Out-of-memory in mediasource_MP4_AACSBR_pipeline_integration_fuzzer |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4540576199606272 Fuzzer: libFuzzer_mediasource_MP4_AACSBR_pipeline_integration_fuzzer Job Type: mac_libfuzzer_chrome_asan Platform Id: mac Crash Type: Out-of-memory (exceeds 2048 MB) Crash Address: Crash State: mediasource_MP4_AACSBR_pipeline_integration_fuzzer Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4540576199606272 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
,
Oct 23 2017
As per the Issue 759277 owner, assigning this issue to @sandersd. @sandersd -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes. Thanks.
,
Oct 24 2017
For more information, please see https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md. The link referenced in the description is no longer valid.
,
Oct 24 2017
,
Oct 24 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/91965df34bca6d9236e62c7a228354d17843dcfa commit 91965df34bca6d9236e62c7a228354d17843dcfa Author: Dan Sanders <sandersd@chromium.org> Date: Tue Oct 24 23:29:56 2017 Limit TrackRunInfo.samples allocation size to 150MB. When trun.sample_count is large, TrackRunInfo.samples may be allocated larger than available memory. This CL caps that allocation to 150MB, and removes the earlier limit that disallowed two (or more) zero-sized samples in a row. This effectively limits the number of samples per trun to 6.5M, which also helps avoid timeouts in fuzzing. That problem is unlikely to be solved by this CL alone, though. Bug: 776721 , 776246 , 774760 , 776018 , 770577 Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: Ib4c35c066193a9da8ef460d9d9283e999d803ced Reviewed-on: https://chromium-review.googlesource.com/734702 Commit-Queue: Dan Sanders <sandersd@chromium.org> Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Reviewed-by: Matthew Wolenetz <wolenetz@chromium.org> Cr-Commit-Position: refs/heads/master@{#511301} [modify] https://crrev.com/91965df34bca6d9236e62c7a228354d17843dcfa/media/formats/mp4/track_run_iterator.cc
,
Jan 12 2018
,
Jan 31 2018
ClusterFuzz testcase 4540576199606272 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ClusterFuzz
, Oct 19 2017