1181734 - Stagefright: crash [@stagefright::MPEG4Extractor::parseTrackHeader]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P1)

Comment 1

[Tyson Smith [:tsmith]]

Attachment: log.txt

==54253==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f488ef5ef5b sp 0x7f4832ebe060 bp 0x7f4832ebe1b0 T118)
    #0 0x7f488ef5ef5a in operator-> /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/system/core/include/utils/StrongPointer.h:88
    #1 0x7f488ef5ef5a in stagefright::MPEG4Extractor::parseTrackHeader(long, long) /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:2174
    #2 0x7f488ef55fee in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1084
    #3 0x7f488ef5b85e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880
    #4 0x7f488ef5b85e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880
    #5 0x7f488ef5440e in stagefright::MPEG4Extractor::readMetaData() /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:484
    #6 0x7f488ef54234 in stagefright::MPEG4Extractor::getMetaData() /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:419
    #7 0x7f488ef389e9 in mp4_demuxer::MP4Metadata::MP4Metadata(mp4_demuxer::Stream*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/media/libstagefright/binding/MP4Metadata.cpp:99
    #8 0x7f4893ae935d in MakeUnique<mp4_demuxer::MP4Metadata, nsRefPtr<mp4_demuxer::BufferStream> &> /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/mozilla/UniquePtr.h:642
    #9 0x7f4893ae935d in mozilla::MP4Demuxer::Init() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/media/fmp4/MP4Demuxer.cpp:52
    #10 0x7f48936f6a91 in mozilla::MediaFormatReader::AsyncReadMetadata() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/media/MediaFormatReader.cpp:289
    #11 0x7f489376be70 in mozilla::detail::MethodCallWithNoArgs<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true>, mozilla::MediaDecoderReader>::Invoke() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/media/MediaPromise.h:875
    #12 0x7f489376b9b6 in mozilla::detail::ProxyRunnable<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true> >::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/media/MediaPromise.h:919
    #13 0x7f489366d5ea in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/media/TaskDispatcher.h:181
    #14 0x7f48937efaa9 in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/dom/media/MediaTaskQueue.cpp:256
    #15 0x7f488f111c31 in nsThreadPool::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:221
    #16 0x7f488f111fec in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:235
    #17 0x7f488f10be17 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/threads/nsThread.cpp:848
    #18 0x7f488f179b1a in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:265
    #19 0x7f488f9d17cf in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/glue/MessagePump.cpp:326
    #20 0x7f488f95e49c in RunInternal /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234
    #21 0x7f488f95e49c in RunHandler /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227
    #22 0x7f488f95e49c in MessageLoop::Run() /builds/slave/m-cen-l64-asan-000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201
    #23 0x7f488f10872c in nsThread::ThreadFunc(void*) /builds/slave/m-cen-l64-asan-000000000000000/build/src/xpcom/threads/nsThread.cpp:360
    #24 0x7f489d6cd135 in _pt_root /builds/slave/m-cen-l64-asan-000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212
    #25 0x7f48a0bf4181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312
    #26 0x7f489fcf547c in clone /build/buildd/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Comment 2

[Chris Peterson [:cpeterson]]

Gerald, here's another Stagefright bug.

Comment 3

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

Looks like a null pointer issue. There's been quite a bit of work around this, and some more upcoming very soon, e.g. bug 1216845.

Tyson, could you please test this again? (Or you may wait until after bug 1216845 lands.)
If it's still happening, please attach the naughty file.

Comment 4

[Tyson Smith [:tsmith]]

(In reply to Gerald Squelart [:gerald] from comment #3)
> Looks like a null pointer issue. There's been quite a bit of work around
> this, and some more upcoming very soon, e.g. bug 1216845.
> 
> Tyson, could you please test this again? (Or you may wait until after bug
> 1216845 lands.)
> If it's still happening, please attach the naughty file.

I have not see this one for at least a month now, maybe longer. I will close it fixed. Any idea which bug may have fixed it?

Comment 5

[Gerald Squelart (he/him) (not at Mozilla since 2022-09-15)]

(In reply to Tyson Smith [:tsmith] from comment #4)
> (In reply to Gerald Squelart [:gerald] from comment #3)
> > Looks like a null pointer issue. There's been quite a bit of work around
> > this, and some more upcoming very soon, e.g. bug 1216845.
> > 
> > Tyson, could you please test this again? (Or you may wait until after bug
> > 1216845 lands.)
> > If it's still happening, please attach the naughty file.
> 
> I have not see this one for at least a month now, maybe longer. I will close
> it fixed. Any idea which bug may have fixed it?

Thank you Tyson.
I believe bug 1187067 (null-check mLastTrack) did the trick.