tguilbert@, could you please take a look?
Thank you.

ClusterFuzz has detected this issue as fixed in range 466472:466488.

Detailed report: https://clusterfuzz.com/testcase?key=5427164494430208

Fuzzer: ochang_domfuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 4
Crash Address: 0x7b5c0002fed4
Crash State:
  read_frame_internal
  av_read_frame
  base::internal::Invoker<base::internal::BindState<int
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=466318:466320
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=466472:466488

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5427164494430208


Additional requirements: Requires Gestures

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

ClusterFuzz testcase 5427164494430208 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

I don't think this is actually fixed => servolk@, it seems like we're calling SetEnabled on the wrong thread, it must be trampolined to the blocking thread.

IIRC the problem is that we are setting AVStream.discard property on media thread (see https://cs.chromium.org/chromium/src/media/filters/ffmpeg_demuxer.cc?rcl=7ddccb994a410a624be528ca2143c869afb67683&l=743). It probably doesn't make sense to call all of SetEnabled on the FFmpeg thread, we'd just get the opposite problem of accessing FFmpegDemuxerStream properties from non-media thread. Instead we can probably just post the setting of AVStream.discard to the blocking_task_runner_. The discard property is purely an optimization thing, so it should be ok if it's updated slightly after the SetEnabled has been toggled. I'll make a CL.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/12b000b53d9f17fe443e7ff10a57f00f9ff17045

commit 12b000b53d9f17fe443e7ff10a57f00f9ff17045
Author: servolk <servolk@chromium.org>
Date: Mon Apr 24 23:00:46 2017

Set FFmpeg AVStream discard on FFmpeg task runner thread

BUG= 714217 

Review-Url: https://codereview.chromium.org/2836173002
Cr-Commit-Position: refs/heads/master@{#466809}

[modify] https://crrev.com/12b000b53d9f17fe443e7ff10a57f00f9ff17045/media/filters/ffmpeg_demuxer.cc
[modify] https://crrev.com/12b000b53d9f17fe443e7ff10a57f00f9ff17045/media/filters/ffmpeg_demuxer.h

We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.