New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 708074 link

Starred by 5 users

Issue metadata

Status: Duplicate
Merged: issue 679306
Owner:
Last visit > 30 days ago
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Chrome_Mac: Crash Report - webrtc::video_coding::FrameBuffer::NextFrame

Project Member Reported by krajshree@chromium.org, Apr 4 2017

Issue description

Unable to find the crash in Fracas, hence reported from Create new issue link.

Product name: Chrome_Mac
Magic Signature: webrtc::video_coding::FrameBuffer::NextFrame

Current link:
https://crash.corp.google.com/browse?q=product.name%3D'Chrome_Mac'%20AND%20product.version%3D'58.0.3029.41'%20AND%20custom_data.ChromeCrashProto.channel%3D'beta'%20AND%20custom_data.ChromeCrashProto.ptype%3D'renderer'%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D'webrtc%3A%3Avideo_coding%3A%3AFrameBuffer%3A%3ANextFrame'%20AND%20ReportID%3D'538be98ee0000000'&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#3


Search properties:
product.name: Chrome_Mac
product.version: 58.0.3029.41
custom_data.chromecrashproto.channel: beta
custom_data.chromecrashproto.ptype: renderer
custom_data.chromecrashproto.magic_signature_1.name: webrtc::video_coding::FrameBuffer::NextFrame
reportid: 538be98ee0000000

Metadata :
Product Name: Chrome_Mac
Product Version: 58.0.3029.41
Report ID: 538be98ee0000000
Report Time: Mon, 03 Apr 2017 13:54:54 GMT
Uptime: 10530000 ms
Cumulative Uptime: 0 ms
User Email: 
OS Name: Mac OS X
OS Version: 10.12.1 16B2338c
CPU Architecture: amd64
CPU Info: family 6 model 70 stepping 1

Stack Trace
=============================
Thread 30 CRASHED [EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000033 ] MAGIC SIGNATURE THREAD
Stack Quality43%Show frame trust levels
0x00000001104315f3	(Google Chrome Framework -__tree:148 )	webrtc::video_coding::FrameBuffer::NextFrame(long long, std::__1::unique_ptr<webrtc::video_coding::FrameObject, std::__1::default_delete<webrtc::video_coding::FrameObject> >*)
0x000000011042555f	(Google Chrome Framework -video_receive_stream.cc:478 )	webrtc::internal::VideoReceiveStream::Decode()
0x000000010f7c5066	(Google Chrome Framework -platform_thread.cc:231 )	rtc::PlatformThread::Run()
0x000000010f7c4fb8	(Google Chrome Framework -platform_thread.cc:138 )	rtc::PlatformThread::StartThread(void*)
0x00007fffaa093aaa	(libsystem_pthread.dylib + 0x00003aaa )	
0x00007fffaa0939f6	(libsystem_pthread.dylib + 0x000039f6 )	
0x00007fffaa093220	(libsystem_pthread.dylib + 0x00003220 )	
0x000000010f7c4faf	(Google Chrome Framework -platform_thread.cc:118 )	rtc::PlatformThread::~PlatformThread()

1) This is a regression crash seen from 57.0.2950.4 and crashes are also seen in latest beta #58.0.3029.41.

2) Currently its a top #28 renderer crasher having 2 crashes from 2 unique client Ids.

3) Crashes are seen on latest M58 as below.

   58.0.3029.41	4.00%	2	-- Latest Beta

4) Link to list of builds where crashes are seen:
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Mac%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27renderer%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27webrtc%3A%3Avideo_coding%3A%3AFrameBuffer%3A%3ANextFrame%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#samplereports:5,productversion:1000

5) Possible suspect from the code search on the crashed file "video_receive_stream.cc" based on recent changes made.
Review-Url: https://codereview.webrtc.org/2720963003

philipel@ : Could you please take a look into this if its related to your change.

Thanks...!!
 
Project Member

Comment 1 by sheriffbot@chromium.org, Apr 7 2017

Labels: FoundIn-M-59 Fracas
Users experienced this crash on the following builds:

Mac Canary 59.0.3064.0 -  0.62 CPM, 2 reports, 1 clients (signature webrtc::video_coding::FrameBuffer::NextFrame)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas
Project Member

Comment 2 by sheriffbot@chromium.org, Apr 7 2017

Labels: FoundIn-M-58
Users experienced this crash on the following builds:

Mac Beta 58.0.3029.54 -  0.41 CPM, 3 reports, 3 clients (signature webrtc::video_coding::FrameBuffer::NextFrame)

If this update was incorrect, please add "Fracas-Wrong" label to prevent future updates.

- Go/Fracas

Comment 3 by rsesek@chromium.org, Apr 11 2017

Cc: rsesek@chromium.org
 Issue 710480  has been merged into this issue.

Comment 4 by rsesek@chromium.org, Apr 17 2017

Labels: -Restrict-View-Google
I have found what is causing the crash, and it is due to the FrameBuffer2 not handling large jumps in picture id correctly.

For example when receiving these frames in a stream:
5453, 5454, 15670, 29804, 29805, 29806, 33819, 41248

Then the order will be considered to be:
5453 < 5454 < 15670 < 29804 < 29805 < 29806 < 33819

But when inserting 41248 it is both 33819 < 41248 and 41248 < 5453 due to the picture id wrapping at 2^16. This cause problems in the NextFrame function when we want to iterate over all continuous frames to find the best frame to return next.
Mergedinto: 679306
Status: Duplicate (was: Assigned)

Comment 7 by awhalley@google.com, Apr 20 2017

Labels: Restrict-View-SecurityTeam

Comment 9 by k...@google.com, Apr 25 2017

Cc: anatolid@chromium.org
Cc: huib@chromium.org
Project Member

Comment 11 by sheriffbot@chromium.org, Jul 29 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment