813549 - DASH crash [@vpx_codec_destroy]

Status: RESOLVED WONTFIX

(Core :: Audio/Video, defect)

Description

[Christoph Diehl [:posidron]]

This happened while fuzzing DASH, the testcase did not reproduce the crash.

We see the following warnings before the crash:

WARNING: NS_ENSURE_TRUE(type.EqualsLiteral("static")) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODParser.cpp, line 101
WARNING: NS_ENSURE_SUCCESS(rv, nullptr) failed with result 0x80070057: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODParser.cpp, line 81
WARNING: NS_ENSURE_TRUE(aMpd) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODManager.cpp, line 60
WARNING: NS_ENSURE_TRUE(mMpd) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODManager.cpp, line 78
WARNING: NS_ENSURE_TRUE(current) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODManager.cpp, line 187
WARNING: NS_ENSURE_TRUE(mMpd) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODManager.cpp, line 78
WARNING: NS_ENSURE_TRUE(current) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/netwerk/dash/mpd/nsDASHWebMODManager.cpp, line 196
WARNING: NS_ENSURE_TRUE(startTime >= 0 && mDuration > 0) failed: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/content/media/dash/DASHDecoder.cpp, line 382
WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x804B000A: file /Users/cdiehl/Code/Mozilla/mc-inbound-asan/content/base/src/nsImageLoadingContent.cpp, line 554


==6022== ERROR: AddressSanitizer crashed on unknown address 0x000000000000 (pc 0x000108314993 sp 0x7fff5fbfbfd0 bp 0x7fff5fbfbff0 T0)
AddressSanitizer can not provide additional info.
    #0 0x108314992 in vpx_codec_destroy vpx_codec.c:100
    #1 0x106a287b5 in mozilla::WebMReader::~WebMReader WebMReader.cpp:127
    #2 0x106a2872d in mozilla::WebMReader::~WebMReader WebMReader.cpp:121
    #3 0x106a3ab58 in mozilla::MediaDecoderReader::Release MediaDecoderReader.h:361
    #4 0x106a3a957 in mozilla::DASHReader::~DASHReader DASHReader.h:41
    #5 0x106a3a4dd in mozilla::DASHReader::~DASHReader DASHReader.h:39
    #6 0x1069caf4d in nsAutoPtr<mozilla::MediaDecoderReader>::operator= nsAutoPtr.h:103
    #7 0x1069ba2e1 in mozilla::MediaDecoderStateMachine::~MediaDecoderStateMachine MediaDecoderStateMachine.cpp:453
    #8 0x1069ba10d in mozilla::MediaDecoderStateMachine::~MediaDecoderStateMachine MediaDecoderStateMachine.cpp:441
    #9 0x107c95edc in nsRunnable::Release nsThreadUtils.cpp:31
    #10 0x1069b594d in nsCOMPtr<mozilla::MediaDecoderStateMachine>::operator= nsCOMPtr.h:624
    #11 0x1069cf0d3 in mozilla::nsDecoderDisposeEvent::Run MediaDecoderStateMachine.cpp:1950
    #12 0x107d53af7 in nsThread::ProcessNextEvent nsThread.cpp:627
    #13 0x107c966a1 in NS_ProcessPendingEvents_P nsThreadUtils.cpp:171
    #14 0x107605ba3 in nsBaseAppShell::NativeEventCallback nsBaseAppShell.cpp:97
    #15 0x107580c9d in nsAppShell::ProcessGeckoEvents nsAppShell.mm:387
    #16 0x7fff87a13100 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (in CoreFoundation) + 16
    #17 0x7fff87a12a24 in __CFRunLoopDoSources0 (in CoreFoundation) + 244
    #18 0x7fff87a35dc4 in __CFRunLoopRun (in CoreFoundation) + 788
    #19 0x7fff87a356b1 in CFRunLoopRunSpecific (in CoreFoundation) + 289
    #20 0x7fff8ca570a3 in RunCurrentEventLoopInMode (in HIToolbox) + 208
    #21 0x7fff8ca56d83 in ReceiveNextEventCommon (in HIToolbox) + 165
    #22 0x7fff8ca56cd2 in BlockUntilNextEventMatchingListInMode (in HIToolbox) + 61
    #23 0x7fff8992d612 in _DPSNextEvent (in AppKit) + 684
    #24 0x7fff8992ced1 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (in AppKit) + 127
    #25 0x10757f347 in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] nsAppShell.mm:164
    #26 0x7fff89924282 in -[NSApplication run] (in AppKit) + 516
    #27 0x1075818b9 in nsAppShell::Run nsAppShell.mm:741
    #28 0x107152158 in nsAppStartup::Run nsAppStartup.cpp:290
    #29 0x104fc96c1 in XREMain::XRE_mainRun nsAppRunner.cpp:3823
    #30 0x104fca8bd in XREMain::XRE_main nsAppRunner.cpp:3890
    #31 0x104fcaf22 in XRE_main nsAppRunner.cpp:4084
    #32 0x100002d3f in do_main nsBrowserApp.cpp:174
    #33 0x1000022e3 in main nsBrowserApp.cpp:279
    #34 0x100001703 in start (in firefox) + 51
    #35 0x4 in 0x0000000100000004 (in firefox)
Stats: 243M malloced (279M for red zones) by 717120 calls
Stats: 16M realloced by 26356 calls
Stats: 204M freed by 531036 calls
Stats: 83M really freed by 159989 calls
Stats: 444M (113723 full pages) mmaped in 111 calls
  mmaps   by size class: 8:475107; 9:57337; 10:40950; 11:12282; 12:4096; 13:3072; 14:1792; 15:640; 16:1024; 17:352; 18:32; 19:8; 20:12; 21:8;
  mallocs by size class: 8:566142; 9:72030; 10:52947; 11:12784; 12:4860; 13:3859; 14:2015; 15:713; 16:1315; 17:397; 18:31; 19:9; 20:10; 21:8;
  frees   by size class: 8:409842; 9:53649; 10:46338; 11:10520; 12:3339; 13:3441; 14:1796; 15:583; 16:1108; 17:379; 18:22; 19:6; 20:7; 21:8;
  rfrees  by size class: 8:108259; 9:21149; 10:22770; 11:4250; 12:1033; 13:1333; 14:453; 15:149; 16:375; 17:195; 18:9; 19:2; 20:5; 21:7;
Stats: malloc large: 672 small slow: 3720
==6022== ABORTING

Comment 1

[Steve Workman [:sworkman] (INACTIVE)]

Marking this as wontifx, since DASH work in Gecko has been halted indefinitely (see Bug 702122 comment 10), and code is to be excluded from the build soon (Bug 855064), and removed from the codebase at some point after that.