New issue
Advanced search Search tips

Issue 790959 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Dec 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: !demuxer_ in ffmpeg_demuxer.cc

Project Member Reported by ClusterFuzz, Dec 1 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4648561534042112

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !demuxer_ in ffmpeg_demuxer.cc
  media::FFmpegDemuxerStream::~FFmpegDemuxerStream
  media::FFmpegDemuxerStream::~FFmpegDemuxerStream
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519843:519877

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4648561534042112

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 1 2017

Components: Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Dec 1 2017

Labels: Test-Predator-Auto-Owner
Owner: sande...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/dbce4c1629ddc42427c466f23073fd85a053b291 ([media] When testing, call RendererWrapper::Stop() synchronously.).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 3 by bugdroid1@chromium.org, Dec 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/899f15412decebca4789fb4fdca48a6153d33e27

commit 899f15412decebca4789fb4fdca48a6153d33e27
Author: Dan Sanders <sandersd@chromium.org>
Date: Mon Dec 04 21:26:10 2017

[media] Fix more cases of Pipeline::Stop() on wrong task runner in tests

Callbacks and mocks that are called on the media thread but act on the
Pipeline must post that work.

This CL fixes the cases where pipeline_integration_fuzzertest.cc calls
test->FailTest() from callbacks.

Bug:  790959 
Change-Id: Iecfdb095dd9d213deffa24f44790b0617ace371a
Reviewed-on: https://chromium-review.googlesource.com/804494
Commit-Queue: Dan Sanders <sandersd@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#521458}
[modify] https://crrev.com/899f15412decebca4789fb4fdca48a6153d33e27/media/test/pipeline_integration_fuzzertest.cc

Project Member

Comment 4 by ClusterFuzz, Dec 5 2017

ClusterFuzz has detected this issue as fixed in range 521454:521495.

Detailed report: https://clusterfuzz.com/testcase?key=4648561534042112

Fuzzer: libFuzzer_media_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !demuxer_ in ffmpeg_demuxer.cc
  media::FFmpegDemuxerStream::~FFmpegDemuxerStream
  media::FFmpegDemuxerStream::~FFmpegDemuxerStream
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=519843:519877
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=521454:521495

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4648561534042112

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Dec 5 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 4648561534042112 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment