Abrt in rtc::webrtc_checks_impl::FatalLog |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5141147490713600 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x0539000aee79 Crash State: rtc::webrtc_checks_impl::FatalLog CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType:: CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType:: Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=604781:604784 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5141147490713600 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
,
Nov 5
With reference to the Issue 898373 , assigning it to jonasolsson@ for further triage.
,
Nov 5
This is the failing check: RTC_DCHECK_LT(vad_data.speech_peak_dbfs, 50.f); And here's the message: Check failed: vad_data.speech_peak_dbfs < 50.f (50 vs. 50) @aleloi: Were we supposed to use RTC_DCHECK_LE here? If so, are we completely sure that we won't ever get 50.000003814697265625 or something? Would it make sense to have this check in the LevelAndProbability constructor instead, or is this restriction specific to AdaptiveModeLevelEstimator::UpdateEstimation?
,
Nov 8
I think this happens because the fuzzer makes APM apply a huge gain to the signal. Then the greatly amplified signal is processed by the AGC, which has to work way outside it's normal operating range. I can either * forbid configuring APM with both AGC and huge gain (inside the APM) * the same, but inside the fuzzer. I'll fix in in the next few days.
,
Nov 8
Sounds good, I'm reassigning this to you then.
,
Nov 12
The following revision refers to this bug: https://webrtc.googlesource.com/src.git/+/20f60f0dc61998244ab38834f48f0319adaacec2 commit 20f60f0dc61998244ab38834f48f0319adaacec2 Author: Alex Loiko <aleloi@webrtc.org> Date: Mon Nov 12 12:16:47 2018 Fuzzer crash in AGC2. Gain specified by fuzzer in APM config was too high. Bug: chromium:901661 Change-Id: Id3ea8d23a4284a35c827bb16125902d84e37ca1e Reviewed-on: https://webrtc-review.googlesource.com/c/110604 Commit-Queue: Alex Loiko <aleloi@webrtc.org> Reviewed-by: Jonas Olsson <jonasolsson@webrtc.org> Cr-Commit-Position: refs/heads/master@{#25594} [modify] https://crrev.com/20f60f0dc61998244ab38834f48f0319adaacec2/modules/audio_processing/gain_controller2.cc [modify] https://crrev.com/20f60f0dc61998244ab38834f48f0319adaacec2/modules/audio_processing/gain_controller2_unittest.cc [modify] https://crrev.com/20f60f0dc61998244ab38834f48f0319adaacec2/test/fuzzers/audio_processing_configs_fuzzer.cc
,
Nov 13
,
Nov 13
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/047254142c539d0a157ddc11c42ce1a9180fcb97 commit 047254142c539d0a157ddc11c42ce1a9180fcb97 Author: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Date: Tue Nov 13 17:55:05 2018 Roll src/third_party/webrtc e769ed90c359..44ca9a392ac6 (75 commits) https://webrtc.googlesource.com/src.git/+log/e769ed90c359..44ca9a392ac6 git log e769ed90c359..44ca9a392ac6 --date=short --no-merges --format='%ad %ae %s' 2018-11-13 mbonadei@webrtc.org Allow usage of stringstream under examples/. 2018-11-13 kwiberg@webrtc.org Remove some unused RentACodec static methods 2018-11-13 peah@webrtc.org AEC3: Corrected erroneous if-statement that always returned true 2018-11-13 nisse@webrtc.org Add missing include of unistd.h 2018-11-13 nisse@webrtc.org Delete deprecated class WrappedI420Buffer 2018-11-13 mbonadei@webrtc.org Configs to run slow_tests. 2018-11-13 nisse@webrtc.org Delete obsolete interface class RtpData 2018-11-13 srte@webrtc.org Adds setup of RTP Extensions in Scenario tests. 2018-11-13 asapersson@webrtc.org Add tests for cpu overuse scaling. 2018-11-12 ouj@fb.com Adding rtcp report interval into RTCConfiguration. 2018-11-12 ouj@fb.com Explicitly retain self in objc blocks to avoid compiler warning. 2018-11-12 srte@webrtc.org Allows change of fake encoder max rate in scenarios tests. 2018-11-12 srte@webrtc.org Add support for screenshare content type in scenario tests. 2018-11-12 srte@webrtc.org Simplifies audio priority rate config in scenario tests. 2018-11-12 eladalon@webrtc.org Remove obsolete comment (WebRtcSessionDescriptionFactory ctor) 2018-11-12 srte@webrtc.org Using early acknowledged rate for safe reset in GoogCC. 2018-11-12 ilnik@webrtc.org In RTP to NTP estimator use linear regression instead of ad hoc filter 2018-11-12 eladalon@webrtc.org Event log - Use ToUnsigned() and ToSigned() on timestamp_ms 2018-11-12 eladalon@webrtc.org Event logs - encode N channels as N-1 2018-11-12 kwiberg@webrtc.org AudioCodingModule: Remove support for creating encoders 2018-11-12 nisse@webrtc.org Tweak ChannelReceive interface, to make it closer to ChannelReceiveProxy 2018-11-12 nisse@webrtc.org Eliminate use of EventWrapper from android audio device tests 2018-11-12 eladalon@webrtc.org Add RtcEvent::timestamp_ms() 2018-11-12 kron@webrtc.org Add offer_extmap_allow_mixed to RTCConfiguration 2018-11-12 danilchap@webrtc.org Revert "Run robolectric tests for Android on several Android API versions" 2018-11-12 aleloi@webrtc.org Fuzzer crash in AGC2. 2018-11-12 jonasolsson@webrtc.org Remove most of api/ortc/. 2018-11-12 kron@webrtc.org Fix overflow for high bitrates in BitrateProber 2018-11-12 yvesg@google.com Revert "Roll "Enable SSE, SSE2, and run-time detected SSE4.1 for libopus."" 2018-11-10 eladalon@webrtc.org Hide RtcEvent members behind accessors 2018-11-10 eladalon@webrtc.org Event logs - separate audio_level and voice_activity 2018-11-09 yvesg@webrtc.org Roll "Enable SSE, SSE2, and run-time detected SSE4.1 for libopus." 2018-11-09 eladalon@webrtc.org Rename fields in rtc_event_log2.proto 2018-11-09 mellem@webrtc.org Fix up an outdated comment in peerconnection_integrationtest.cc. 2018-11-09 Peter) Slatala Signal Network route change in fake ice. 2018-11-09 eladalon@webrtc.org Use delta-encoding in new WebRTC event logs 2018-11-09 phoglund@webrtc.org Clean up root OWNERS. 2018-11-09 artit@webrtc.org Run robolectric tests for Android on several Android API versions 2018-11-09 kron@webrtc.org Pass HdrMetadata between VideoFrame and EncodedImage for VP9 2018-11-09 terelius@webrtc.org Add support for audio in latency visualization. 2018-11-09 jonasolsson@webrtc.org Fix flaky JsepTransportControllerTests. 2018-11-09 kron@webrtc.org Add RTP header extension for HDR metadata 2018-11-09 ilnik@webrtc.org In RTP to NTP estimator do not allow huge jumps in NTP timestamps 2018-11-09 yvesg@webrtc.org Reintroduce missing dependencies in libwebrtc.a library. 2018-11-09 mellem@webrtc.org Implement data channels over media transport. 2018-11-08 ouj@fb.com Reland "Use the factory instead of using the builtin code path in `VideoCodecInitializer`" 2018-11-08 yvesg@webrtc.org [Win/boringSSL] Add nasm as part of required dependencies. 2018-11-08 Peter) Slatala Callback changes to media transport interface: 2018-11-08 Peter) Slatala Add owners for media_transport_interface 2018-11-08 sprang@webrtc.org Add ability to specify if rate controller of video encoder is trusted. 2018-11-08 sprang@webrtc.org In Android encoders, cache EncoderInfo in InitEncode. 2018-11-08 nisse@webrtc.org Delete rtc::Filesystem. Move needed functions to filerotatingstream.cc. 2018-11-08 nisse@webrtc.org Eliminate use of EventWrapper from mac audio device 2018-11-08 sprang@webrtc.org Add magjed/nisse/sprang/brandtr as api/video_codecs owners 2018-11-08 danilchap@webrtc.org Introduce RtpPacket::GetExtension accessor that return result 2018-11-08 yujo@chromium.org Split a separate codecs target off of :video_jni 2018-11-08 nisse@webrtc.org Eliminate use of EventWrapper from ios audio device tests 2018-11-08 alessiob@webrtc.org Tolerate optional chunks in WAV files 2018-11-08 saza@webrtc.org Add flag for fast jitter buffer playout in neteq simulation 2018-11-08 alessiob@webrtc.org MsanUninitialized: restric type check to msan case. 2018-11-08 nisse@webrtc.org Delete classes EventFactory and EventFactoryImpl. 2018-11-08 oprypin@webrtc.org Make the bitrate_allocator param optional to prepare for its removal 2018-11-08 nisse@webrtc.org Reenable test RampUpTest.AudioTransportSequenceNumber 2018-11-08 kwiberg@webrtc.org Add a style rule about not using const optional<T>& arguments 2018-11-08 saza@webrtc.org Add missing conditional defines to neteq test and tools targets 2018-11-08 nisse@webrtc.org Deprecate EventFactory and delete all usage. 2018-11-07 sprang@webrtc.org Update H264 encoder to use GetEncoderInfo 2018-11-07 sprang@webrtc.org Update LibVpxVp8Encoder to use GetEncoderInfo 2018-11-07 sprang@webrtc.org Update VP9 encoder to use GetEncoderInfo 2018-11-07 orphis@webrtc.org Remove multiple RTX codec entries in GetRtpReceiver/SenderCapabilities 2018-11-07 sprang@webrtc.org Update SimulcastEncoderAdapter merging of EncoderInfo 2018-11-07 ilnik@webrtc.org Clear FrameBuffer if there were no frames received for 10 minutes 2018-11-07 alessiob@webrtc.org Reland "Isolating APM API build target: making :api an actual target." 2018-11-07 brandtr@webrtc.org Add field trial for target bitrate RTCP XR message. 2018-11-07 nisse@webrtc.org Delete NullEventFactory Created with: gclient setdep -r src/third_party/webrtc@44ca9a392ac6 The AutoRoll server is located here: https://autoroll.skia.org/r/webrtc-chromium-autoroll Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_chromium_archive_rel_ng;luci.chromium.try:mac_chromium_archive_rel_ng BUG=chromium:None,chromium:none,chromium:None,chromium:901661,chromium:None,chromium:None,chromium:None,chromium:766721,chromium:None,chromium:None,chromium:None,chromium:none,chromium:None TBR=webrtc-chromium-sheriffs-robots@google.com Change-Id: I80b2d4e7908e09e4b4b99e592eca5879ce252ca2 Reviewed-on: https://chromium-review.googlesource.com/c/1333849 Reviewed-by: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#607647} [modify] https://crrev.com/047254142c539d0a157ddc11c42ce1a9180fcb97/DEPS
,
Nov 14
ClusterFuzz has detected this issue as fixed in range 607638:607647. Detailed report: https://clusterfuzz.com/testcase?key=5141147490713600 Fuzzer: libFuzzer_audio_processing_fuzzer Job Type: libfuzzer_chrome_asan_debug Platform Id: linux Crash Type: Abrt Crash Address: 0x0539000aee79 Crash State: rtc::webrtc_checks_impl::FatalLog CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType:: CallCheckOp<rtc::webrtc_checks_impl::Val<rtc::webrtc_checks_impl::CheckArgType:: Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=604781:604784 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan_debug&range=607638:607647 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5141147490713600 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 14
ClusterFuzz testcase 5141147490713600 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Nov 4Labels: ClusterFuzz-Auto-CC