204248 2019-11-15 14:11:59 -0800 CRASH in SourceBuffer::removeCodedFrames() 2019-11-18 09:25:46 -0800 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jer.noble jer.noble calvaris commit-queue darin ddkilzer eric.carlson ews-watchlist glenn philipj sergio webkit-bug-importer oldest_to_newest 1590657 0 jer.noble 2019-11-15 14:11:59 -0800 CRASH in SourceBuffer::removeCodedFrames() 1590658 1 jer.noble 2019-11-15 14:12:35 -0800 rdar://problem/57168384 1590665 2 383651 jer.noble 2019-11-15 14:28:14 -0800 Created attachment 383651 Patch 1590729 3 383651 commit-queue 2019-11-15 16:05:08 -0800 Comment on attachment 383651 Patch Clearing flags on attachment: 383651 Committed r252511: <https://trac.webkit.org/changeset/252511> 1590730 4 commit-queue 2019-11-15 16:05:10 -0800 All reviewed patches have been landed. Closing bug. 1590740 5 383651 ddkilzer 2019-11-15 16:28:06 -0800 Comment on attachment 383651 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=383651&action=review r=me > Source/WebCore/Modules/mediasource/SourceBuffer.cpp:805 > + if (start >= end) Wasn’t there a second place where this check could be added that was missing it? 1590741 6 ddkilzer 2019-11-15 16:30:43 -0800 (In reply to David Kilzer (:ddkilzer) from comment #5) > Comment on attachment 383651 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=383651&action=review > > r=me Oops, didn’t see this landed already. 1590815 7 jer.noble 2019-11-15 19:55:49 -0800 (In reply to David Kilzer (:ddkilzer) from comment #5) > Comment on attachment 383651 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=383651&action=review > > r=me > > > Source/WebCore/Modules/mediasource/SourceBuffer.cpp:805 > > + if (start >= end) > > Wasn’t there a second place where this check could be added that was missing > it? All those places are upstream of here. IOW, a check here checks every call site. 1591082 8 383651 darin 2019-11-18 09:25:46 -0800 Comment on attachment 383651 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=383651&action=review > Source/WebCore/ChangeLog:10 > + Speculative fix for rare crash. It's possible that the startTime and endTime inputs to > + removeCodedFrames() are out-of-order, which could lead to iterating off the end of the > + SampleMap. Verify that startTime < endTime and bail out early if not true. If it’s possible, then why are we asserting it’s not true? 383651 2019-11-15 14:28:14 -0800 2019-11-15 16:30:05 -0800 Patch bug-204248-20191115142814.patch text/plain 1728 jer.noble U3VidmVyc2lvbiBSZXZpc2lvbjogMjUyNDMwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNWYxZjMwMmJiNjJmNjA0 MmYxN2M0M2JiZGIyZjFlZmM4MzMxMTM4OS4uYmJlYmE4MGFjMzhjODc4MTNjYzYxMzJiOGEzMTNh YmY1YzI5MmFjYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE5LTExLTE1ICBKZXIg Tm9ibGUgIDxqZXIubm9ibGVAYXBwbGUuY29tPgorCisgICAgICAgIENSQVNIIGluIFNvdXJjZUJ1 ZmZlcjo6cmVtb3ZlQ29kZWRGcmFtZXMoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MjA0MjQ4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgU3BlY3VsYXRpdmUgZml4IGZvciByYXJlIGNyYXNoLiBJdCdzIHBv c3NpYmxlIHRoYXQgdGhlIHN0YXJ0VGltZSBhbmQgZW5kVGltZSBpbnB1dHMgdG8KKyAgICAgICAg cmVtb3ZlQ29kZWRGcmFtZXMoKSBhcmUgb3V0LW9mLW9yZGVyLCB3aGljaCBjb3VsZCBsZWFkIHRv IGl0ZXJhdGluZyBvZmYgdGhlIGVuZCBvZiB0aGUKKyAgICAgICAgU2FtcGxlTWFwLiBWZXJpZnkg dGhhdCBzdGFydFRpbWUgPCBlbmRUaW1lIGFuZCBiYWlsIG91dCBlYXJseSBpZiBub3QgdHJ1ZS4K KworICAgICAgICAqIE1vZHVsZXMvbWVkaWFzb3VyY2UvU291cmNlQnVmZmVyLmNwcDoKKyAgICAg ICAgKFdlYkNvcmU6OlNvdXJjZUJ1ZmZlcjo6cmVtb3ZlQ29kZWRGcmFtZXMpOgorCiAyMDE5LTEx LTE1ICBKZXIgTm9ibGUgIDxqZXIubm9ibGVAYXBwbGUuY29tPgogCiAgICAgICAgIFJFR1JFU1NJ T04ocjI1MTg5NSkgLSAnc2luZicgaW5pdCBkYXRhIGZsb3cgZ2VuZXJhdGVzICdjZW5jJyBzdHls ZSBlbmNyeXB0ZWQgbWVzc2FnZXMKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMv bWVkaWFzb3VyY2UvU291cmNlQnVmZmVyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvbWVk aWFzb3VyY2UvU291cmNlQnVmZmVyLmNwcAppbmRleCA5ZTI4N2U1ZWY3NjYxYmQ0NjUwZmIwOTll NWM1ZjRkZjc5NGJhZjQ3Li4wN2ZiMGRlM2Y5ZmJjM2RiMGFkODk3Njc5NTY0NmU4MTM3N2VhNGQ1 IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL21lZGlhc291cmNlL1NvdXJjZUJ1 ZmZlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvTW9kdWxlcy9tZWRpYXNvdXJjZS9Tb3VyY2VC dWZmZXIuY3BwCkBAIC04MDEsNiArODAxLDEwIEBAIHZvaWQgU291cmNlQnVmZmVyOjpyZW1vdmVD b2RlZEZyYW1lcyhjb25zdCBNZWRpYVRpbWUmIHN0YXJ0LCBjb25zdCBNZWRpYVRpbWUmIGVuCiB7 CiAgICAgREVCVUdfTE9HKExPR0lERU5USUZJRVIsICJzdGFydCA9ICIsIHN0YXJ0LCAiLCBlbmQg PSAiLCBlbmQpOwogCisgICAgQVNTRVJUKHN0YXJ0IDwgZW5kKTsKKyAgICBpZiAoc3RhcnQgPj0g ZW5kKQorICAgICAgICByZXR1cm47CisKICAgICAvLyAzLjUuOSBDb2RlZCBGcmFtZSBSZW1vdmFs IEFsZ29yaXRobQogICAgIC8vIGh0dHBzOi8vZHZjcy53My5vcmcvaGcvaHRtbC1tZWRpYS9yYXct ZmlsZS90aXAvbWVkaWEtc291cmNlL21lZGlhLXNvdXJjZS5odG1sI3NvdXJjZWJ1ZmZlci1jb2Rl ZC1mcmFtZS1yZW1vdmFsCiAK