1203763 - ASan: heap-use-after-free [@mozilla::GMPVideoDecoder::GMPInitDone]

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: GMP, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: call_stack.txt

Comment 1

[Tyson Smith [:tsmith]]

Attachment: test_case.mp4

This test does not consistently reproduce the issue.

Comment 2

[Tyson Smith [:tsmith]]

Attachment: test_case.html

Letting this run for a minute or two will reproduce the error for me

Comment 3

[Daniel Veditz [:dveditz]]

Is this another bug where OpenH264 is doing the wrong thing?

Comment 4

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

(In reply to Tyson Smith [:tsmith] from comment #2)
> Created attachment 8660849 [details]
> test_case.html
> 
> Letting this run for a minute or two will reproduce the error for me

Do you have some funny prefs set? GMP isn't used for playback by default.

Comment 5

[Randell Jesup [:jesup] (needinfo me)]

(In reply to Daniel Veditz [:dveditz] from comment #3)
> Is this another bug where OpenH264 is doing the wrong thing?

OpenH264 isn't being used here (or shouldn't be); this is straight decode of inline video.

Comment 6

[Tyson Smith [:tsmith]]

(In reply to Anthony Jones (:kentuckyfriedtakahe, :k17e) from comment #4)
> (In reply to Tyson Smith [:tsmith] from comment #2)
> > Created attachment 8660849 [details]
> > test_case.html
> > 
> > Letting this run for a minute or two will reproduce the error for me
> 
> Do you have some funny prefs set? GMP isn't used for playback by default.

Prefs that I am setting that maybe interesting are:
media.mediasource.enabled=True
media.mediasource.mp4.enabled=True
media.fragmented-mp4.enabled=True
media.fragmented-mp4.exposed=True
media.fragmented-mp4.use-blank-decoder=True
media.fragmented-mp4.ffmpeg.enabled=True
media.fragmented-mp4.gmp.enabled=True
media.ogg.enabled=True
media.opus.enabled=True
media.wave.enabled=True

I assume it's media.fragmented-mp4.gmp.enabled that is allowing me to hit this issue. But I'm not sure if that makes this a false positive? Could this issue be triggered on other platforms? Do we ever plan to use GMP on Linux? Since I am fuzzing my intention is to find bugs.

If this is not adding value and finding useless bugs I will gladly change the pref :)

Comment 7

[Maire Reavy [:mreavy]]

Hi Chris -- This affects playback (decode only) code, not openh264.  Can you take this one since it's a sec high?

Comment 8

[Randell Jesup [:jesup] (needinfo me)]

k17e: given he's using media.fragmented-mp4.gmp.enabled=True, is this something we are going to care about anytime soon?  If we aren't planning on flipping that switch soon, we can probably reduce the severity.

tsmith: we should recheck this with OpenH264 1.5 soon

Comment 9

[Tyson Smith [:tsmith]]

This appears to be fixed, I am no longer seeing it while fuzzing.

Comment 10

[Tyson Smith [:tsmith]]

Is it possible this is related to bug 1204588?

Comment 11

[Randell Jesup [:jesup] (needinfo me)]

per comment 9

Comment 12

[Daniel Veditz [:dveditz]]

resolution FIXED sends us on a hunt for the patch that needs to be backported to ESR. The true state seems to be WORKSFORME -- may or may not be fixed, maybe it's just  lurking.

Comment 13

[Mats Palmgren (inactive)]

This signature is #6 Top Crash in v46 (beta) crash data, so I filed bug 1256065.