1859384 - Assertion failure: nalu.mNalUnitType == nalUnitType, at /builds/worker/checkouts/gecko/dom/media/platforms/agnostic/bytestreams/H265.cpp:157

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.mp4

Found while fuzzing m-c 20231016-f64b858317d1 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.mp4

Assertion failure: nalu.mNalUnitType == nalUnitType, at /builds/worker/checkouts/gecko/dom/media/platforms/agnostic/bytestreams/H265.cpp:157

35|0|xul.dll|mozilla::HVCCConfig::Parse(mozilla::MediaByteBuffer const*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/agnostic/bytestreams/H265.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|157|0x665
35|1|xul.dll|mozilla::H265::DecodeSPSFromHVCCExtraData(mozilla::MediaByteBuffer const*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/agnostic/bytestreams/H265.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|373|0x4e
35|2|xul.dll|mozilla::MP4TrackDemuxer::MP4TrackDemuxer(mozilla::MediaResource*, mozilla::UniquePtr<mozilla::TrackInfo,mozilla::DefaultDelete<mozilla::TrackInfo> >&&, mozilla::IndiceWrapper const&, unsigned int)|hg:hg.mozilla.org/mozilla-central:dom/media/mp4/MP4Demuxer.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|347|0x40b
35|3|xul.dll|mozilla::MP4Demuxer::Init()|hg:hg.mozilla.org/mozilla-central:dom/media/mp4/MP4Demuxer.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|231|0xb33
35|4|xul.dll|mozilla::detail::ProxyFunctionRunnable<`lambda at /builds/worker/checkouts/gecko/dom/media/MediaFormatReader.cpp:783:22',mozilla::MozPromise<mozilla::MediaResult,mozilla::MediaResult,0> >::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|1690|0x59
35|5|xul.dll|mozilla::TaskQueue::Runner::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskQueue.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|257|0x35f
35|6|xul.dll|nsThreadPool::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadPool.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|341|0x7dd
35|7|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|1192|0xa5d
35|8|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|480|0x44
35|9|xul.dll|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|300|0xad
35|10|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|363|0x4f
35|11|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|345|0x6e
35|12|xul.dll|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|370|0x15a
35|13|nss3.dll|_PR_NativeRunThread(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/combined/pruthr.c:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|399|0x120
35|14|nss3.dll|pr_root(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/md/windows/w95thred.c:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|139|0x10
35|15|ucrtbase.dll||||
35|16|KERNELBASE.dll||||
35|17|ucrtbase.dll||||
35|18|kernel32.dll||||
35|19|ucrtbase.dll||||
35|20|mozglue.dll|patched_BaseThreadInitThunk(int, void*, void*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:f64b858317d13b67b1a863c43863f2dbe9c3c7c9|561|0x93
35|21|ntdll.dll||||
35|22|KERNELBASE.dll||||

Comment 1

[Alastor Wu [:alwu]]

Attachment: Bug 1859384 - only append specific type of NALU into HVCC's nalu array.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d3d97163dde6
only append specific type of NALU into HVCC's nalu array. r=media-playback-reviewers,padenot

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/d3d97163dde6