New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 901661 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Nov 13
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in rtc::webrtc_checks_impl::FatalLog

Project Member Reported by ClusterFuzz, Nov 4

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5141147490713600

Fuzzer: libFuzzer_audio_processing_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x0539000aee79
Crash State:
  rtc::webrtc_checks_impl::FatalLog
  CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType::
  CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType::
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=604781:604784

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5141147490713600

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 4

Cc: kwiberg@webrtc.org mflodman@webrtc.org henrika@webrtc.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Cc: kkaluri@chromium.org
Components: Blink>WebRTC
Labels: M-72 Test-Predator-Wrong
Owner: jonasolsson@chromium.org
Status: Assigned (was: Untriaged)
With reference to the  Issue 898373 , assigning it to jonasolsson@ for further triage.
Cc: aleloi@chromium.org
This is the failing check:
RTC_DCHECK_LT(vad_data.speech_peak_dbfs, 50.f);

And here's the message:
Check failed: vad_data.speech_peak_dbfs < 50.f (50 vs. 50)

@aleloi: Were we supposed to use RTC_DCHECK_LE here? If so, are we completely sure that we won't ever get 50.000003814697265625 or something? Would it make sense to have this check in the LevelAndProbability constructor instead, or is this restriction specific to AdaptiveModeLevelEstimator::UpdateEstimation?

I think this happens because the fuzzer makes APM apply a huge gain to the signal. Then the greatly amplified signal is processed by the AGC, which has to work way outside it's normal operating range. I can either
* forbid configuring APM with both AGC and huge gain (inside the APM)
* the same, but inside the fuzzer.

I'll fix in in the next few days.
Owner: aleloi@chromium.org
Sounds good, I'm reassigning this to you then.
Project Member

Comment 6 by bugdroid1@chromium.org, Nov 12

The following revision refers to this bug:
  https://webrtc.googlesource.com/src.git/+/20f60f0dc61998244ab38834f48f0319adaacec2

commit 20f60f0dc61998244ab38834f48f0319adaacec2
Author: Alex Loiko <aleloi@webrtc.org>
Date: Mon Nov 12 12:16:47 2018

Fuzzer crash in AGC2.

Gain specified by fuzzer in APM config was too high.

Bug:  chromium:901661 
Change-Id: Id3ea8d23a4284a35c827bb16125902d84e37ca1e
Reviewed-on: https://webrtc-review.googlesource.com/c/110604
Commit-Queue: Alex Loiko <aleloi@webrtc.org>
Reviewed-by: Jonas Olsson <jonasolsson@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#25594}
[modify] https://crrev.com/20f60f0dc61998244ab38834f48f0319adaacec2/modules/audio_processing/gain_controller2.cc
[modify] https://crrev.com/20f60f0dc61998244ab38834f48f0319adaacec2/modules/audio_processing/gain_controller2_unittest.cc
[modify] https://crrev.com/20f60f0dc61998244ab38834f48f0319adaacec2/test/fuzzers/audio_processing_configs_fuzzer.cc

Status: Fixed (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Nov 13

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/047254142c539d0a157ddc11c42ce1a9180fcb97

commit 047254142c539d0a157ddc11c42ce1a9180fcb97
Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Date: Tue Nov 13 17:55:05 2018

Roll src/third_party/webrtc e769ed90c359..44ca9a392ac6 (75 commits)

https://webrtc.googlesource.com/src.git/+log/e769ed90c359..44ca9a392ac6


git log e769ed90c359..44ca9a392ac6 --date=short --no-merges --format='%ad %ae %s'
2018-11-13 mbonadei@webrtc.org Allow usage of stringstream under examples/.
2018-11-13 kwiberg@webrtc.org Remove some unused RentACodec static methods
2018-11-13 peah@webrtc.org AEC3: Corrected erroneous if-statement that always returned true
2018-11-13 nisse@webrtc.org Add missing include of unistd.h
2018-11-13 nisse@webrtc.org Delete deprecated class WrappedI420Buffer
2018-11-13 mbonadei@webrtc.org Configs to run slow_tests.
2018-11-13 nisse@webrtc.org Delete obsolete interface class RtpData
2018-11-13 srte@webrtc.org Adds setup of RTP Extensions in Scenario tests.
2018-11-13 asapersson@webrtc.org Add tests for cpu overuse scaling.
2018-11-12 ouj@fb.com Adding rtcp report interval into RTCConfiguration.
2018-11-12 ouj@fb.com Explicitly retain self in objc blocks to avoid compiler warning.
2018-11-12 srte@webrtc.org Allows change of fake encoder max rate in scenarios tests.
2018-11-12 srte@webrtc.org Add support for screenshare content type in scenario tests.
2018-11-12 srte@webrtc.org Simplifies audio priority rate config in scenario tests.
2018-11-12 eladalon@webrtc.org Remove obsolete comment (WebRtcSessionDescriptionFactory ctor)
2018-11-12 srte@webrtc.org Using early acknowledged rate for safe reset in GoogCC.
2018-11-12 ilnik@webrtc.org In RTP to NTP estimator use linear regression instead of ad hoc filter
2018-11-12 eladalon@webrtc.org Event log - Use ToUnsigned() and ToSigned() on timestamp_ms
2018-11-12 eladalon@webrtc.org Event logs - encode N channels as N-1
2018-11-12 kwiberg@webrtc.org AudioCodingModule: Remove support for creating encoders
2018-11-12 nisse@webrtc.org Tweak ChannelReceive interface, to make it closer to ChannelReceiveProxy
2018-11-12 nisse@webrtc.org Eliminate use of EventWrapper from android audio device tests
2018-11-12 eladalon@webrtc.org Add RtcEvent::timestamp_ms()
2018-11-12 kron@webrtc.org Add offer_extmap_allow_mixed to RTCConfiguration
2018-11-12 danilchap@webrtc.org Revert "Run robolectric tests for Android on several Android API versions"
2018-11-12 aleloi@webrtc.org Fuzzer crash in AGC2.
2018-11-12 jonasolsson@webrtc.org Remove most of api/ortc/.
2018-11-12 kron@webrtc.org Fix overflow for high bitrates in BitrateProber
2018-11-12 yvesg@google.com Revert "Roll "Enable SSE, SSE2, and run-time detected SSE4.1 for libopus.""
2018-11-10 eladalon@webrtc.org Hide RtcEvent members behind accessors
2018-11-10 eladalon@webrtc.org Event logs - separate audio_level and voice_activity
2018-11-09 yvesg@webrtc.org Roll "Enable SSE, SSE2, and run-time detected SSE4.1 for libopus."
2018-11-09 eladalon@webrtc.org Rename fields in rtc_event_log2.proto
2018-11-09 mellem@webrtc.org Fix up an outdated comment in peerconnection_integrationtest.cc.
2018-11-09 Peter) Slatala Signal Network route change in fake ice.
2018-11-09 eladalon@webrtc.org Use delta-encoding in new WebRTC event logs
2018-11-09 phoglund@webrtc.org Clean up root OWNERS.
2018-11-09 artit@webrtc.org Run robolectric tests for Android on several Android API versions
2018-11-09 kron@webrtc.org Pass HdrMetadata between VideoFrame and EncodedImage for VP9
2018-11-09 terelius@webrtc.org Add support for audio in latency visualization.
2018-11-09 jonasolsson@webrtc.org Fix flaky JsepTransportControllerTests.
2018-11-09 kron@webrtc.org Add RTP header extension for HDR metadata
2018-11-09 ilnik@webrtc.org In RTP to NTP estimator do not allow huge jumps in NTP timestamps
2018-11-09 yvesg@webrtc.org Reintroduce missing dependencies in libwebrtc.a library.
2018-11-09 mellem@webrtc.org Implement data channels over media transport.
2018-11-08 ouj@fb.com Reland "Use the factory instead of using the builtin code path in `VideoCodecInitializer`"
2018-11-08 yvesg@webrtc.org [Win/boringSSL] Add nasm as part of required dependencies.
2018-11-08 Peter) Slatala Callback changes to media transport interface:
2018-11-08 Peter) Slatala Add owners for media_transport_interface
2018-11-08 sprang@webrtc.org Add ability to specify if rate controller of video encoder is trusted.
2018-11-08 sprang@webrtc.org In Android encoders, cache EncoderInfo in InitEncode.
2018-11-08 nisse@webrtc.org Delete rtc::Filesystem. Move needed functions to filerotatingstream.cc.
2018-11-08 nisse@webrtc.org Eliminate use of EventWrapper from mac audio device
2018-11-08 sprang@webrtc.org Add magjed/nisse/sprang/brandtr as api/video_codecs owners
2018-11-08 danilchap@webrtc.org Introduce RtpPacket::GetExtension accessor that return result
2018-11-08 yujo@chromium.org Split a separate codecs target off of :video_jni
2018-11-08 nisse@webrtc.org Eliminate use of EventWrapper from ios audio device tests
2018-11-08 alessiob@webrtc.org Tolerate optional chunks in WAV files
2018-11-08 saza@webrtc.org Add flag for fast jitter buffer playout in neteq simulation
2018-11-08 alessiob@webrtc.org MsanUninitialized: restric type check to msan case.
2018-11-08 nisse@webrtc.org Delete classes EventFactory and EventFactoryImpl.
2018-11-08 oprypin@webrtc.org Make the bitrate_allocator param optional to prepare for its removal
2018-11-08 nisse@webrtc.org Reenable test RampUpTest.AudioTransportSequenceNumber
2018-11-08 kwiberg@webrtc.org Add a style rule about not using const optional<T>& arguments
2018-11-08 saza@webrtc.org Add missing conditional defines to neteq test and tools targets
2018-11-08 nisse@webrtc.org Deprecate EventFactory and delete all usage.
2018-11-07 sprang@webrtc.org Update H264 encoder to use GetEncoderInfo
2018-11-07 sprang@webrtc.org Update LibVpxVp8Encoder to use GetEncoderInfo
2018-11-07 sprang@webrtc.org Update VP9 encoder to use GetEncoderInfo
2018-11-07 orphis@webrtc.org Remove multiple RTX codec entries in GetRtpReceiver/SenderCapabilities
2018-11-07 sprang@webrtc.org Update SimulcastEncoderAdapter merging of EncoderInfo
2018-11-07 ilnik@webrtc.org Clear FrameBuffer if there were no frames received for 10 minutes
2018-11-07 alessiob@webrtc.org Reland "Isolating APM API build target: making :api an actual target."
2018-11-07 brandtr@webrtc.org Add field trial for target bitrate RTCP XR message.
2018-11-07 nisse@webrtc.org Delete NullEventFactory


Created with:
  gclient setdep -r src/third_party/webrtc@44ca9a392ac6

The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.

CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng

BUG=chromium:None,chromium:none,chromium:None,chromium:901661,chromium:None,chromium:None,chromium:None,chromium:766721,chromium:None,chromium:None,chromium:None,chromium:none,chromium:None
TBR=webrtc-chromium-sheriffs-robots@google.com

Change-Id: I80b2d4e7908e09e4b4b99e592eca5879ce252ca2
Reviewed-on: https://chromium-review.googlesource.com/c/1333849
Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#607647}
[modify] https://crrev.com/047254142c539d0a157ddc11c42ce1a9180fcb97/DEPS

Project Member

Comment 9 by ClusterFuzz, Nov 14

ClusterFuzz has detected this issue as fixed in range 607638:607647.

Detailed report: https://clusterfuzz.com/testcase?key=5141147490713600

Fuzzer: libFuzzer_audio_processing_fuzzer
Job Type: libfuzzer_chrome_asan_debug
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x0539000aee79
Crash State:
  rtc::webrtc_checks_impl::FatalLog
  CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType::
  CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType::
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=604781:604784
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=607638:607647

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5141147490713600

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Nov 14

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5141147490713600 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment