New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 817341 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jul 12
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Timeout in media_vpx_video_decoder_fuzzer

Project Member Reported by ClusterFuzz, Feb 28 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5948370842288128

Fuzzer: libFuzzer_media_vpx_video_decoder_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  media_vpx_video_decoder_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=430909:430924

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5948370842288128

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Cc: brajkumar@chromium.org
Components: Internals>Media>Video
Labels: -Pri-1 M-65 Test-Predator-Wrong Pri-2
Owner: mmoroz@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.

From the below CL observing some changes related to 'media_vpx_video_decoder_fuzzer' hence suspecting the same
https://chromium.googlesource.com/chromium/src/+log/08e70eafd07278df1ff50d8c26055c884e13825e..1b17536a000dc9d3029a5263ba80fe32e28f3d44?pretty=fuller&n=10000

Suspect CL: https://chromium.googlesource.com/chromium/src/+/29b3abb7b00ec613920892937199d39f684c9493

mmoroz@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

Comment 2 by mmoroz@chromium.org, Mar 14 2018

Owner: jrumm...@chromium.org
Passing this over to John from Media team.
Labels: -M-65 M-68
I'll try to look into this in the next release.
Cc: dalecur...@chromium.org
Able to recreate this locally. Noticed 2 problems:
1) The test is run twice, no idea why. The test does complete, it just takes 50 seconds (timeout is 25 seconds). Log below.
2) The data allocates a frame of 14026 x 14393, which results in a frame allocation of 1,224,695,839 bytes. Currently the code creates a std::vector<uint8_t> of size 0 and then resizes it to the required size, which takes 15 seconds. I'll try fixing this.

Log (additional output with timestamps from vpx_video_decoder_fuzzertest.cc):
/ssd/chrome/src/out/clusterfuzz_5948370842288128/media_vpx_video_decoder_fuzzer: Running 1 inputs 1 time(s) each.
Running: /usr/local/google/home/jrummell/.clusterfuzz/cache/testcases/5948370842288128_testcase/fuzz-3
20:53:48.536 Enter
20:53:48.536 Calling Initialize()
20:53:48.537 OnInitDone()
20:53:48.537 Done Initialize()
20:53:48.537 Calling Decode()      // takes 15 seconds, #2 above
20:54:04.071 OnDecodeComplete()
20:54:04.072 Done Decode()
20:54:04.072 Exit
20:54:15.440 Enter                 // no idea why this is called again (and after 11 seconds of ??)
20:54:15.440 Calling Initialize()
20:54:15.441 OnInitDone()
20:54:15.441 Done Initialize()
20:54:15.441 Calling Decode()      // takes 15 seconds again, #2 above
20:54:31.004 OnDecodeComplete()
20:54:31.004 Done Decode()
20:54:31.004 Exit
Executed /usr/local/google/home/jrummell/.clusterfuzz/cache/testcases/5948370842288128_testcase/fuzz-3 in 53147 ms

Project Member

Comment 5 by bugdroid1@chromium.org, Jul 12

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/803005b59bef10b2d804a5827d626dcc9d10d906

commit 803005b59bef10b2d804a5827d626dcc9d10d906
Author: John Rummell <jrummell@chromium.org>
Date: Thu Jul 12 00:09:27 2018

Improve FrameBuffer allocation time

When allocating a large buffer (via the fuzzer tests), calling resize() on
std::vector<uint8_t> took a long time. This changes the code to use a
std::unique_ptr<uint8_t[]> so that allocating a large buffer is much cheaper.

BUG= 817341 
TEST=fuzzer test now runs in 535ms instead of timing out after 25 seconds

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel
Change-Id: If3a57a325dfab4f15d43a71b935e18c2ce759715
Reviewed-on: https://chromium-review.googlesource.com/1133586
Commit-Queue: John Rummell <jrummell@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#574422}
[modify] https://crrev.com/803005b59bef10b2d804a5827d626dcc9d10d906/media/filters/frame_buffer_pool.cc

Project Member

Comment 6 by ClusterFuzz, Jul 12

ClusterFuzz has detected this issue as fixed in range 574418:574425.

Detailed report: https://clusterfuzz.com/testcase?key=5948370842288128

Fuzzer: libFuzzer_media_vpx_video_decoder_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  media_vpx_video_decoder_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=430909:430924
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=574418:574425

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5948370842288128

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Jul 12

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5948370842288128 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 8 by bugdroid1@chromium.org, Jul 16

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5a1e739c05aeb47d7fd9d053f5d047688e11c0c9

commit 5a1e739c05aeb47d7fd9d053f5d047688e11c0c9
Author: John Rummell <jrummell@chromium.org>
Date: Mon Jul 16 23:30:43 2018

Change type of |upload_pixels_| to improve performance

For  issue 817341 , fuzzer tests were taking a long time due to calls to
std::vector<uint8_t>::resize(), as it initializes each element one by
one. Switching to std::unique_ptr<uint8_t[]> speed things up, as the
elements are not initialized. As VideoResourceUpdater allocates a
temporary buffer to hold a video frame, it could also benefit from the
improved execution time.

BUG= 817341 
TEST=media_unittests pass

Change-Id: I63c1afce3eb6b654c8863a555642ee3e05c1c883
Reviewed-on: https://chromium-review.googlesource.com/1137063
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Commit-Queue: John Rummell <jrummell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#575479}
[modify] https://crrev.com/5a1e739c05aeb47d7fd9d053f5d047688e11c0c9/media/renderers/video_resource_updater.cc
[modify] https://crrev.com/5a1e739c05aeb47d7fd9d053f5d047688e11c0c9/media/renderers/video_resource_updater.h

Sign in to add a comment