New issue
Advanced search Search tips

Issue 615141 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2016
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

DecoderStream can drop valid demuxer buffers when falling back to a new decoder.

Project Member Reported by tguilbert@chromium.org, May 26 2016

Issue description

I set up GpuVideoDecoder to fail 10%, and held the refresh button for a few minutes to see if I ever got into the overlapping demuxer reads from 613958.

Instead I ran into a DCHECK on this line:
https://code.google.com/p/chromium/codesearch#chromium/src/media/filters/decoder_stream.cc&q=decoder_stream&sq=package:chromium&type=cs&l=586
When we were in STATE_NORMAL

This was not caught earlier mainly because this line:
https://code.google.com/p/chromium/codesearch#chromium/src/media/filters/decoder_stream.cc&q=decoder_stream&sq=package:chromium&type=cs&l=546
is not a condition, and will never be false (it is missing the 'state_ ==')

This lead me to realize that, currently, the following scenario can happen:
- DecoderStream requests buffers from the demuxer
  (STATE_PENDING_DEMUXER_READ).
- |decoder_| returns a DECODE_ERROR before a frame was outputted, 
  initiating a decoder fallback (STATE_REINITIALIZING_DECODER).
- OnDecoderSelected() successfully completes (STATE_NORMAL).
- OnBufferReady() is called back (the typo in the DCHECK meant we never
  considered when we enter the function in STATE_NORMAL). We return at
  line 601 because the state is not STATE_PENDING_DEMUXER_READ, and drop
  the buffer.

 
Project Member

Comment 1 by bugdroid1@chromium.org, May 27 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4849043c3e003ef57a431552f9a97cf159debd06

commit 4849043c3e003ef57a431552f9a97cf159debd06
Author: tguilbert <tguilbert@chromium.org>
Date: Fri May 27 03:11:14 2016

Fix dropped demuxer buffers for fallback decoder

An edge case was missed due to a typo in a DCHECK, during the original
fallback decoder submission.

Currently, the following scenario can happen:
- DecoderStream requests buffers from the demuxer
  (STATE_PENDING_DEMUXER_READ).
- |decoder_| returns a DECODE_ERROR before a frame was ouptutted,
  initiating a decoder fallback (STATE_REINITIALIZING_DECODER).
- OnDecoderSelected() successfully completes (STATE_NORMAL).
- OnBufferReady() is called back (the typo in the DCHECK meant we never
  considered when we enter the function in STATE_NORMAL). We return at
  line 601 because the state is not STATE_PENDING_DEMUXER_READ, and drop
  the buffer.

This CL fixes the typo, and changes so we only drop the buffer whilst in
STATE_ERROR, and also handles the case where we had saved buffers in the
fallback buffer queue.

BUG= 615141 
TEST= Setup GpuVideoDecoder to fail 10% and refreshed the page for
several minutes. Hard to test the end to end though...

Review-Url: https://codereview.chromium.org/2012293002
Cr-Commit-Position: refs/heads/master@{#396371}

[modify] https://crrev.com/4849043c3e003ef57a431552f9a97cf159debd06/media/filters/decoder_stream.cc

Status: Fixed (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Jun 30 2016

Labels: merge-merged-2743
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/62136bd4d4f641a0f516badd93c200eaf2bca285

commit 62136bd4d4f641a0f516badd93c200eaf2bca285
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Thu Jun 30 01:35:42 2016

Merge M52: "Fix dropped demuxer buffers for fallback decoder"

An edge case was missed due to a typo in a DCHECK, during the original
fallback decoder submission.

Currently, the following scenario can happen:
- DecoderStream requests buffers from the demuxer
  (STATE_PENDING_DEMUXER_READ).
- |decoder_| returns a DECODE_ERROR before a frame was ouptutted,
  initiating a decoder fallback (STATE_REINITIALIZING_DECODER).
- OnDecoderSelected() successfully completes (STATE_NORMAL).
- OnBufferReady() is called back (the typo in the DCHECK meant we never
  considered when we enter the function in STATE_NORMAL). We return at
  line 601 because the state is not STATE_PENDING_DEMUXER_READ, and drop
  the buffer.

This CL fixes the typo, and changes so we only drop the buffer whilst in
STATE_ERROR, and also handles the case where we had saved buffers in the
fallback buffer queue.

BUG=597605,  615141 
TEST= Setup GpuVideoDecoder to fail 10% and refreshed the page for
several minutes. Hard to test the end to end though...

Review-Url: https://codereview.chromium.org/2012293002
Cr-Commit-Position: refs/heads/master@{#396371}
(cherry picked from commit 4849043c3e003ef57a431552f9a97cf159debd06)

Review URL: https://codereview.chromium.org/2109083003 .

Cr-Commit-Position: refs/branch-heads/2743@{#541}
Cr-Branched-From: 2b3ae3b8090361f8af5a611712fc1a5ab2de53cb-refs/heads/master@{#394939}

[modify] https://crrev.com/62136bd4d4f641a0f516badd93c200eaf2bca285/media/filters/decoder_stream.cc

Labels: Needs-Feedback
tguilbert@, can you please let us know if this can be manually tested ? If so, please provide us with the steps so that we can verify it at our end ?
In order to test it, you would have to compile a version of Chrome where the HW accelerated decoders arbitrarily fail some % of the time (10% is what I for example). Then, within 5 minutes of holding the refresh button and trying to play a video format that supports HW acceleration, Chrome would crash.

I had done some manual testing, and with the fix, I was not able to repro anymore (using the same setup that found the bug, Chrome didn't crash within about 10 minutes of refreshing).

Furthermore, Dale's fix for 597605 removed STATE_REINIALIZING_DECODER, which was one of the ingredients necessary for running into this bug.

I think it is acceptable to mark this bug as Verified (if that was the intent of your question).

Sign in to add a comment