Open Bug 1772647 Opened 2 years ago Updated 2 years ago

dom/media/platforms/wrappers/MediaChangeMonitor.cpp:177:44: runtime error: inf is outside the range of representable values of type 'int'

Categories

(Core :: Audio/Video, defect, P3)

defect

Tracking

()

Tracking Status
firefox103 --- affected

People

(Reporter: tsmith, Assigned: jhlin)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-undefined)

This was found by enabling the float-cast-overflow check in UBSan and running existing tests. This type of issue can create inconsistencies across platforms, architectures and optimization levels.

Found with m-c 20220603-68727ef04ccf

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="float-cast-overflow"

This issue is found by the existing test: dom/media/test/crashtests/track-with-zero-dimensions.mp4`

/builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:177:44: runtime error: inf is outside the range of representable values of type 'int'
    #0 0x7faf38076a50 in ApplyPixelAspectRatio /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:177:44
    #1 0x7faf38076a50 in mozilla::VPXChangeMonitor::CheckForChange(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:270:11
    #2 0x7faf3806c5c8 in mozilla::MediaChangeMonitor::CreateDecoderAndInit(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:715:36
    #3 0x7faf3806b51e in mozilla::MediaChangeMonitor::CheckForChange(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:827:12
    #4 0x7faf3806ac38 in mozilla::MediaChangeMonitor::Decode(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:538:20
    #5 0x7faf3808a3e8 in operator() /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaDataDecoderProxy.cpp:31:33
    #6 0x7faf3808a3e8 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaDataDecoderProxy::Decode(mozilla::MediaRawData*)::$_18, mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> >::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1645:29
    #7 0x7faf31e3f116 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
    #8 0x7faf31e69a32 in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:310:14
    #9 0x7faf31e5c2be in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1174:16
    #10 0x7faf31e65f44 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
    #11 0x7faf33448d48 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
    #12 0x7faf332e57d1 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380:10
    #13 0x7faf332e57d1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373:3
    #14 0x7faf332e57d1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355:3
    #15 0x7faf31e53877 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:378:10
    #16 0x7faf59374cde in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #17 0x7faf590ab6da in start_thread /tmp/glibc/nptl/pthread_create.c:463
    #18 0x7faf58089a3e in __clone /tmp/glibc/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

This issue is currently triggered while running existing tests with the 'float-cast-overflow' UBSan check enabled. This issue will need to be addressed before the check can be enabled by default.

If it requires too much effort to fix immediately please ni? me and let me know. If necessary it will be added to a suppression list. Thank you :)

Flags: needinfo?(jmathies)
Blocks: media-triage
Flags: needinfo?(jmathies)
Flags: needinfo?(jolin)
No longer blocks: media-triage
Assignee: nobody → jolin
Flags: needinfo?(jolin)
Severity: -- → S3
Priority: -- → P3
You need to log in before you can comment on or make changes to this bug.