New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 594614 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 595792
Owner:
Last visit > 30 days ago
Closed: Mar 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Stack overflow in HostResolverImplTest.DeleteWithinCallback.

Project Member Reported by reillyg@chromium.org, Mar 14 2016

Issue description

The net_unittests test HostResolverImplTest.DeleteWithinCallback appears to be encountering a stack overflow on the Windows Dr. Memory bots:

https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Unit%20%28DrMemory%20full%29%20%281%29/builds/4409

UNADDRESSABLE ACCESS beyond top of stack: reading 0x01f3f7d8-0x01f3f7dc 4 byte(s)
# 0 std::basic_string<>::assign                                                [c:\b\depot_tools\win_toolchain\vs_files\391bbf1220d3edcd3cc3fccdb56224181e3b13a7\vc\include\xstring:1165]
# 1 net::HostResolverImplTest_CancelWithinCallback_Test::TestBody              [net\dns\host_resolver_impl_unittest.cc:875]
# 2 testing::internal::HandleExceptionsInMethodIfSupported<>                   [testing\gtest\src\gtest.cc:2458]
Note: @0:02:53.535 in thread 736
Note: 0x01f3f7d8 refers to -24 byte(s) beyond the top of the stack 0x01f3f7c0
Note: instruction: mov    0x0c(%ebp) -> %edi
Suppression (error hash=#CA1C9ECAF150E874#):
For more info on using suppressions see http://dev.chromium.org/developers/how-tos/using-drmemory#TOC-Suppressing-error-reports-from-the-
{
UNADDRESSABLE ACCESS
name=<insert_a_suppression_name_here>
*!std::basic_string<>::assign
*!net::HostResolverImplTest_CancelWithinCallback_Test::TestBody
*!testing::internal::HandleExceptionsInMethodIfSupported<>
}

 
Same issue within HostResolverImplTest.CancelWithinCallback:

UNADDRESSABLE ACCESS beyond top of stack: reading 0x01f3f7d8-0x01f3f7dc 4 byte(s)
# 0 std::basic_string<>::assign                                                [c:\b\depot_tools\win_toolchain\vs_files\391bbf1220d3edcd3cc3fccdb56224181e3b13a7\vc\include\xstring:1165]
# 1 net::HostResolverImplTest_CancelWithinCallback_Test::TestBody              [net\dns\host_resolver_impl_unittest.cc:875]
# 2 testing::internal::HandleExceptionsInMethodIfSupported<>                   [testing\gtest\src\gtest.cc:2458]
Note: @0:02:53.535 in thread 736
Note: 0x01f3f7d8 refers to -24 byte(s) beyond the top of the stack 0x01f3f7c0
Note: instruction: mov    0x0c(%ebp) -> %edi
Suppression (error hash=#CA1C9ECAF150E874#):
For more info on using suppressions see http://dev.chromium.org/developers/how-tos/using-drmemory#TOC-Suppressing-error-reports-from-the-
{
UNADDRESSABLE ACCESS
name=<insert_a_suppression_name_here>
*!std::basic_string<>::assign
*!net::HostResolverImplTest_CancelWithinCallback_Test::TestBody
*!testing::internal::HandleExceptionsInMethodIfSupported<>
}
Project Member

Comment 2 by bugdroid1@chromium.org, Mar 14 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/664bf5cfb36ba93d714acecfd197bf76e887fd1c

commit 664bf5cfb36ba93d714acecfd197bf76e887fd1c
Author: reillyg <reillyg@chromium.org>
Date: Mon Mar 14 18:11:52 2016

Add suppressions for new Windows Unit Dr. Memory failures.

BUG= 594614 , 594618 
TBR=thestig@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1795303003

Cr-Commit-Position: refs/heads/master@{#381009}

[modify] https://crrev.com/664bf5cfb36ba93d714acecfd197bf76e887fd1c/tools/valgrind/drmemory/suppressions_full.txt

Comment 3 by mmenke@chromium.org, Mar 14 2016

Owner: mmenke@chromium.org
Status: Assigned (was: Untriaged)
Not sure if anyone else is going to take this on, so I will.

This test looks extremely borked.  It creates 5 requests, cancels 2, and tells 2 to complete with a condition variable, and then waits on the 5th request, which it never tells to complete, which is...creative.  I can get it to hang by playing with break points.  Not sure why it manages to pass if I don't set them.

Comment 4 by mmenke@chromium.org, Mar 14 2016

May not be the cause of the failure, but looks like the tests are incorrectly using a ConditionVariable.  Fun times.  Not sure if this is the cause of the leak, but the entire test fixture looks broken.

Comment 5 by mmenke@chromium.org, Mar 15 2016

Cc: mmenke@chromium.org
Owner: ----
Status: Available (was: Assigned)
Hrm, ok, ConditionVariables look to not be the problem, their interaction with locks was confusing me (They have a lot of docs, curiously, but the docs never say how they actually work).

The test has multiple timeouts - a 6 second DNS timeout, a 30 second test timeout, etc, but none of them are triggering - the tests are taking under 50 ms, and nothing has a timeout nearly that short (And we'd probably be seeing the test fail or a hang if timeouts were the issue).

Digging into the line it claims is running into a problem creating a string, the code looks fine to me.

Can't repro by running Dr. Memory locally, either.  Going to go ahead and unassign, don't see a path forward here.

Comment 6 by eroman@chromium.org, Mar 15 2016

The regression window is the same as for  issue 594618  (sqliet) -- both appear to have begun with:

https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Unit%20%28DrMemory%20full%29%20%281%29/builds/4380

There aren't any changes to hostresolver in that window, but there are changes to sqlite.

I expect there is a coupling between those two tests, since they are also run around the same time. The HostResolverImpl test looks to run first, and then the failing Sqlite one.

I don't spot the problem in HostResolverImpl yet, but TBH I don't understand the given callstack or error from Dr Memory either. Line 875 is this:

    EXPECT_EQ(ERR_IO_PENDING, CreateRequest("a", 80 + i)->Resolve()) << i;

The only string assignment I see there is the implicit std::string("a");

Comment 7 by sh...@chromium.org, Mar 15 2016

IMHO, this is from the VS 2015 changeover, so it's likely to be a latent problem caused by new code generation rather than a new problem caused by a particular CL.  [That doesn't mean it shouldn't be fixed.]
Mergedinto: 595792
Owner: bruening@chromium.org
Status: Duplicate (was: Available)
I can repro only if I undo my  issue 595792  modrm nop fix, so this is just another manifestation of the same bug.

net_unittests!std::basic_string<char,std::char_traits<char>,std::allocator<char> >::_Grow [z:\derek\depot_tools\win_toolchain\vs_files\a3796183a9fc4d22a687c5212b9c76dbd136d70d\vc\include\xstring @ 1165] [inlined in net_unittests!std::basic_string<char,std::char_traits<char>,std::allocator<char> >::assign+0x66 [z:\derek\depot_tools\win_toolchain\vs_files\a3796183a9fc4d22a687c5212b9c76dbd136d70d\vc\include\xstring @ 1165]]:
014a8116 8b7d0c          mov     edi,dword ptr [ebp+0Ch]
014a8119 83fffe          cmp     edi,0FFFFFFFEh

   +0x010 ebp              : 0x35f8d4
   +0x014 esp              : 0x35f8c8

The xl8 sharing bug must end up marking part of the stack as unaddressable,
and the reporting logic assumes that an unaddr error on the stack must be
beyond the top.

Project Member

Comment 10 by bugdroid1@chromium.org, Mar 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/899620623be8f7b5004cea13f7da96ff7ca80c27

commit 899620623be8f7b5004cea13f7da96ff7ca80c27
Author: bruening <bruening@chromium.org>
Date: Sun Mar 20 13:37:54 2016

Remove Dr. Memory suppressions and exclusions that are no longer needed.

Remove the suppressions and exclusions put in place to work around Dr. Memory bugs that are now fixed.

BUG= 594614 , 594618 , 594785 , 594618 , 594808 , 595158 , 595490 
TBR=reillyg,oshima
NOTRY=true

Review URL: https://codereview.chromium.org/1817853002

Cr-Commit-Position: refs/heads/master@{#382222}

[modify] https://crrev.com/899620623be8f7b5004cea13f7da96ff7ca80c27/tools/valgrind/drmemory/suppressions_full.txt
[modify] https://crrev.com/899620623be8f7b5004cea13f7da96ff7ca80c27/tools/valgrind/gtest_exclude/unit_tests.gtest-drmemory_win32.txt

Sign in to add a comment