Closed Bug 1380468 Opened 2 years ago Closed 2 years ago

mp4 file triggers OOM

Categories

(Core :: Audio/Video: Playback, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla56
Tracking Status
firefox56 --- fixed

People

(Reporter: tsmith, Assigned: ayang)

References

Details

(Keywords: csectype-oom, testcase)

Attachments

(3 files)

Attached video test_case.mp4
==121631==ERROR: AddressSanitizer failed to allocate 0x300002000 (12884910080) bytes of LargeMmapAllocator (error code: 12)
==121631==AddressSanitizer CHECK failed: /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:120 "((0 && "unable to mmap")) != (0)" (0x0, 0x0)
    #0 0x4c580f in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_rtl.cc:67:3
    #1 0x4d8322 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_termination.cc:79:5
    #2 0x4ca08e in __sanitizer::ReportMmapFailureAndDie(unsigned long, char const*, char const*, int, bool) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:120:3
    #3 0x4d264b in __sanitizer::MmapOrDie(unsigned long, char const*, bool) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc:132:5
    #4 0x4218f4 in __sanitizer::LargeMmapAllocator<__asan::AsanMapUnmapCallback>::Allocate(__sanitizer::AllocatorStats*, unsigned long, unsigned long) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1057:9
    #5 0x4217b8 in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap<17ul, 128ul, 16ul>, __asan::AsanMapUnmapCallback>, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap<17ul, 128ul, 16ul>, __asan::AsanMapUnmapCallback> >, __sanitizer::LargeMmapAllocator<__asan::AsanMapUnmapCallback> >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap<17ul, 128ul, 16ul>, __asan::AsanMapUnmapCallback> >*, unsigned long, unsigned long, bool, bool) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_allocator.h:1326:24
    #6 0x41e932 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_allocator.cc:368:21
    #7 0x41f10d in __asan::Allocator::Reallocate(void*, unsigned long, __sanitizer::BufferedStackTrace*) /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_allocator.cc:549:21
    #8 0x4bbe82 in realloc /builds/slave/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:85:10
    #9 0x7f20d640a319 in alloc_system::imp::reallocate /checkout/src/liballoc_system/lib.rs:143
    #10 0x7f20d640a319 in alloc_system::__rust_reallocate /checkout/src/liballoc_system/lib.rs:63
    #11 0x7f20d640a319 in alloc::heap::reallocate /checkout/src/liballoc/heap.rs:93
    #12 0x7f20d640a319 in _$LT$alloc..raw_vec..RawVec$LT$T$GT$$GT$::double::hd770ab531a4200ab /checkout/src/liballoc/raw_vec.rs:232
    #13 0x7f20d640903e in collections::vec::{{impl}}::push<mp4parse_capi::mp4parse_indice> /checkout/src/libcollections/vec.rs:969
    #14 0x7f20d640903e in mp4parse_capi::create_sample_table src/media/libstagefright/binding/mp4parse_capi/src/lib.rs:905
    #15 0x7f20d640903e in mp4parse_get_indice_table src/media/libstagefright/binding/mp4parse_capi/src/lib.rs:706
    #16 0x7f20c9babeaf in mp4_demuxer::MP4MetadataRust::ReadTrackIndice(mp4parse_byte_data*, int) src/media/libstagefright/binding/MP4Metadata.cpp:1011:8
    #17 0x7f20c9ba990f in mp4_demuxer::MP4Metadata::GetTrackIndice(int) src/media/libstagefright/binding/MP4Metadata.cpp:434:33
    #18 0x7f20cf6213c5 in mozilla::MP4Demuxer::Init() src/dom/media/fmp4/MP4Demuxer.cpp:247:18
    #19 0x7f20cefd48e4 in operator() src/dom/media/MediaFormatReader.cpp:1030:47
    #20 0x7f20cefd48e4 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaFormatReader::DemuxerProxy::Init()::$_10, mozilla::MozPromise<mozilla::MediaResult, mozilla::MediaResult, true> >::Run() src/obj-firefox/dist/include/mozilla/MozPromise.h:1510
    #21 0x7f20c9df27e4 in mozilla::TaskQueue::Runner::Run() src/xpcom/threads/TaskQueue.cpp:246:12
    #22 0x7f20c9e243c8 in nsThreadPool::Run() src/xpcom/threads/nsThreadPool.cpp:225:14
    #23 0x7f20c9e24b0c in non-virtual thunk to nsThreadPool::Run() src/xpcom/threads/nsThreadPool.cpp:154:15
    #24 0x7f20c9e1a875 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1437:14
    #25 0x7f20c9e20aa8 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:489:10
    #26 0x7f20cac341e0 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:339:20
    #27 0x7f20cab8f0e0 in RunInternal src/ipc/chromium/src/base/message_loop.cc:320:10
    #28 0x7f20cab8f0e0 in RunHandler src/ipc/chromium/src/base/message_loop.cc:313
    #29 0x7f20cab8f0e0 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:293
    #30 0x7f20c9e124dd in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:506:11
    #31 0x7f20e48d3423 in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:216:5
    #32 0x7f20e7ecb6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #33 0x7f20e6f543dc in clone /build/glibc-bfm8X4/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Allocation from the Rust MP4 parser. Alfredo, could you please have a look, when possible? (Or reassign)
Flags: needinfo?(ayang)
Sure, I'll check it.
Assignee: nobody → ayang
Flags: needinfo?(ayang)
Comment on attachment 8886453 [details]
Bug 1380468 - update rust parser.

https://reviewboard.mozilla.org/r/157236/#review162362
Attachment #8886453 - Flags: review?(kinetik) → review+
Comment on attachment 8886452 [details]
Bug 1380468 - don't fallback when table size is too large.

https://reviewboard.mozilla.org/r/157234/#review162364
Attachment #8886452 - Flags: review?(kinetik) → review+
Thanks for quick review!
Pushed by ayang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d6286a7f8094
don't fallback when table size is too large. r=kinetik
https://hg.mozilla.org/integration/autoland/rev/294935222edd
update rust parser. r=kinetik
https://hg.mozilla.org/mozilla-central/rev/d6286a7f8094
https://hg.mozilla.org/mozilla-central/rev/294935222edd
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
Alfredo, it looks like this fix has automated coverage. Would manual testing be relevant here?
Flags: qe-verify?
Flags: needinfo?(ayang)
(In reply to Andrei Vaida [:avaida], Desktop Release QA – please ni? me from comment #13)
> Alfredo, it looks like this fix has automated coverage. Would manual testing
> be relevant here?

The autotest is on rust only. It'd be good if QA can help to test it manually, that helps to cover gecko part.
Flags: needinfo?(ayang)
hmm... it'd be better to add the test file into gecko mochitest.
Flags: needinfo?(ayang)
See Also: → 1404182
You need to log in before you can comment on or make changes to this bug.