From cde790c36dbd437415e7fc971b5c1016a52b31f7 Mon Sep 17 00:00:00 2001
From: James Zern <jzern@google.com>
Date: Wed, 27 Aug 2014 16:29:34 -0700
Subject: [PATCH] vp9: fix crash in inline loopfilter w/corrupt file

attempting to decode a frame after the previous frame failed has the
potential of interrupting an earlier loop filter task

Change-Id: I6f2b1ddcdf5b89c3e2ee8caf5289dada2a087d66
---
 test/invalid_file_test.cc     | 1 +
 test/test-data.sha1           | 2 ++
 test/test.mk                  | 2 ++
 vp9/decoder/vp9_decodeframe.c | 2 ++
 4 files changed, 7 insertions(+)

diff --git a/test/invalid_file_test.cc b/test/invalid_file_test.cc
index fd55d91f2..8b18df670 100644
--- a/test/invalid_file_test.cc
+++ b/test/invalid_file_test.cc
@@ -146,6 +146,7 @@ const DecodeParam kMultiThreadedVP9InvalidFileTests[] = {
   {4, "invalid-vp90-2-08-tile_1x4_frame_parallel_all_key.webm"},
   {4, "invalid-"
       "vp90-2-08-tile_1x2_frame_parallel.webm.ivf.s47039_r01-05_b6-.ivf"},
+  {2, "invalid-vp90-2-09-aq2.webm.ivf.s3984_r01-05_b6-.ivf"},
 };
 
 INSTANTIATE_TEST_CASE_P(
diff --git a/test/test-data.sha1 b/test/test-data.sha1
index b00aa8edd..7956e5040 100644
--- a/test/test-data.sha1
+++ b/test/test-data.sha1
@@ -683,3 +683,5 @@ c12918cf0a716417fba2de35c3fc5ab90e52dfce  vp90-2-18-resize.ivf.md5
 717da707afcaa1f692ff1946f291054eb75a4f06  screendata.y4m
 b7c1296630cdf1a7ef493d15ff4f9eb2999202f6  invalid-vp90-2-08-tile_1x2_frame_parallel.webm.ivf.s47039_r01-05_b6-.ivf
 0a3884edb3fd8f9d9b500223e650f7de257b67d8  invalid-vp90-2-08-tile_1x2_frame_parallel.webm.ivf.s47039_r01-05_b6-.ivf.res
+fac89b5735be8a86b0dc05159f996a5c3208ae32  invalid-vp90-2-09-aq2.webm.ivf.s3984_r01-05_b6-.ivf
+22e0ee8babe574722baf4ef6d7ff5d7cf80d386c  invalid-vp90-2-09-aq2.webm.ivf.s3984_r01-05_b6-.ivf.res
diff --git a/test/test.mk b/test/test.mk
index 7fe39304e..fe5a1cfff 100644
--- a/test/test.mk
+++ b/test/test.mk
@@ -805,6 +805,8 @@ LIBVPX_TEST_DATA-$(CONFIG_VP9_DECODER) += invalid-vp90-2-08-tile_1x2_frame_paral
 LIBVPX_TEST_DATA-$(CONFIG_VP9_DECODER) += invalid-vp90-2-08-tile_1x2_frame_parallel.webm.ivf.s47039_r01-05_b6-.ivf.res
 LIBVPX_TEST_DATA-$(CONFIG_VP9_DECODER) += invalid-vp90-2-08-tile_1x4_frame_parallel_all_key.webm
 LIBVPX_TEST_DATA-$(CONFIG_VP9_DECODER) += invalid-vp90-2-08-tile_1x4_frame_parallel_all_key.webm.res
+LIBVPX_TEST_DATA-$(CONFIG_VP9_DECODER) += invalid-vp90-2-09-aq2.webm.ivf.s3984_r01-05_b6-.ivf
+LIBVPX_TEST_DATA-$(CONFIG_VP9_DECODER) += invalid-vp90-2-09-aq2.webm.ivf.s3984_r01-05_b6-.ivf.res
 
 ifeq ($(CONFIG_DECODE_PERF_TESTS),yes)
 # BBB VP9 streams
diff --git a/vp9/decoder/vp9_decodeframe.c b/vp9/decoder/vp9_decodeframe.c
index 572ab0efc..72e5edf81 100644
--- a/vp9/decoder/vp9_decodeframe.c
+++ b/vp9/decoder/vp9_decodeframe.c
@@ -813,6 +813,8 @@ static const uint8_t *decode_tiles(VP9Decoder *pbi,
 
   if (cm->lf.filter_level) {
     LFWorkerData *const lf_data = (LFWorkerData*)pbi->lf_worker.data1;
+    // Be sure to sync as we might be resuming after a failed frame decode.
+    winterface->sync(&pbi->lf_worker);
     lf_data->frame_buffer = get_frame_new_buffer(cm);
     lf_data->cm = cm;
     vp9_copy(lf_data->planes, pbi->mb.plane);