Closed Bug 1184877 Opened 11 years ago Closed 10 years ago

Stagefright: crash [@stagefright::SampleTable::setSampleSizeParams]

Categories

(Core :: Audio/Video: Playback, defect)

Product:
Core
Component:
Audio/Video: Playback
Platform:
x86_64
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla43

People

(Reporter: posidron, Unassigned)

References

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

Testcase
45.83 KB, application/octet-stream
Details
The following testcase crashes on mozilla-inbound-linux64-asan revision c66c5db7e21a See attachment. Backtrace: ==8814==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040 (pc 0x7f429f6fdbe9 sp 0x7f4278e4ab60 bp 0x7f4278e4ac10 T45) #0 0x7f429f6fdbe8 in stagefright::SampleTable::setSampleSizeParams(unsigned int, long, unsigned long) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp:281 #1 0x7f429f6d8f1a in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:1453 #2 0x7f429f6d8a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #3 0x7f429f6d8a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #4 0x7f429f6d8a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #5 0x7f429f6d8a7e in stagefright::MPEG4Extractor::parseChunk(long*, int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:880 #6 0x7f429f6d162e in stagefright::MPEG4Extractor::readMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:484 #7 0x7f429f6d1454 in stagefright::MPEG4Extractor::getMetaData() /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/MPEG4Extractor.cpp:419 #8 0x7f429f6b5c09 in mp4_demuxer::MP4Metadata::MP4Metadata(mp4_demuxer::Stream*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/binding/MP4Metadata.cpp:99 #9 0x7f42a424e01d in MakeUnique<mp4_demuxer::MP4Metadata, nsRefPtr<mp4_demuxer::BufferStream> &> /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/mozilla/UniquePtr.h:642 #10 0x7f42a424e01d in mozilla::MP4Demuxer::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/fmp4/MP4Demuxer.cpp:93 #11 0x7f42a3e3a3e1 in mozilla::MediaFormatReader::AsyncReadMetadata() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaFormatReader.cpp:288 #12 0x7f42a3eb7230 in mozilla::detail::MethodCallWithNoArgs<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true>, mozilla::MediaDecoderReader>::Invoke() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:878 #13 0x7f42a3eb6d76 in mozilla::detail::ProxyRunnable<mozilla::MediaPromise<nsRefPtr<mozilla::MetadataHolder>, mozilla::ReadMetadataFailureReason, true> >::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaPromise.h:938 #14 0x7f42a3db378a in mozilla::AutoTaskDispatcher::TaskGroupRunnable::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:181 #15 0x7f42a3f3c105 in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:256 #16 0x7f429f88f021 in nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:228 #17 0x7f429f88f3dc in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:242 #18 0x7f429f888f27 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:867 #19 0x7f429f8f7bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #20 0x7f42a015ca6f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:326 #21 0x7f42a00e8f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #22 0x7f42a00e8f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #23 0x7f42a00e8f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #24 0x7f429f885345 in nsThread::ThreadFunc(void*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:360 #25 0x7f42ac675135 in _pt_root /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212 #26 0x7f42accb3181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /builds/slave/m-in-l64-asan-0000000000000000/build/src/media/libstagefright/frameworks/av/media/libstagefright/SampleTable.cpp:281 stagefright::SampleTable::setSampleSizeParams(unsigned int, long, unsigned long) Thread T45 (MediaPl~back #5) created by T41 (MediaPl~back #1) here: #0 0x461855 in pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:175 #1 0x7f42ac671abd in _PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f42ac67163a in PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f429f88693d in nsThread::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:470 #4 0x7f429f88c93e in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadManager.cpp:249 #5 0x7f429f88e00e in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>&&) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:109 #6 0x7f429f88f8e7 in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>&&, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:276 #7 0x7f42a3f3c4a0 in operator nsIEventTarget * /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsIEventTarget.h:37 #8 0x7f42a3f3c4a0 in operator-> /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/SharedThreadPool.h:51 #9 0x7f42a3f3c4a0 in mozilla::MediaTaskQueue::Runner::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:282 #10 0x7f429f88f021 in nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:228 #11 0x7f429f88f3dc in non-virtual thunk to nsThreadPool::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/xpcom/threads/Unified_cpp_xpcom_threads0.cpp:242 #12 0x7f429f888f27 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:867 #13 0x7f429f8f7bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #14 0x7f42a015ca6f in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:326 #15 0x7f42a00e8f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #16 0x7f42a00e8f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #17 0x7f42a00e8f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #18 0x7f429f885345 in nsThread::ThreadFunc(void*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:360 #19 0x7f42ac675135 in _pt_root /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:212 #20 0x7f42accb3181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181) Thread T41 (MediaPl~back #1) created by T0 (Web Content) here: #0 0x461855 in pthread_create /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:175 #1 0x7f42ac671abd in _PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:453 #2 0x7f42ac67163a in PR_CreateThread /builds/slave/m-in-l64-asan-0000000000000000/build/src/nsprpub/pr/src/pthreads/ptthread.c:544 #3 0x7f429f88693d in nsThread::Init() /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:470 #4 0x7f429f88c93e in nsThreadManager::NewThread(unsigned int, unsigned int, nsIThread**) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadManager.cpp:249 #5 0x7f429f88e00e in nsThreadPool::PutEvent(already_AddRefed<nsIRunnable>&&) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:109 #6 0x7f429f88f8e7 in nsThreadPool::Dispatch(already_AddRefed<nsIRunnable>&&, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThreadPool.cpp:276 #7 0x7f42a3f3a869 in operator nsIEventTarget * /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsIEventTarget.h:37 #8 0x7f42a3f3a869 in operator-> /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/SharedThreadPool.h:51 #9 0x7f42a3f3a869 in mozilla::MediaTaskQueue::DispatchLocked(already_AddRefed<nsIRunnable>, mozilla::MediaTaskQueue::DispatchMode, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/MediaTaskQueue.cpp:65 #10 0x7f42a3f0d35c in mozilla::MediaTaskQueue::Dispatch(already_AddRefed<nsIRunnable>, mozilla::AbstractThread::DispatchFailureHandling, mozilla::AbstractThread::DispatchReason) /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/fmp4/../../../dist/include/MediaTaskQueue.h:45 #11 0x7f42a3db30fc in mozilla::AutoTaskDispatcher::DispatchTaskGroup(mozilla::UniquePtr<mozilla::AutoTaskDispatcher::PerThreadTaskGroup, mozilla::DefaultDelete<mozilla::AutoTaskDispatcher::PerThreadTaskGroup> >) /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:233 #12 0x7f42a3db1da2 in mozilla::AutoTaskDispatcher::~AutoTaskDispatcher() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/TaskDispatcher.h:88 #13 0x7f42a3db0ef1 in reset /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/mozilla/Maybe.h:373 #14 0x7f42a3db0ef1 in mozilla::XPCOMThreadWrapper::FireTailDispatcher() /builds/slave/m-in-l64-asan-0000000000000000/build/src/dom/media/AbstractThread.cpp:76 #15 0x7f42a3db1090 in apply<mozilla::XPCOMThreadWrapper, void (mozilla::XPCOMThreadWrapper::*)()> /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsThreadUtils.h:621 #16 0x7f42a3db1090 in nsRunnableMethodImpl<void (mozilla::XPCOMThreadWrapper::*)(), true>::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/dom/media/../../dist/include/nsThreadUtils.h:828 #17 0x7f42a4e06985 in assign_assuming_AddRef /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/widget/../dist/include/nsCOMPtr.h:336 #18 0x7f42a4e06985 in forget /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/widget/../dist/include/nsCOMPtr.h:574 #19 0x7f42a4e06985 in Forget /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.h:110 #20 0x7f42a4e06985 in nsBaseAppShell::RunSyncSectionsInternal(bool, unsigned int) /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.cpp:381 #21 0x7f42a4e0752d in RunSyncSections /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.h:95 #22 0x7f42a4e0752d in AfterProcessNextEvent /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.cpp:435 #23 0x7f42a4e0752d in non-virtual thunk to nsBaseAppShell::AfterProcessNextEvent(nsIThreadInternal*, unsigned int, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/obj-firefox/widget/Unified_cpp_widget1.cpp:437 #24 0x7f429f8893f0 in nsThread::ProcessNextEvent(bool, bool*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/threads/nsThread.cpp:881 #25 0x7f429f8f7bca in NS_ProcessNextEvent(nsIThread*, bool) /builds/slave/m-in-l64-asan-0000000000000000/build/src/xpcom/glue/nsThreadUtils.cpp:277 #26 0x7f42a015baf9 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/glue/MessagePump.cpp:95 #27 0x7f42a00e8f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #28 0x7f42a00e8f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #29 0x7f42a00e8f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #30 0x7f42a4e05137 in nsBaseAppShell::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/widget/nsBaseAppShell.cpp:165 #31 0x7f42a6c6c6a2 in XRE_RunAppShell /builds/slave/m-in-l64-asan-0000000000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:785 #32 0x7f42a00e8f6c in RunInternal /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:234 #33 0x7f42a00e8f6c in RunHandler /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:227 #34 0x7f42a00e8f6c in MessageLoop::Run() /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/chromium/src/base/message_loop.cc:201 #35 0x7f42a6c6bd99 in XRE_InitChildProcess /builds/slave/m-in-l64-asan-0000000000000000/build/src/toolkit/xre/nsEmbedFunctions.cpp:621 #36 0x48d672 in content_process_main(int, char**) /builds/slave/m-in-l64-asan-0000000000000000/build/src/ipc/app/../contentproc/plugin-container.cpp:236 #37 0x7f429d2f9ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
Attached file Testcase —
Blocks: fuzzing-stagefright
This was fixed by bug 1187067 (and/or other recent libstagefright fixes). The following try-run uses the test case file from this bug in the libstagefright unit tests: https://treeherder.mozilla.org/#/jobs?repo=try&revision=427f65be7b10
Status: NEW → RESOLVED
Closed: 10 years ago
Component: Audio/Video → Audio/Video: Playback
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: