Data race in media::VpxVideoDecoder::MemoryPool::OnVideoFrameDestroyed |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6262309000577024 Fuzzer: inferno_flicker Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 4 Crash Address: 0x7b1000017574 Crash State: media::VpxVideoDecoder::MemoryPool::OnVideoFrameDestroyed base::internal::Invoker<base::internal::BindState<void base::internal::IncomingTaskQueue::RunTask Sanitizer: thread (TSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6262309000577024 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Nov 6 2017
Ah, looks like even though we may not have any pending decodes, the frame releases may still come in at the same time. We'll have to hand off vpx_codec_destroy() to the offload thread in this case.
,
Nov 14 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/2ccebeef9a1660bbee810c3af6b19ec4f574e968 commit 2ccebeef9a1660bbee810c3af6b19ec4f574e968 Author: Dale Curtis <dalecurtis@chromium.org> Date: Tue Nov 14 23:16:01 2017 Replace offload task runner with base::PostTask. No reason to roll our own thread anymore. Just use the base::PostTask mechanism. This additionally fixes race conditions with the tear down of the codec when the offload task runner is running. BUG= 781610 TEST=no race condition anymore. Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel Change-Id: Ia448968d48017a16c425befae43b3f9c1a396f40 Reviewed-on: https://chromium-review.googlesource.com/767576 Reviewed-by: Thomas Guilbert <tguilbert@chromium.org> Commit-Queue: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#516490} [modify] https://crrev.com/2ccebeef9a1660bbee810c3af6b19ec4f574e968/media/filters/vpx_video_decoder.cc [modify] https://crrev.com/2ccebeef9a1660bbee810c3af6b19ec4f574e968/media/filters/vpx_video_decoder.h
,
Nov 17 2017
,
Nov 17 2017
,
Nov 18 2017
ClusterFuzz has detected this issue as fixed in range 514498:517698. Detailed report: https://clusterfuzz.com/testcase?key=6262309000577024 Fuzzer: inferno_flicker Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 4 Crash Address: 0x7b1000017574 Crash State: media::VpxVideoDecoder::MemoryPool::OnVideoFrameDestroyed base::internal::Invoker<base::internal::BindState<void base::internal::IncomingTaskQueue::RunTask Sanitizer: thread (TSAN) Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=514498:517698 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6262309000577024 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 18 2017
ClusterFuzz testcase 6262309000577024 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by kkaluri@chromium.org
, Nov 6 2017Components: Internals>Media>Codecs
Labels: Test-Predator-Wrong M-63
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)