New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 598551 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Email to this user bounced
Closed: Apr 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in blink::IndexedDBClient::create

Project Member Reported by ClusterFuzz, Mar 29 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5687430199377920

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 8
Crash Address: 0x7fa0d60a3498
Crash State:
  blink::IndexedDBClient::create
  blink::WorkerGlobalScopeIndexedDatabase::indexedDB
  blink::WorkerGlobalScopePartialV8Internal::indexedDBAttributeGetterCallback
  

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv9738D7WsEOTdIstEtxKuayK7YeNcoXatkHx38O6mSo8c_A38suw6J6yqqWaE_vO0GVZ8Z11KLUvL94hxuvWBgmZnzl2U7fVrDnpUob6dd30ahPYpPq7u3o9bt2ZF_TJh3bfLQ2wgEwFElIvRjciggxrbtESdQ


Additional requirements: Requires HTTP

Filer: durga.behera

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Labels: findit-wrong Te-Logged M-50
Owner: jsb...@chromium.org
Status: Assigned (was: Available)
This is impacting the previous Stable # 49.0.2623.108 and current Beta # 50.0.2661.49.
Suspected CLs :	Analysis of failed component others is not supported by Findit.
Suspected Component: others

From code search on the crashed file 'IndexedDBClient.cpp' suspecting the below.
https://codereview.chromium.org/225023020
jsbell@ : Could you please take a look into this if its related to your change.

Comment 2 by jsb...@chromium.org, Mar 29 2016

Cc: kinuko@chromium.org
Components: Blink>Workers Blink>Storage>IndexedDB
Looks like a race between blink::provideContentSettingsClientToWorker (main thread) and the worker thread which is already running and calling into the client create function the context settings client manages.

Did we tweak something in thread startup recently?

Comment 3 Deleted

Comment 4 Deleted

Project Member

Comment 5 by bugdroid1@chromium.org, Apr 7 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7f906f7d164fd89132d1ea261d83e09df9e508f6

commit 7f906f7d164fd89132d1ea261d83e09df9e508f6
Author: sigbjornf <sigbjornf@opera.com>
Date: Thu Apr 07 16:02:59 2016

Avoid IndexedDBClient::create() read race.

R=haraken
BUG= 598551 

Review URL: https://codereview.chromium.org/1869013002

Cr-Commit-Position: refs/heads/master@{#385772}

[modify] https://crrev.com/7f906f7d164fd89132d1ea261d83e09df9e508f6/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp

Cc: haraken@chromium.org jsb...@chromium.org
Owner: sigbjo...@opera.com
Thanks for the fix!

Sounds like this should merge back to 50 and maybe 49, once it's baked.
Status: Fixed (was: Assigned)
It regressed via https://codereview.chromium.org/1823953002 afaik, which means it is >= M51 specific.

https://codereview.chromium.org/1862403002/ has the dual for write.
Project Member

Comment 8 by bugdroid1@chromium.org, Apr 8 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4fa5dd8ee1e6f6c8719935152f3b48f82626d595

commit 4fa5dd8ee1e6f6c8719935152f3b48f82626d595
Author: sigbjornf <sigbjornf@opera.com>
Date: Fri Apr 08 05:55:16 2016

Add setIndexedDBClientCreateFunction() explanatory comment.

Follow up changes in r385772 and r385733 with a comment to
try to explain why update atomicity matters here.

R=
BUG= 598551 ,  599011 
NOTRY=true

Review URL: https://codereview.chromium.org/1862223005

Cr-Commit-Position: refs/heads/master@{#386000}

[modify] https://crrev.com/4fa5dd8ee1e6f6c8719935152f3b48f82626d595/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp

Project Member

Comment 9 by ClusterFuzz, Apr 24 2016

ClusterFuzz has detected this issue as fixed in range 385751:385831.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5687430199377920

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 8
Crash Address: 0x7fa0d60a3498
Crash State:
  blink::IndexedDBClient::create
  blink::WorkerGlobalScopeIndexedDatabase::indexedDB
  blink::WorkerGlobalScopePartialV8Internal::indexedDBAttributeGetterCallback
  
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=385751:385831

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv9738D7WsEOTdIstEtxKuayK7YeNcoXatkHx38O6mSo8c_A38suw6J6yqqWaE_vO0GVZ8Z11KLUvL94hxuvWBgmZnzl2U7fVrDnpUob6dd30ahPYpPq7u3o9bt2ZF_TJh3bfLQ2wgEwFElIvRjciggxrbtESdQ


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment