1587164 - undefined shift in media/webrtc/trunk/webrtc/rtc_base/timeutils.cc:142

Status: RESOLVED FIXED

(Core :: WebRTC, defect, P3)

Description

[Tyson Smith [:tsmith]]

This is triggered with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="shift"
ac_add_options --disable-jemalloc

Found via test-linux64-asan/opt-web-platform-tests-e10s-16

src/media/webrtc/trunk/webrtc/rtc_base/timeutils.cc:142:34: runtime error: left shift of negative value -1
    #0 0x7fea22a83546 in rtc::TimestampWrapAroundHandler::Unwrap(unsigned int) src/media/webrtc/trunk/webrtc/rtc_base/timeutils.cc
    #1 0x7fea22b1482d in webrtc::voe::Channel::GetAudioFrameWithInfo(int, webrtc::AudioFrame*) src/media/webrtc/trunk/webrtc/voice_engine/channel.cc:823:37
    #2 0x7fea1ac54379 in mozilla::WebrtcAudioConduit::GetAudioFrame(short*, int, int, int&) src/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp:616:22
    #3 0x7fea1acd184e in mozilla::MediaPipelineReceiveAudio::PipelineListener::NotifyPullImpl(long) src/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp:1332:17
    #4 0x7fea1e9ec1d8 in mozilla::SourceMediaTrack::PullNewData(long) src/dom/media/MediaTrackGraph.cpp:2347:8
    #5 0x7fea1e9eb168 in mozilla::MediaTrackGraphImpl::UpdateGraph(long) src/dom/media/MediaTrackGraph.cpp:1095:34
    #6 0x7fea1e9ee55b in mozilla::MediaTrackGraphImpl::OneIterationImpl(long) src/dom/media/MediaTrackGraph.cpp:1304:3
    #7 0x7fea1e772660 in mozilla::AudioCallbackDriver::DataCallback(float const*, float*, long) src/dom/media/GraphDriver.cpp:882:36
    #8 0x7fea25203cff in _$LT$audioipc_client..stream..CallbackServer$u20$as$u20$audioipc..rpc..server..Server$GT$::process::_$u7b$$u7b$closure$u7d$$u7d$::ha43956b0eea91cf4 src/media/audioipc/client/src/stream.rs:113:24
    #9 0x7fea25203cff in futures::future::lazy::Lazy$LT$F$C$R$GT$::get::h07d3c7d5fa23492d src/third_party/rust/futures/src/future/lazy.rs:64
    #10 0x7fea25203cff in _$LT$futures..future..lazy..Lazy$LT$F$C$R$GT$$u20$as$u20$futures..future..Future$GT$::poll::h04c8f2a4b37c4cc4 src/third_party/rust/futures/src/future/lazy.rs:82
    #11 0x7fea25203cff in futures::future::catch_unwind::_$LT$impl$u20$futures..future..Future$u20$for$u20$std..panic..AssertUnwindSafe$LT$F$GT$$GT$::poll::hbc95ddcc43778203 src/third_party/rust/futures/src/future/catch_unwind.rs:49
    #12 0x7fea25203cff in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::_$u7b$$u7b$closure$u7d$$u7d$::h88fae40ae17fead0 src/third_party/rust/futures/src/future/catch_unwind.rs:32
    #13 0x7fea25203cff in std::panicking::try::do_call::hb53a138c07811070 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
    #14 0x7fea25203cff in __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29
    #15 0x7fea25203cff in std::panicking::try::haf1bcccc99281b03 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:275
    #16 0x7fea25203cff in std::panic::catch_unwind::h4869e15ba6994726 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:394
    #17 0x7fea25203cff in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::ha72049ee68bd070c src/third_party/rust/futures/src/future/catch_unwind.rs:32
    #18 0x7fea25203cff in _$LT$futures_cpupool..MySender$LT$F$C$core..result..Result$LT$$LT$F$u20$as$u20$futures..future..Future$GT$..Item$C$$LT$F$u20$as$u20$futures..future..Future$GT$..Error$GT$$GT$$u20$as$u20$futures..future..Future$GT$::poll::h792cf0333f3aa894 src/third_party/rust/futures-cpupool/src/lib.rs:325
    #19 0x7fea2521eb52 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::h54ddf78dbcbbe5d7 src/third_party/rust/futures/src/future/mod.rs:113:12
    #20 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::poll_future_notify::_$u7b$$u7b$closure$u7d$$u7d$::h9087352d841f248c src/third_party/rust/futures/src/task_impl/mod.rs:289
    #21 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::enter::_$u7b$$u7b$closure$u7d$$u7d$::hfb133f03c1046753 src/third_party/rust/futures/src/task_impl/mod.rs:363
    #22 0x7fea2521eb52 in futures::task_impl::std::set::hb997ae7cc15a9b15 src/third_party/rust/futures/src/task_impl/std/mod.rs:78
    #23 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::enter::h058bb783be7fc7a3 src/third_party/rust/futures/src/task_impl/mod.rs:363
    #24 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::poll_future_notify::h74c95dca24aed8a8 src/third_party/rust/futures/src/task_impl/mod.rs:289
    #25 0x7fea2521eb52 in futures::task_impl::std::Run::run::h1a0c4680ae006636 src/third_party/rust/futures/src/task_impl/std/mod.rs:450
    #26 0x7fea2521eb52 in futures_cpupool::Inner::work::h4762dceb8410976a src/third_party/rust/futures-cpupool/src/lib.rs:257
    #27 0x7fea2521eb52 in futures_cpupool::Builder::create::_$u7b$$u7b$closure$u7d$$u7d$::hce6c1b963e8c3ab1 src/third_party/rust/futures-cpupool/src/lib.rs:427
    #28 0x7fea2521eb52 in std::sys_common::backtrace::__rust_begin_short_backtrace::hec0a26d17fbf8797 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/backtrace.rs:77
    #29 0x7fea2521d8e9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::ha5c426bceccbf1ef /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:470:16
    #30 0x7fea2521d8e9 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h46726cdf78664f0c /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:315
    #31 0x7fea2521d8e9 in std::panicking::try::do_call::h96880815832064e4 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
    #32 0x7fea2521d8e9 in __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29
    #33 0x7fea2521d8e9 in std::panicking::try::h8eed1c6e8f11155c /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:275
    #34 0x7fea2521d8e9 in std::panic::catch_unwind::hf5c1edfc475e6579 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:394
    #35 0x7fea2521d8e9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hba604fe8945ffb73 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:469
    #36 0x7fea2521d8e9 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h133f8224b7997b5a /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/ops/function.rs:231
    #37 0x7fea258e26ed in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h42806b83647d4c79 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/liballoc/boxed.rs:746:8
    #38 0x7fea258e4997 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h83c921c8e826dd1d /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/liballoc/boxed.rs:746:8
    #39 0x7fea258e4997 in std::sys_common::thread::start_thread::h2613204ce513782e /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/thread.rs:13
    #40 0x7fea258e4997 in std::sys::unix::thread::Thread::new::thread_start::h4570080769500bcd /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys/unix/thread.rs:79
    #41 0x7fea3954d6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #42 0x7fea385d641c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1

[Dan Minor [:dminor]]

Attachment: Bug 1587164 - Avoid left shift of negative value in TimestampWrapAroundHandler; r=bwc!

The code for handling backwards wraps left shifts num_wrap_ - 1. If
num_wrap_ is zero, this results in a left shift of a negative value which
is undefined behaviour. This adds a check to avoid this shift if num_wrap_
is zero.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b37d1c262965
Avoid left shift of negative value in TimestampWrapAroundHandler; r=bwc

Comment 3

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/b37d1c262965

Comment 4

[Dan Minor [:dminor]]

Upstream bug: https://bugs.chromium.org/p/webrtc/issues/detail?id=11742
Upstream review: https://webrtc-review.googlesource.com/c/src/+/178441