New issue
Advanced search Search tips

Issue 906373 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 3
Type: Bug

Blocked on:
issue 907268



Sign in to add a comment

Timeout in mediasource_MP4_OPUS_pipeline_integration_fuzzer

Project Member Reported by ClusterFuzz, Nov 17

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5495402156261376

Fuzzer: libFuzzer_mediasource_MP4_OPUS_pipeline_integration_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  mediasource_MP4_OPUS_pipeline_integration_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=585717:585726

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5495402156261376

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Nov 17

Cc: xhw...@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Components: Internals>Media
Owner: wolenetz@chromium.org
Status: Assigned (was: Untriaged)
Labels: -Pri-1 Pri-3
Project Member

Comment 4 by ClusterFuzz, Nov 20

Labels: OS-Mac
Components: -Internals>Media Internals>Media>Source
I have a local repro: 57 seconds local execution time for the repro case. Investigating.
This looks less like an MP4-specific issue. Rather it is the poor performance of media::SourceBufferStream<media::SourceBufferRangeByPts>::Append when performed on every single audio frame.

tl;dr: this looks like behavior that the eventual CL ala https://chromium-review.googlesource.com/c/chromium/src/+/1232485 should fix.

related to part of bug 879970
Data backing up #6: profile of part of a repro run indicates that, out of overall sample time:
~83% of time spent in MP4StreamParser::Parse,
~62% of time spent in FrameProcessor::ProcessFrames,
~30% of time spent in FrameProcessor::FlushProcessedFrames.

(Parse involves running ProcessFrames, which runs FlushProcessFrames).

Also, rerun of the fuzzer case locally with:

Just the ByDts part enabled: 22 seconds
Just the ByPts part enabled: 35 seconds

--> ByPts audio buffering perf (along with, perhaps, MP4 atom count) is culprit behind this issue
Cc: sande...@chromium.org
In addition to fixing the ByPts audio buffering perf, maybe we should also tighten the sanity checks on number of empty (sample_size = 0 in trun) samples in the track_run_iterator code. Currently, we only check roughly that the sample_count * metadata-per-sample storage footprint doesn't exceed the 'demuxer memory limit'.

cc+sandersd@ for this part.
w.r.t. chat w/Dan on #9, perhaps "we should ban sample size zero if that's not happening in the wild much" --> we should instrument our demuxers (both SRC= and MSE) to see if this happens in the wild much before arbitrarily choosing some cap on number of empty samples in a trun.
Blockedon: 907268
(@#10, See bug 907268, focused on just the MSE MP4 case which the fuzzer keeps hitting...)
Project Member

Comment 13 by ClusterFuzz, Dec 1

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 5495402156261376 appears to be flaky, updating reproducibility label.
Labels: -Unreproducible Reproducible
Please ignore the last comment about testcase being unreproducible. The testcase is still reproducible. This happened due to a code refactoring on ClusterFuzz side, and the underlying root cause is now fixed. Resetting the label back to Reproducible. Sorry about the inconvenience caused from these incorrect notifications.
Project Member

Comment 15 by ClusterFuzz, Dec 16

Labels: OS-Chrome
Project Member

Comment 16 by ClusterFuzz, Dec 22

Labels: OS-Windows

Sign in to add a comment