2046425 - Crash in [@ mozilla::FFmpegDescToVA]

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect, P2)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/7a1f0195-9828-4c14-9cd5-265150260610

Reason:

SIGSEGV / SEGV_MAPERR

Top 10 frames:

0  libxul.so  mozilla::FFmpegDescToVA(AVDRMFrameDescriptor&, AVFrame*)  dom/media/platforms/ffmpeg/FFmpegVideoFramePool.cpp:428
0  libxul.so  mozilla::VideoFramePool<46465650>::GetVideoFrameSurface(AVDRMFrameDescriptor&...  dom/media/platforms/ffmpeg/FFmpegVideoFramePool.cpp:599
1  libxul.so  mozilla::FFmpegVideoDecoder<62>::CreateImageV4L2(long, long, long, nsTArray<R...  dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp:2437
2  libxul.so  mozilla::FFmpegVideoDecoder<62>::DoDecode(mozilla::MediaRawData*, unsigned ch...  dom/media/platforms/ffmpeg/FFmpegVideoDecoder.cpp:1656
3  libxul.so  mozilla::FFmpegDataDecoder<62>::ProcessDecode(mozilla::MediaRawData*)  dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp:310
4  libxul.so  mozilla::detail::RunnableMethodArguments<mozilla::MediaRawData*>::apply<mozil...  xpcom/threads/nsThreadUtils.h:1070
4  libxul.so  std::__invoke_impl<RefPtr<mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaD...  /builds/worker/fetches/sysroot-aarch64-linux-gnu/usr/include/c++/10/bits/invoke.h:60
4  libxul.so  std::__invoke<mozilla::detail::RunnableMethodArguments<mozilla::MediaRawData*...  /builds/worker/fetches/sysroot-aarch64-linux-gnu/usr/include/c++/10/bits/invoke.h:95
4  libxul.so  std::__apply_impl<mozilla::detail::RunnableMethodArguments<mozilla::MediaRawD...  /builds/worker/fetches/sysroot-aarch64-linux-gnu/usr/include/c++/10/tuple:1740
4  libxul.so  std::apply<mozilla::detail::RunnableMethodArguments<mozilla::MediaRawData*>::...  /builds/worker/fetches/sysroot-aarch64-linux-gnu/usr/include/c++/10/tuple:1751

It seems like we're hitting a null pointer but only on ARM64 for some reason, x86-64 builds seem unaffected.

Comment 1

[Jim Mathies [:jimm]]

Attachment: triage md report

Comment 2

[Tymur Boiko]

Attachment: Bug 2046425 - DOM Media - Fix null deref in FFmpegDescToVA for V4L2 frames. r=stransky,alwu

Guard the hw_frames_ctx dereference in FFmpegDescToVA inside the
non-DRM_PRIME branch. V4L2 frames have a null hw_frames_ctx, so when
CreateImageV4L2 calls GetVideoFrameSurface with a non-DRM_PRIME format
the unconditional deref crashes at address 0x8. The deref is used only
for diagnostic logging so skip it when hw_frames_ctx is null.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 2021722

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8ae09d669eda
https://hg.mozilla.org/integration/autoland/rev/2e0a5da4d580
DOM Media - Fix null deref in FFmpegDescToVA for V4L2 frames. r=alwu

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/2e0a5da4d580