Analysis

The crash report is Fenix 160.0a1 Nightly on Android, on the MediaSupervisor thread. In the last 6 months, crash-stats shows 12 crashes with this signature. Ten are on Fenix 159 and 160 Nightly. Two are on desktop Firefox 153 beta and 157 release.

The cause looks like a race between a stale video seek and a new audio-only seek in MediaFormatReader:

MediaFormatReader.cpp: ResetDecode(aTracks) rejects mSeekPromise and clears mPendingSeekTime for all tracks. It calls ResetDemuxer() only for the tracks in aTracks.
ResetDemuxer() disconnects mSeekRequest (MediaFormatReader.h). Thus ResetDecode(audio) leaves a running video demuxer seek alive.
A following Seek(AudioOnly) replaces mOriginalSeekTarget and starts an audio seek through DoAudioSeek.
When the old video seek resolves, OnVideoSeekCompleted sees a target that is not video-only (MediaFormatReader.cpp). It calls DoAudioSeek again, and the assert fails (MediaFormatReader.cpp).

The likely trigger is the seamless looping code in MediaDecoderStateMachine. LoopingDecodingState::Exit disconnects its seek requests but does not reset the reader (MediaDecoderStateMachine.cpp). A buffering transition or a change of loop can then create a new looping state. That state calls ResetDecode(audio) and Seek(AudioOnly) in RequestDataFromStartPosition (MediaDecoderStateMachine.cpp) while the old video seek still runs. The crash stack does not show which state change occurred.

Clouseau says that mPendingSeekTime was set because the next line did not fault. That is not correct: the assert stops execution before the next line runs.

The regressor is not known. The code is from bug 1816852 and older bugs. The recent changes in bug 2078225 and bug 2076235 do not touch this seek state. Bug 1891129 is a fuzzer report of the same assert, closed as WONTFIX.

Fix direction

In ResetDecode, also disconnect the mSeekRequest of the tracks that it does not reset. Or cancel the demuxer seek of the other track in Seek() or AttemptSeek.
In OnVideoSeekCompleted, ignore a video seek result when the current target is AudioOnly.
As a second step, LoopingDecodingState::Exit can call ResetDecode for each track whose seek request it disconnects.
A gtest in TestMediaFormatReader.cpp can trigger the race every time. Start a video-only seek, call ResetDecode(audio) and Seek(AudioOnly), then resolve the video seek.

No duplicate or media meta bug matches this crash.

Bugs handled per day

Issue types

Close / Reassign: where the bugs went

Severity the bot set

Triage rotation