1860840 - Assertion failure: HVCCConfig::Parse(aSample).isOk(), at /builds/worker/checkouts/gecko/dom/media/platforms/agnostic/bytestreams/AnnexB.cpp:482

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.mp4

Found while fuzzing m-c 20231024-bcdbc81d4adf (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.mp4

Assertion failure: HVCCConfig::Parse(aSample).isOk(), at /builds/worker/checkouts/gecko/dom/media/platforms/agnostic/bytestreams/AnnexB.cpp:482

39|0|xul.dll|mozilla::AnnexB::ConvertSampleToHVCC(mozilla::MediaRawData*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/agnostic/bytestreams/AnnexB.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|481|0x313
39|1|xul.dll|mozilla::HEVCChangeMonitor::CheckForChange(mozilla::MediaRawData*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/wrappers/MediaChangeMonitor.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|192|0x39
39|2|xul.dll|mozilla::MediaChangeMonitor::CreateDecoderAndInit(mozilla::MediaRawData*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/wrappers/MediaChangeMonitor.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|854|0x7a
39|3|xul.dll|mozilla::MediaChangeMonitor::CheckForChange(mozilla::MediaRawData*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/wrappers/MediaChangeMonitor.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|966|0xc5
39|4|xul.dll|mozilla::MediaChangeMonitor::Decode(mozilla::MediaRawData*)|hg:hg.mozilla.org/mozilla-central:dom/media/platforms/wrappers/MediaChangeMonitor.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|677|0x7c
39|5|xul.dll|mozilla::detail::ProxyFunctionRunnable<`lambda at /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaDataDecoderProxy.cpp:30:46',mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >,mozilla::MediaResult,1> >::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/MozPromise.h:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|1690|0x62
39|6|xul.dll|mozilla::TaskQueue::Runner::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskQueue.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|257|0x35f
39|7|xul.dll|nsThreadPool::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadPool.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|341|0x7dd
39|8|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|1192|0xa5d
39|9|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|480|0x44
39|10|xul.dll|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|300|0xad
39|11|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|363|0x4f
39|12|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|345|0x6e
39|13|xul.dll|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|370|0x15a
39|14|nss3.dll|_PR_NativeRunThread(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/combined/pruthr.c:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|399|0x120
39|15|nss3.dll|pr_root(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/md/windows/w95thred.c:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|139|0x10
39|16|ucrtbase.dll||||
39|17|KERNELBASE.dll||||
39|18|ucrtbase.dll||||
39|19|ucrtbase.dll||||
39|20|mozglue.dll|patched_BaseThreadInitThunk(int, void*, void*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:bcdbc81d4adffb0c3b1e04e1854e43cf49314d92|561|0x93
39|21|ntdll.dll||||
39|22|KERNELBASE.dll||||

Comment 1

[Alastor Wu [:alwu]]

Attachment: Bug 1860840 - return error for invalid hvcc config when converting sample.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fd44d547e093
return error for invalid hvcc config when converting sample. r=media-playback-reviewers,padenot

Comment 3

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/fd44d547e093