bytes_to_fill == static_cast<size_t>(params_.GetBytesPerBuffer()) in pulse_outpu |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4742838359425024 Fuzzer: inferno_flicker Job Type: linux_asan_chrome_chromeos Platform Id: linux Crash Type: CHECK failure Crash Address: Crash State: bytes_to_fill == static_cast<size_t>(params_.GetBytesPerBuffer()) in pulse_outpu media::PulseAudioOutputStream::FulfillWriteRequest pa_pdispatch_run Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_chromeos&range=370165:370699 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96SvwSwKcgmcTpR6BwrjzBulh9pWxP54YwXQi8xSC7QAT13FDnX5ovW0wR11L3ObNE7Xi4q2CxKcBuTAaeuBrBmjle3z25QR3lV2Y5kMvJ47s30IG6yfkEEwM1NzDmZE46tWIWKaFOODhATFQMByJMEihPZnAEs3gH-hGBKmmmDhrfujDk?testcase_id=4742838359425024 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 1 2016
The check fails comparing bytes-per-buffer value returned by pa_stream_begin_write() vs AudioParameters one pased into it. (65472 vs. 196608) Documentation for pa_stream_begin_write() says that "on return *nbytes can be smaller or have the same value as you passed in". (http://pulseaudio.sourcearchive.com/documentation/1.0/stream_8h_a6cf50cfc4ea8897391941184d74d7dfa.html) However, the failing check assumes that the returned size will be the same as the passed one. The check was added 3,5 yeasr ago (https://chromiumcodereview.appspot.com/12328097) because the case had never been observed when the values are different.
,
Dec 1 2016
Known crashes for FullfillWriteRequest: https://crash.corp.google.com/browse?stbtiq=FulfillWriteRequest The only one I see is not related (https://crash.corp.google.com/browse?q=&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=&stbtiq=FulfillWriteRequest&reportid=2e9ffcb900000000&index=0) Lowering the priority.
,
Dec 1 2016
196608 bytes per buffer can be reached if maximum output buffer size of 8192 is used ( https://cs.chromium.org/chromium/src/media/audio/pulse/audio_manager_pulse.cc?q=pulse+%228192%22&sq=package:chromium&l=41&dr=C) for 12 channels at 16 bps. In usual cases we have 20 ms buffers at 192kHz at max, so for 8 channels it will be 192 * 20 * 8 * 2 = 61440. That's probably why we never hit the check.
,
Mar 16 2017
ClusterFuzz testcase 4742838359425024 is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by mmohammad@chromium.org
, Oct 31 2016Owner: olka@chromium.org
Status: Assigned (was: Untriaged)