New issue
Advanced search Search tips

Issue 826580 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in media::DecoderStream<

Project Member Reported by ClusterFuzz, Mar 28 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5652529225138176

Fuzzer: inferno_flicker
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 8
Crash Address: 0x7b040000fa30
Crash State:
  media::DecoderStream<
  media::DecoderStream<
  media::VideoRendererImpl::Flush
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=545933:545973

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5652529225138176

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 28 2018

Components: Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 28 2018

Labels: Test-Predator-Auto-Owner
Owner: dalecur...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/00eda06906b09bb0b001207e29ed8ebb8c0e03e1 (Attempt to parallelize offloaded video decoding again...).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Fix here I think, https://chromium-review.googlesource.com/#/c/chromium/src/+/983005

Will double check it Thursday.
Cc: xhw...@chromium.org
I'm actually not sure a double reset like this is valid. Seems there should be a decode call in between...
Project Member

Comment 6 by bugdroid1@chromium.org, Mar 28 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e2a63b0ee92086fe2592b743e5c36ff47775ffe9

commit e2a63b0ee92086fe2592b743e5c36ff47775ffe9
Author: Dale Curtis <dalecurtis@chromium.org>
Date: Wed Mar 28 05:24:14 2018

Wait for ResetCB to complete when offloading.

Without this it's possible for the caller to issue back to back
Reset() calls which might call Cancel() on the AtomicFlag while
it's being recreated on the offloading thread.

BUG= 826580 
TEST=tbd

Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: I58b960c2ff567c7213dcde4701e5281262024c28
Reviewed-on: https://chromium-review.googlesource.com/983005
Reviewed-by: Xiaohan Wang <xhwang@chromium.org>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#546414}
[modify] https://crrev.com/e2a63b0ee92086fe2592b743e5c36ff47775ffe9/media/filters/offloading_video_decoder.cc

Project Member

Comment 7 by ClusterFuzz, Mar 28 2018

ClusterFuzz has detected this issue as fixed in range 546413:546415.

Detailed report: https://clusterfuzz.com/testcase?key=5652529225138176

Fuzzer: inferno_flicker
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 8
Crash Address: 0x7b040000fa30
Crash State:
  media::DecoderStream<
  media::DecoderStream<
  media::VideoRendererImpl::Flush
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=545933:545973
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=546413:546415

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5652529225138176

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Mar 28 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5652529225138176 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment