Bug 1814790 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
Found while fuzzing m-c 20230201-b7f075124503 (--enable-debug --enable-fuzzing)

The test case is not 100% reliable it will likely require multiple reloads (press F5). Seems to reproduce about 3/100 attempts.

Requires pref `image.avif.sequence.enabled=true`

firefox-bin: /builds/worker/checkouts/gecko/third_party/dav1d/src/refmvs.c:182: union mv mv_projection(const union mv, const int, const int): Assertion `den > 0 && den < 32' failed.
```
#0 0x7fb24156400b in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
#1 0x7fb241543858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7
#2 0x7fb241543728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3
#3 0x7fb241554fd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3
#4 0x7fb233bd4a72 in mv_projection /builds/worker/checkouts/gecko/third_party/dav1d/src/refmvs.c:182:5
#5 0x7fb233bd4a72 in dav1d_refmvs_load_tmvs /builds/worker/checkouts/gecko/third_party/dav1d/src/refmvs.c:729:35
#6 0x7fb233b93908 in dav1d_decode_tile_sbrow /builds/worker/checkouts/gecko/third_party/dav1d/src/decode.c:2832:9
#7 0x7fb233bd8447 in dav1d_worker_task /builds/worker/checkouts/gecko/third_party/dav1d/src/thread_task.c:761:33
#8 0x7fb241a95608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#9 0x7fb241640132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```
Revision 1 by
on 
Found while fuzzing m-c 20230201-b7f075124503 (--enable-debug --enable-fuzzing)

The test case is not 100% reliable it will likely require multiple reloads (press F5). Seems to reproduce about 3/100 attempts.

~~Requires pref `image.avif.sequence.enabled=true`~~

firefox-bin: /builds/worker/checkouts/gecko/third_party/dav1d/src/refmvs.c:182: union mv mv_projection(const union mv, const int, const int): Assertion `den > 0 && den < 32' failed.
```
#0 0x7fb24156400b in raise /build/glibc-SzIz7B/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
#1 0x7fb241543858 in abort /build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79:7
#2 0x7fb241543728 in __assert_fail_base /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:92:3
#3 0x7fb241554fd5 in __assert_fail /build/glibc-SzIz7B/glibc-2.31/assert/assert.c:101:3
#4 0x7fb233bd4a72 in mv_projection /builds/worker/checkouts/gecko/third_party/dav1d/src/refmvs.c:182:5
#5 0x7fb233bd4a72 in dav1d_refmvs_load_tmvs /builds/worker/checkouts/gecko/third_party/dav1d/src/refmvs.c:729:35
#6 0x7fb233b93908 in dav1d_decode_tile_sbrow /builds/worker/checkouts/gecko/third_party/dav1d/src/decode.c:2832:9
#7 0x7fb233bd8447 in dav1d_worker_task /builds/worker/checkouts/gecko/third_party/dav1d/src/thread_task.c:761:33
#8 0x7fb241a95608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#9 0x7fb241640132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

Back to Bug 1814790 Comment 0