New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 766472 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Timeout in mediasource_MP4_AACLC_pipeline_integration_fuzzer

Project Member Reported by ClusterFuzz, Sep 19 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4909765900894208

Fuzzer: libFuzzer_mediasource_MP4_AACLC_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  mediasource_MP4_AACLC_pipeline_integration_fuzzer
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4909765900894208

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
 
Labels: Test-Predator-Wrong CF-NeedsTriage
Redo Task has been performed for regression range.
Thank You.
Project Member

Comment 2 by ClusterFuzz, Sep 19 2017

Labels: OS-Mac
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Components: Internals>Media
Labels: -CF-NeedsTriage
Owner: wolenetz@chromium.org
Status: Assigned (was: Untriaged)
As per the  Issue 754500  owner assigning this issue to @wolenetz.
@wolenetz -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thanks.


I have a local repro. It looks like an avoidable timeout from the log (the pipeline does a kStarting -> kStopping after init+media segment+endOfStream, then kStopping -> kkStopped after ChunkDemuxerStream shutdown and ChunkDemuxer ENDED -> SHUTDOWN.

Further investigation is needed to figure out what's going on. Maybe bisect if this was working before...
Cc: wolenetz@chromium.org
 Issue 766669  has been merged into this issue.
Test-specific EME handler is calling FailTest, which apparently isn't ending the RunLoop of the test.
Cc: xhw...@chromium.org
Components: -Internals>Media Internals>Media>Encrypted Internals>Media>Source
Detail:

0921/131548.555379:VERBOSE1:mp4_stream_parser.cc(391)] audio_track_id=1 config=codec: aac bytes_per_channel: 2 channel_layout: 3 channels: 2 samples_per_second: 44100 sample_format: 2 bytes_per_frame: 4 seek_preroll: 0ms codec_delay: 0 has extra data? false encrypted? true
[0921/131548.555703:VERBOSE2:pipeline_impl.cc(1034)] Stop
...
[0921/131548.563000:VERBOSE1:pipeline_impl.cc(814)] kStopping -> kStopped

(but StartPipelineWithMediaSource's runloop never quits...)
Project Member

Comment 10 by bugdroid1@chromium.org, Sep 21 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/194995c434ed179b0b2cba1269a2f4fd1d4dbcae

commit 194995c434ed179b0b2cba1269a2f4fd1d4dbcae
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Thu Sep 21 23:13:44 2017

MSE+SRC=: Let early PITB::FailTest() during PITB::Start*() stop the Start*()

Modifies PITB::StartPipelineWithMediaSource() to let any PITB::OnEnded()
or PITB()::OnError() stop the run loop and let the method return. In
cases where OnError (like that triggered if EME is indicated in init
segment -> PITB::FailTest()) or OnEnded occur prior to pipeline
completing start-up, this avoids one kind of fuzzer timeout.

Also includes addition of PITB helpers to assist common "RunUntilIdle"
scenarios and refactoring of PITB to use those helpers.

Also changes the SRC= PITB::StartInternal() to similarly allow early
fuzzer EME callback to quit the run-loop early, possibly mitigating any
similar timeouts in SRC= media_pipeline_integration_fuzzer.

BUG= 766472 , 766669 

Change-Id: I8307db26828eaf04ae92dc1dbee4fa6969c5dd37
Reviewed-on: https://chromium-review.googlesource.com/677774
Reviewed-by: Dan Sanders <sandersd@chromium.org>
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#503605}
[modify] https://crrev.com/194995c434ed179b0b2cba1269a2f4fd1d4dbcae/media/test/pipeline_integration_test_base.cc
[modify] https://crrev.com/194995c434ed179b0b2cba1269a2f4fd1d4dbcae/media/test/pipeline_integration_test_base.h

Status: Fixed (was: Assigned)
#10 should fix this. Pending CF verification...

Sign in to add a comment