Open
Bug 1772647
Opened 2 years ago
Updated 2 years ago
dom/media/platforms/wrappers/MediaChangeMonitor.cpp:177:44: runtime error: inf is outside the range of representable values of type 'int'
Categories
(Core :: Audio/Video, defect, P3)
Core
Audio/Video
Tracking
()
NEW
Tracking | Status | |
---|---|---|
firefox103 | --- | affected |
People
(Reporter: tsmith, Assigned: jhlin)
References
(Blocks 1 open bug)
Details
(Keywords: csectype-undefined)
This was found by enabling the float-cast-overflow
check in UBSan and running existing tests. This type of issue can create inconsistencies across platforms, architectures and optimization levels.
Found with m-c 20220603-68727ef04ccf
To enable this check add the following to your mozconfig:
ac_add_options --enable-undefined-sanitizer="float-cast-overflow"
This issue is found by the existing test: dom/media/test/crashtests/track-with-zero-dimensions.mp4`
/builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:177:44: runtime error: inf is outside the range of representable values of type 'int'
#0 0x7faf38076a50 in ApplyPixelAspectRatio /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:177:44
#1 0x7faf38076a50 in mozilla::VPXChangeMonitor::CheckForChange(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:270:11
#2 0x7faf3806c5c8 in mozilla::MediaChangeMonitor::CreateDecoderAndInit(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:715:36
#3 0x7faf3806b51e in mozilla::MediaChangeMonitor::CheckForChange(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:827:12
#4 0x7faf3806ac38 in mozilla::MediaChangeMonitor::Decode(mozilla::MediaRawData*) /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaChangeMonitor.cpp:538:20
#5 0x7faf3808a3e8 in operator() /builds/worker/checkouts/gecko/dom/media/platforms/wrappers/MediaDataDecoderProxy.cpp:31:33
#6 0x7faf3808a3e8 in mozilla::detail::ProxyFunctionRunnable<mozilla::MediaDataDecoderProxy::Decode(mozilla::MediaRawData*)::$_18, mozilla::MozPromise<nsTArray<RefPtr<mozilla::MediaData> >, mozilla::MediaResult, true> >::Run() /builds/worker/workspace/obj-build/dist/include/mozilla/MozPromise.h:1645:29
#7 0x7faf31e3f116 in mozilla::TaskQueue::Runner::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskQueue.cpp:259:20
#8 0x7faf31e69a32 in nsThreadPool::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadPool.cpp:310:14
#9 0x7faf31e5c2be in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1174:16
#10 0x7faf31e65f44 in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#11 0x7faf33448d48 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#12 0x7faf332e57d1 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:380:10
#13 0x7faf332e57d1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:373:3
#14 0x7faf332e57d1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:355:3
#15 0x7faf31e53877 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:378:10
#16 0x7faf59374cde in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#17 0x7faf590ab6da in start_thread /tmp/glibc/nptl/pthread_create.c:463
#18 0x7faf58089a3e in __clone /tmp/glibc/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Reporter | ||
Comment 1•2 years ago
•
|
||
This issue is currently triggered while running existing tests with the 'float-cast-overflow' UBSan check enabled. This issue will need to be addressed before the check can be enabled by default.
If it requires too much effort to fix immediately please ni?
me and let me know. If necessary it will be added to a suppression list. Thank you :)
Flags: needinfo?(jmathies)
![]() |
||
Updated•2 years ago
|
Blocks: media-triage
Flags: needinfo?(jmathies)
![]() |
||
Updated•2 years ago
|
Flags: needinfo?(jolin)
![]() |
||
Updated•2 years ago
|
No longer blocks: media-triage
Assignee | ||
Updated•2 years ago
|
Assignee: nobody → jolin
Flags: needinfo?(jolin)
Updated•2 years ago
|
Severity: -- → S3
Priority: -- → P3
You need to log in
before you can comment on or make changes to this bug.
Description
•