New issue
Advanced search Search tips

Issue 781610 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in media::VpxVideoDecoder::MemoryPool::OnVideoFrameDestroyed

Project Member Reported by ClusterFuzz, Nov 5 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6262309000577024

Fuzzer: inferno_flicker
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7b1000017574
Crash State:
  media::VpxVideoDecoder::MemoryPool::OnVideoFrameDestroyed
  base::internal::Invoker<base::internal::BindState<void
  base::internal::IncomingTaskQueue::RunTask
  
Sanitizer: thread (TSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6262309000577024

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: kkaluri@chromium.org
Components: Internals>Media>Codecs
Labels: Test-Predator-Wrong M-63
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “vpx_video_decoder.cc” assigning to concern owner.
Suspecting Commit# https://chromium.googlesource.com/chromium/src/+/7457c49f753270d5f88293fa9403bf40493c7c1e

dalecurtis@ -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thank You.

Ah, looks like even though we may not have any pending decodes, the frame releases may still come in at the same time. We'll have to hand off vpx_codec_destroy() to the offload thread in this case.
Project Member

Comment 3 by bugdroid1@chromium.org, Nov 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2ccebeef9a1660bbee810c3af6b19ec4f574e968

commit 2ccebeef9a1660bbee810c3af6b19ec4f574e968
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Tue Nov 14 23:16:01 2017

Replace offload task runner with base::PostTask.

No reason to roll our own thread anymore. Just use the base::PostTask
mechanism. This additionally fixes race conditions with the tear down
of the codec when the offload task runner is running.

BUG= 781610 
TEST=no race condition anymore.

Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: Ia448968d48017a16c425befae43b3f9c1a396f40
Reviewed-on: https://chromium-review.googlesource.com/767576
Reviewed-by: Thomas Guilbert <tguilbert@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#516490}
[modify] https://crrev.com/2ccebeef9a1660bbee810c3af6b19ec4f574e968/media/filters/vpx_video_decoder.cc
[modify] https://crrev.com/2ccebeef9a1660bbee810c3af6b19ec4f574e968/media/filters/vpx_video_decoder.h

Status: Fixed (was: Assigned)
Labels: -M-63 M-64
Project Member

Comment 6 by ClusterFuzz, Nov 18 2017

ClusterFuzz has detected this issue as fixed in range 514498:517698.

Detailed report: https://clusterfuzz.com/testcase?key=6262309000577024

Fuzzer: inferno_flicker
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7b1000017574
Crash State:
  media::VpxVideoDecoder::MemoryPool::OnVideoFrameDestroyed
  base::internal::Invoker<base::internal::BindState<void
  base::internal::IncomingTaskQueue::RunTask
  
Sanitizer: thread (TSAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=514498:517698

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6262309000577024

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Nov 18 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6262309000577024 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment