Closed Bug 1410565 Opened 3 years ago Closed 3 years ago

FPE in [@ mp4_demuxer::Moof::ParseTrun]

Categories

(Core :: Audio/Video: Playback, defect, P3, critical)

defect

Tracking

()

RESOLVED FIXED
mozilla58
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- unaffected
firefox57 --- unaffected
firefox58 --- fixed

People

(Reporter: tsmith, Assigned: ayang)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase)

Attachments

(3 files)

Attached video test_case.mp4
#0 mozalloc_abort(char const*) /src/memory/mozalloc/mozalloc_abort.cpp:33:5
#1 Abort(char const*) /src/xpcom/base/nsDebugImpl.cpp:461:3
#2 NS_DebugBreak /src/xpcom/base/nsDebugImpl.cpp:417:7
#3 fpehandler(int, siginfo*, void*) /src/toolkit/xre/nsSigHandlers.cpp:155:5
#4 0x7f70641e538f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)
#5 ToMicroseconds /src/media/libstagefright/binding/include/mp4_demuxer/MoofParser.h:39:41
#6 mp4_demuxer::Moof::ParseTrun(mp4_demuxer::Box&, mp4_demuxer::Tfhd&, mp4_demuxer::Mvhd&, mp4_demuxer::Mdhd&, mp4_demuxer::Edts&, unsigned long*, bool) /src/media/libstagefright/binding/MoofParser.cpp:684
#7 mp4_demuxer::Moof::ParseTraf(mp4_demuxer::Box&, mp4_demuxer::Trex&, mp4_demuxer::Mvhd&, mp4_demuxer::Mdhd&, mp4_demuxer::Edts&, mp4_demuxer::Sinf&, unsigned long*, bool) /src/media/libstagefright/binding/MoofParser.cpp:593:11
#8 mp4_demuxer::Moof::Moof(mp4_demuxer::Box&, mp4_demuxer::Trex&, mp4_demuxer::Mvhd&, mp4_demuxer::Mdhd&, mp4_demuxer::Edts&, mp4_demuxer::Sinf&, unsigned long*, bool) /src/media/libstagefright/binding/MoofParser.cpp:404:7
#9 mp4_demuxer::MoofParser::RebuildFragmentedIndex(mp4_demuxer::BoxContext&) /src/media/libstagefright/binding/MoofParser.cpp:65:12
#10 RebuildFragmentedIndex /src/media/libstagefright/binding/MoofParser.cpp:35:10
#11 mp4_demuxer::MoofParser::RebuildFragmentedIndex(mozilla::media::IntervalSet<long> const&, bool*) /src/media/libstagefright/binding/MoofParser.cpp:51
#12 mp4_demuxer::Index::UpdateMoofIndex(mozilla::media::IntervalSet<long> const&, bool) /src/media/libstagefright/binding/Index.cpp:433:16
#13 mozilla::MP4TrackDemuxer::EnsureUpToDateIndex() /src/dom/media/fmp4/MP4Demuxer.cpp:400:11
#14 mozilla::MP4TrackDemuxer::MP4TrackDemuxer(mozilla::MP4Demuxer*, mozilla::UniquePtr<mozilla::TrackInfo, mozilla::DefaultDelete<mozilla::TrackInfo> >&&, mp4_demuxer::IndiceWrapper const&) /src/dom/media/fmp4/MP4Demuxer.cpp:358:3
#15 mozilla::MP4Demuxer::Init() /src/dom/media/fmp4/MP4Demuxer.cpp:221:13
#16 operator() /src/dom/media/MediaFormatReader.cpp:1115:47
#17 mozilla::detail::ProxyFunctionRunnable<mozilla::MediaFormatReader::DemuxerProxy::Init()::$_10, mozilla::MozPromise<mozilla::MediaResult, mozilla::MediaResult, true> >::Run() /src/obj-firefox/dist/include/mozilla/MozPromise.h:1511
#18 mozilla::TaskQueue::Runner::Run() /src/xpcom/threads/TaskQueue.cpp:246:12
#19 nsThreadPool::Run() /src/xpcom/threads/nsThreadPool.cpp:228:14
#20 non-virtual thunk to nsThreadPool::Run() /src/xpcom/threads/nsThreadPool.cpp:156:15
#21 nsThread::ProcessNextEvent(bool, bool*) /src/xpcom/threads/nsThread.cpp:1037:14
#22 NS_ProcessNextEvent(nsIThread*, bool) /src/xpcom/threads/nsThreadUtils.cpp:513:10
#23 mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /src/ipc/glue/MessagePump.cpp:334:20
#24 RunInternal /src/ipc/chromium/src/base/message_loop.cc:326:10
#25 RunHandler /src/ipc/chromium/src/base/message_loop.cc:319
#26 MessageLoop::Run() /src/ipc/chromium/src/base/message_loop.cc:299
#27 nsThread::ThreadFunc(void*) /src/xpcom/threads/nsThread.cpp:425:11
#28 _pt_root /src/nsprpub/pr/src/pthreads/ptthread.c:216:5
#29 start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#30 clone /build/glibc-bfm8X4/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Flags: in-testsuite?
Flags: needinfo?(ayang)
INFO: Last good revision: aecaa85bb1d9d8b7d2cbd9ab84eb6dbc0ed9eee8
INFO: First bad revision: 4e892b27c2f112e61a74d1bd75cc1d73ff91e2b2
INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=aecaa85bb1d9d8b7d2cbd9ab84eb6dbc0ed9eee8&tochange=4e892b27c2f112e61a74d1bd75cc1d73ff91e2b2
Blocks: 1387798
Has Regression Range: --- → yes
Assignee: nobody → ayang
Comment on attachment 8921363 [details]
Bug 1410565 - check mTimescale to avoid dividing by zero.

https://reviewboard.mozilla.org/r/192396/#review197802
Attachment #8921363 - Flags: review?(kinetik) → review+
Comment on attachment 8921364 [details]
Bug 1410565 - add gtest for mTimescale checking.

https://reviewboard.mozilla.org/r/192398/#review197804
Attachment #8921364 - Flags: review?(kinetik) → review+
Pushed by ayang@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a0282427c61c
check mTimescale to avoid dividing by zero. r=kinetik
https://hg.mozilla.org/integration/autoland/rev/a8df0a966ce6
add gtest for mTimescale checking. r=kinetik
You need to log in before you can comment on or make changes to this bug.