buffer->timestamp() >= base::TimeDelta() in ffmpeg_demuxer.cc |
|||||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=6565168716972032 Fuzzer: inferno_layout_test_unmodified Job Type: linux_debug_content_shell_drt Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: buffer->timestamp() >= base::TimeDelta() in ffmpeg_demuxer.cc media::FFmpegDemuxerStream::EnqueuePacket media::FFmpegDemuxer::OnReadFrameDone Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=287002:287043 Minimized Testcase (0.06 Kb): Download: https://cluster-fuzz.appspot.com/download/AMIfv97G-6ewbDYJW0quOSw6oIU2aV0sWdkKjJvftpVSF6R_B7QKIars2wzbwWSJTzH_51Z22QzVUxD1SmjpU6erjCMLOkJmNu_LM_VNboPQdmSkakqmlnD-knrIcQ12phm5ViAWFAgfeQuJUQnCvGiAjOUZTNqKug?testcase_id=6565168716972032 <video><source src='flicker-graytone0.vp91400840449.51.webm'> Filer: nyerramilli See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jul 19 2016
Hmm, my change shouldn't have any effect on how we handle buffer timestamps in the FFmpegDemuxer. I think Dale might know more about this, since he added the fixup_negative_timestamps_ in FFmpegDemuxer (https://chromium.googlesource.com/chromium/src/+/aa958fd3a80afdfdc2f747a819a1c67605c637e6). Dale, any ideas why fuzzing crashes/CHECKs on negative timestamps in FFmpegDemuxer? Do we need to handle negative timestamps in webm in addition to ogg containers?
,
Jul 19 2016
There should not be negative timestamps in non-ogg containers, so this seems like a bug; though aside from glitchy rendering there is no impact of this behavior beyond the check failure.
,
Jul 29 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6684308601569280 Fuzzer: media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x03e90000745f Crash State: media::FFmpegDemuxerStream::EnqueuePacket media::FFmpegDemuxer::OnReadFrameDone void base::internal::FunctorTraits<void Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=408389:408457 Minimized Testcase (2.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95UoK5qCplbg5CW8yxh0ZT7VG9qsLVyRGPkOrzNSq4qMp7kY_2t_BoNWqPVuDDaGW0Tvc6WLL2Z7ic91iSlMvc0uB3fCm9fDEjWQnH1DNYYgEsZvB38O636uD0HoNQQ_pe8sGq9Cf_-T-lmxE0okCWfDcloGQ?testcase_id=6684308601569280 Filer: rnimmagadda See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Aug 1 2016
ClusterFuzz has detected this issue as fixed in range 408588:408608. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6684308601569280 Fuzzer: media_pipeline_integration_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x03e90000745f Crash State: media::FFmpegDemuxerStream::EnqueuePacket media::FFmpegDemuxer::OnReadFrameDone void base::internal::FunctorTraits<void Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=408389:408457 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=408588:408608 Minimized Testcase (2.16 Kb): https://cluster-fuzz.appspot.com/download/AMIfv95UoK5qCplbg5CW8yxh0ZT7VG9qsLVyRGPkOrzNSq4qMp7kY_2t_BoNWqPVuDDaGW0Tvc6WLL2Z7ic91iSlMvc0uB3fCm9fDEjWQnH1DNYYgEsZvB38O636uD0HoNQQ_pe8sGq9Cf_-T-lmxE0okCWfDcloGQ?testcase_id=6684308601569280 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Oct 18 2016
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 22 2016
ClusterFuzz testcase 6565168716972032 is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by nyerramilli@chromium.org
, Jul 15 2016Components: Tools>Test>FindIt>NoResult
Labels: findit-wrong Te-Logged M-52
Owner: servolk@chromium.org
Status: Assigned (was: Available)