To reproduce, host the attached SWF and other files on a web server (e.g. localhost) and load it like this:
http://localhost/PlayManifest.swf?file=avcC.mpd
The fault condition varies significantly by platform:
- On 64-bit Chrome OS, an OOM condition occurs.
- On 32-bit Windows, an OOM condition occurs.
- On 64-bit Windows, I believe there's a memory corruption condition. Here's some windbg evidence that a wild copy is going on:
000007fe`ed069230 ... mov r9, qword ptr [rdx+rcx-8] ds:ffffffff`82054037
And the following assembler does look like an unrolled memcpy() implementation -- it loads r9 and r10 repeatedly, interspersed with movnti instructions to do stores. There's even a bit of prefetchnta going on.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
