Closed
Bug 1587164
Opened 5 years ago
Closed 5 years ago
undefined shift in media/webrtc/trunk/webrtc/rtc_base/timeutils.cc:142
Categories
(Core :: WebRTC, defect, P3)
Core
WebRTC
Tracking
()
RESOLVED
FIXED
mozilla71
Tracking | Status | |
---|---|---|
firefox71 | --- | fixed |
People
(Reporter: tsmith, Assigned: dminor)
References
(Blocks 1 open bug)
Details
(Keywords: csectype-undefined)
Attachments
(1 file)
(deleted),
text/x-phabricator-request
|
Details |
This is triggered with an UBSan build. To enable this check add the following to your mozconfig:
ac_add_options --enable-address-sanitizer
ac_add_options --enable-undefined-sanitizer="shift"
ac_add_options --disable-jemalloc
Found via test-linux64-asan/opt-web-platform-tests-e10s-16
src/media/webrtc/trunk/webrtc/rtc_base/timeutils.cc:142:34: runtime error: left shift of negative value -1
#0 0x7fea22a83546 in rtc::TimestampWrapAroundHandler::Unwrap(unsigned int) src/media/webrtc/trunk/webrtc/rtc_base/timeutils.cc
#1 0x7fea22b1482d in webrtc::voe::Channel::GetAudioFrameWithInfo(int, webrtc::AudioFrame*) src/media/webrtc/trunk/webrtc/voice_engine/channel.cc:823:37
#2 0x7fea1ac54379 in mozilla::WebrtcAudioConduit::GetAudioFrame(short*, int, int, int&) src/media/webrtc/signaling/src/media-conduit/AudioConduit.cpp:616:22
#3 0x7fea1acd184e in mozilla::MediaPipelineReceiveAudio::PipelineListener::NotifyPullImpl(long) src/media/webrtc/signaling/src/mediapipeline/MediaPipeline.cpp:1332:17
#4 0x7fea1e9ec1d8 in mozilla::SourceMediaTrack::PullNewData(long) src/dom/media/MediaTrackGraph.cpp:2347:8
#5 0x7fea1e9eb168 in mozilla::MediaTrackGraphImpl::UpdateGraph(long) src/dom/media/MediaTrackGraph.cpp:1095:34
#6 0x7fea1e9ee55b in mozilla::MediaTrackGraphImpl::OneIterationImpl(long) src/dom/media/MediaTrackGraph.cpp:1304:3
#7 0x7fea1e772660 in mozilla::AudioCallbackDriver::DataCallback(float const*, float*, long) src/dom/media/GraphDriver.cpp:882:36
#8 0x7fea25203cff in _$LT$audioipc_client..stream..CallbackServer$u20$as$u20$audioipc..rpc..server..Server$GT$::process::_$u7b$$u7b$closure$u7d$$u7d$::ha43956b0eea91cf4 src/media/audioipc/client/src/stream.rs:113:24
#9 0x7fea25203cff in futures::future::lazy::Lazy$LT$F$C$R$GT$::get::h07d3c7d5fa23492d src/third_party/rust/futures/src/future/lazy.rs:64
#10 0x7fea25203cff in _$LT$futures..future..lazy..Lazy$LT$F$C$R$GT$$u20$as$u20$futures..future..Future$GT$::poll::h04c8f2a4b37c4cc4 src/third_party/rust/futures/src/future/lazy.rs:82
#11 0x7fea25203cff in futures::future::catch_unwind::_$LT$impl$u20$futures..future..Future$u20$for$u20$std..panic..AssertUnwindSafe$LT$F$GT$$GT$::poll::hbc95ddcc43778203 src/third_party/rust/futures/src/future/catch_unwind.rs:49
#12 0x7fea25203cff in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::_$u7b$$u7b$closure$u7d$$u7d$::h88fae40ae17fead0 src/third_party/rust/futures/src/future/catch_unwind.rs:32
#13 0x7fea25203cff in std::panicking::try::do_call::hb53a138c07811070 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
#14 0x7fea25203cff in __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29
#15 0x7fea25203cff in std::panicking::try::haf1bcccc99281b03 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:275
#16 0x7fea25203cff in std::panic::catch_unwind::h4869e15ba6994726 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:394
#17 0x7fea25203cff in _$LT$futures..future..catch_unwind..CatchUnwind$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::ha72049ee68bd070c src/third_party/rust/futures/src/future/catch_unwind.rs:32
#18 0x7fea25203cff in _$LT$futures_cpupool..MySender$LT$F$C$core..result..Result$LT$$LT$F$u20$as$u20$futures..future..Future$GT$..Item$C$$LT$F$u20$as$u20$futures..future..Future$GT$..Error$GT$$GT$$u20$as$u20$futures..future..Future$GT$::poll::h792cf0333f3aa894 src/third_party/rust/futures-cpupool/src/lib.rs:325
#19 0x7fea2521eb52 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$futures..future..Future$GT$::poll::h54ddf78dbcbbe5d7 src/third_party/rust/futures/src/future/mod.rs:113:12
#20 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::poll_future_notify::_$u7b$$u7b$closure$u7d$$u7d$::h9087352d841f248c src/third_party/rust/futures/src/task_impl/mod.rs:289
#21 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::enter::_$u7b$$u7b$closure$u7d$$u7d$::hfb133f03c1046753 src/third_party/rust/futures/src/task_impl/mod.rs:363
#22 0x7fea2521eb52 in futures::task_impl::std::set::hb997ae7cc15a9b15 src/third_party/rust/futures/src/task_impl/std/mod.rs:78
#23 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::enter::h058bb783be7fc7a3 src/third_party/rust/futures/src/task_impl/mod.rs:363
#24 0x7fea2521eb52 in futures::task_impl::Spawn$LT$T$GT$::poll_future_notify::h74c95dca24aed8a8 src/third_party/rust/futures/src/task_impl/mod.rs:289
#25 0x7fea2521eb52 in futures::task_impl::std::Run::run::h1a0c4680ae006636 src/third_party/rust/futures/src/task_impl/std/mod.rs:450
#26 0x7fea2521eb52 in futures_cpupool::Inner::work::h4762dceb8410976a src/third_party/rust/futures-cpupool/src/lib.rs:257
#27 0x7fea2521eb52 in futures_cpupool::Builder::create::_$u7b$$u7b$closure$u7d$$u7d$::hce6c1b963e8c3ab1 src/third_party/rust/futures-cpupool/src/lib.rs:427
#28 0x7fea2521eb52 in std::sys_common::backtrace::__rust_begin_short_backtrace::hec0a26d17fbf8797 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/backtrace.rs:77
#29 0x7fea2521d8e9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::ha5c426bceccbf1ef /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:470:16
#30 0x7fea2521d8e9 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h46726cdf78664f0c /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:315
#31 0x7fea2521d8e9 in std::panicking::try::do_call::h96880815832064e4 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
#32 0x7fea2521d8e9 in __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29
#33 0x7fea2521d8e9 in std::panicking::try::h8eed1c6e8f11155c /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:275
#34 0x7fea2521d8e9 in std::panic::catch_unwind::hf5c1edfc475e6579 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:394
#35 0x7fea2521d8e9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hba604fe8945ffb73 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:469
#36 0x7fea2521d8e9 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h133f8224b7997b5a /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/ops/function.rs:231
#37 0x7fea258e26ed in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h42806b83647d4c79 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/liballoc/boxed.rs:746:8
#38 0x7fea258e4997 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h83c921c8e826dd1d /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/liballoc/boxed.rs:746:8
#39 0x7fea258e4997 in std::sys_common::thread::start_thread::h2613204ce513782e /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/thread.rs:13
#40 0x7fea258e4997 in std::sys::unix::thread::Thread::new::thread_start::h4570080769500bcd /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys/unix/thread.rs:79
#41 0x7fea3954d6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#42 0x7fea385d641c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
Reporter | ||
Updated•5 years ago
|
Component: WebRTC: Audio/Video → WebRTC
Updated•5 years ago
|
Priority: -- → P3
Assignee | ||
Updated•5 years ago
|
Assignee: nobody → dminor
Assignee | ||
Comment 1•5 years ago
|
||
The code for handling backwards wraps left shifts num_wrap_ - 1. If
num_wrap_ is zero, this results in a left shift of a negative value which
is undefined behaviour. This adds a check to avoid this shift if num_wrap_
is zero.
Pushed by dminor@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b37d1c262965 Avoid left shift of negative value in TimestampWrapAroundHandler; r=bwc
Comment 3•5 years ago
|
||
bugherder |
Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
Assignee | ||
Comment 4•4 years ago
|
||
Upstream bug: https://bugs.chromium.org/p/webrtc/issues/detail?id=11742
Upstream review: https://webrtc-review.googlesource.com/c/src/+/178441
You need to log in
before you can comment on or make changes to this bug.
Description
•