have is a ~500KB file that repros ~1 in 100 attempts.

Report from mozilla-central 20180815-8546719c58dc

Assertion failure: IsVideoSeeking() || mSeekPromise.IsEmpty() (No sample requests allowed while seeking), at src/dom/media/MediaFormatReader.cpp:1961

#0 0x7fbfc6af5357 in AnnotateMozCrashReason src/obj-firefox/dist/include/mozilla/Assertions.h:40:19
#1 0x7fbfc6af5357 in mozilla::MediaFormatReader::RequestAudioData() src/dom/media/MediaFormatReader.cpp:1964
#2 0x7fbfc6cde7be in operator() src/dom/media/ReaderProxy.cpp:103:40
#3 0x7fbfc6cde7be in InvokeMethod<(lambda at src/dom/media/ReaderProxy.cpp:103:12), RefPtr<mozilla::MozPromise<RefPtr<mozilla::AudioData>, mozilla::MediaResult, true> > ((lambda at src/dom/media/ReaderProxy.cpp:103:12)::*)() const, mozilla::media::TimeUnit> src/obj-firefox/dist/include/mozilla/MozPromise.h:538
#4 0x7fbfc6cde7be in InvokeCallbackMethod<true, (lambda at src/dom/media/ReaderProxy.cpp:103:12), RefPtr<mozilla::MozPromise<RefPtr<mozilla::AudioData>, mozilla::MediaResult, true> > ((lambda at src/dom/media/ReaderProxy.cpp:103:12)::*)() const, mozilla::media::TimeUnit, RefPtr<mozilla::MozPromise<RefPtr<mozilla::AudioData>, mozilla::MediaResult, true>::Private> > src/obj-firefox/dist/include/mozilla/MozPromise.h:553
#5 0x7fbfc6cde7be in mozilla::MozPromise<mozilla::media::TimeUnit, mozilla::SeekRejectValue, true>::ThenValue<mozilla::ReaderProxy::OnAudioDataRequestFailed(mozilla::MediaResult const&)::$_0, mozilla::ReaderProxy::OnAudioDataRequestFailed(mozilla::MediaResult const&)::$_1>::DoResolveOrRejectInternal(mozilla::MozPromise<mozilla::media::TimeUnit, mozilla::SeekRejectValue, true>::ResolveOrRejectValue&) src/obj-firefox/dist/include/mozilla/MozPromise.h:774
#6 0x7fbfc6a7b53c in mozilla::MozPromise<mozilla::media::TimeUnit, mozilla::SeekRejectValue, true>::ThenValueBase::ResolveOrRejectRunnable::Run() src/obj-firefox/dist/include/mozilla/MozPromise.h:411:21
#7 0x7fbfbea47db1 in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() src/obj-firefox/dist/include/mozilla/TaskDispatcher.h:214:37
#8 0x7fbfbea52530 in mozilla::TaskQueue::Runner::Run() src/xpcom/threads/TaskQueue.cpp:235:12
#9 0x7fbfbea86352 in nsThreadPool::Run() src/xpcom/threads/nsThreadPool.cpp:231:14
#10 0x7fbfbea86ff4 in non-virtual thunk to nsThreadPool::Run() src/xpcom/threads/nsThreadPool.cpp
#11 0x7fbfbea78bc0 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1235:14
#12 0x7fbfbea81925 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:519:10
#13 0x7fbfbfc5c8df in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:334:20
#14 0x7fbfbfb5d29c in RunInternal src/ipc/chromium/src/base/message_loop.cc:325:10
#15 0x7fbfbfb5d29c in RunHandler src/ipc/chromium/src/base/message_loop.cc:318
#16 0x7fbfbfb5d29c in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:298
#17 0x7fbfbea70869 in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:467:11
#18 0x7fbfe1f7bf08 in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
#19 0x7fbfe55756b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#20 0x7fbfe45fe41c in clone /build/glibc-Cl5G7W/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

	Jason Kratzer [:jkratzer]
	Comment 1 • 6 years ago

The attached testcase is not fully reduced and a bit tricky to reproduce.  For best results, the testcase must be served via a local webserver.

Steps to reproduce:
1. Start local webserver in testcase directory
  python -m SimpleHTTPServer &
2. Use ffpuppet to trigger via:
  python -m ffpuppet -p prefs.js --xvfb -d -l log ~/builds/firefox -u http://localhost:8000/testcase.html

Testcase may take a minute or two to trigger.

*FFPuppet can be found at the following URL:
https://github.com/MozillaSecurity/ffpuppet