Timeout in media_vpx_video_decoder_fuzzer |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5948370842288128 Fuzzer: libFuzzer_media_vpx_video_decoder_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Timeout (exceeds 25 secs) Crash Address: Crash State: media_vpx_video_decoder_fuzzer Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=430909:430924 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5948370842288128 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Mar 14 2018
Passing this over to John from Media team.
,
Apr 12 2018
I'll try to look into this in the next release.
,
Jul 10
Able to recreate this locally. Noticed 2 problems: 1) The test is run twice, no idea why. The test does complete, it just takes 50 seconds (timeout is 25 seconds). Log below. 2) The data allocates a frame of 14026 x 14393, which results in a frame allocation of 1,224,695,839 bytes. Currently the code creates a std::vector<uint8_t> of size 0 and then resizes it to the required size, which takes 15 seconds. I'll try fixing this. Log (additional output with timestamps from vpx_video_decoder_fuzzertest.cc): /ssd/chrome/src/out/clusterfuzz_5948370842288128/media_vpx_video_decoder_fuzzer: Running 1 inputs 1 time(s) each. Running: /usr/local/google/home/jrummell/.clusterfuzz/cache/testcases/5948370842288128_testcase/fuzz-3 20:53:48.536 Enter 20:53:48.536 Calling Initialize() 20:53:48.537 OnInitDone() 20:53:48.537 Done Initialize() 20:53:48.537 Calling Decode() // takes 15 seconds, #2 above 20:54:04.071 OnDecodeComplete() 20:54:04.072 Done Decode() 20:54:04.072 Exit 20:54:15.440 Enter // no idea why this is called again (and after 11 seconds of ??) 20:54:15.440 Calling Initialize() 20:54:15.441 OnInitDone() 20:54:15.441 Done Initialize() 20:54:15.441 Calling Decode() // takes 15 seconds again, #2 above 20:54:31.004 OnDecodeComplete() 20:54:31.004 Done Decode() 20:54:31.004 Exit Executed /usr/local/google/home/jrummell/.clusterfuzz/cache/testcases/5948370842288128_testcase/fuzz-3 in 53147 ms
,
Jul 12
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/803005b59bef10b2d804a5827d626dcc9d10d906 commit 803005b59bef10b2d804a5827d626dcc9d10d906 Author: John Rummell <jrummell@chromium.org> Date: Thu Jul 12 00:09:27 2018 Improve FrameBuffer allocation time When allocating a large buffer (via the fuzzer tests), calling resize() on std::vector<uint8_t> took a long time. This changes the code to use a std::unique_ptr<uint8_t[]> so that allocating a large buffer is much cheaper. BUG= 817341 TEST=fuzzer test now runs in 535ms instead of timing out after 25 seconds Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel Change-Id: If3a57a325dfab4f15d43a71b935e18c2ce759715 Reviewed-on: https://chromium-review.googlesource.com/1133586 Commit-Queue: John Rummell <jrummell@chromium.org> Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Cr-Commit-Position: refs/heads/master@{#574422} [modify] https://crrev.com/803005b59bef10b2d804a5827d626dcc9d10d906/media/filters/frame_buffer_pool.cc
,
Jul 12
ClusterFuzz has detected this issue as fixed in range 574418:574425. Detailed report: https://clusterfuzz.com/testcase?key=5948370842288128 Fuzzer: libFuzzer_media_vpx_video_decoder_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Timeout (exceeds 25 secs) Crash Address: Crash State: media_vpx_video_decoder_fuzzer Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=430909:430924 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=574418:574425 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5948370842288128 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 12
ClusterFuzz testcase 5948370842288128 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jul 16
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5a1e739c05aeb47d7fd9d053f5d047688e11c0c9 commit 5a1e739c05aeb47d7fd9d053f5d047688e11c0c9 Author: John Rummell <jrummell@chromium.org> Date: Mon Jul 16 23:30:43 2018 Change type of |upload_pixels_| to improve performance For issue 817341 , fuzzer tests were taking a long time due to calls to std::vector<uint8_t>::resize(), as it initializes each element one by one. Switching to std::unique_ptr<uint8_t[]> speed things up, as the elements are not initialized. As VideoResourceUpdater allocates a temporary buffer to hold a video frame, it could also benefit from the improved execution time. BUG= 817341 TEST=media_unittests pass Change-Id: I63c1afce3eb6b654c8863a555642ee3e05c1c883 Reviewed-on: https://chromium-review.googlesource.com/1137063 Reviewed-by: Dale Curtis <dalecurtis@chromium.org> Commit-Queue: John Rummell <jrummell@chromium.org> Cr-Commit-Position: refs/heads/master@{#575479} [modify] https://crrev.com/5a1e739c05aeb47d7fd9d053f5d047688e11c0c9/media/renderers/video_resource_updater.cc [modify] https://crrev.com/5a1e739c05aeb47d7fd9d053f5d047688e11c0c9/media/renderers/video_resource_updater.h |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by brajkumar@chromium.org
, Mar 1 2018Components: Internals>Media>Video
Labels: -Pri-1 M-65 Test-Predator-Wrong Pri-2
Owner: mmoroz@chromium.org
Status: Assigned (was: Untriaged)