Data race in blink::IndexedDBClient::create |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5687430199377920 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 8 Crash Address: 0x7fa0d60a3498 Crash State: blink::IndexedDBClient::create blink::WorkerGlobalScopeIndexedDatabase::indexedDB blink::WorkerGlobalScopePartialV8Internal::indexedDBAttributeGetterCallback Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv9738D7WsEOTdIstEtxKuayK7YeNcoXatkHx38O6mSo8c_A38suw6J6yqqWaE_vO0GVZ8Z11KLUvL94hxuvWBgmZnzl2U7fVrDnpUob6dd30ahPYpPq7u3o9bt2ZF_TJh3bfLQ2wgEwFElIvRjciggxrbtESdQ Additional requirements: Requires HTTP Filer: durga.behera See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Mar 29 2016
Looks like a race between blink::provideContentSettingsClientToWorker (main thread) and the worker thread which is already running and calling into the client create function the context settings client manages. Did we tweak something in thread startup recently?
,
Apr 7 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7f906f7d164fd89132d1ea261d83e09df9e508f6 commit 7f906f7d164fd89132d1ea261d83e09df9e508f6 Author: sigbjornf <sigbjornf@opera.com> Date: Thu Apr 07 16:02:59 2016 Avoid IndexedDBClient::create() read race. R=haraken BUG= 598551 Review URL: https://codereview.chromium.org/1869013002 Cr-Commit-Position: refs/heads/master@{#385772} [modify] https://crrev.com/7f906f7d164fd89132d1ea261d83e09df9e508f6/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp
,
Apr 7 2016
Thanks for the fix! Sounds like this should merge back to 50 and maybe 49, once it's baked.
,
Apr 7 2016
It regressed via https://codereview.chromium.org/1823953002 afaik, which means it is >= M51 specific. https://codereview.chromium.org/1862403002/ has the dual for write.
,
Apr 8 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4fa5dd8ee1e6f6c8719935152f3b48f82626d595 commit 4fa5dd8ee1e6f6c8719935152f3b48f82626d595 Author: sigbjornf <sigbjornf@opera.com> Date: Fri Apr 08 05:55:16 2016 Add setIndexedDBClientCreateFunction() explanatory comment. Follow up changes in r385772 and r385733 with a comment to try to explain why update atomicity matters here. R= BUG= 598551 , 599011 NOTRY=true Review URL: https://codereview.chromium.org/1862223005 Cr-Commit-Position: refs/heads/master@{#386000} [modify] https://crrev.com/4fa5dd8ee1e6f6c8719935152f3b48f82626d595/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp
,
Apr 24 2016
ClusterFuzz has detected this issue as fixed in range 385751:385831. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5687430199377920 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 8 Crash Address: 0x7fa0d60a3498 Crash State: blink::IndexedDBClient::create blink::WorkerGlobalScopeIndexedDatabase::indexedDB blink::WorkerGlobalScopePartialV8Internal::indexedDBAttributeGetterCallback Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=385751:385831 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv9738D7WsEOTdIstEtxKuayK7YeNcoXatkHx38O6mSo8c_A38suw6J6yqqWaE_vO0GVZ8Z11KLUvL94hxuvWBgmZnzl2U7fVrDnpUob6dd30ahPYpPq7u3o9bt2ZF_TJh3bfLQ2wgEwFElIvRjciggxrbtESdQ Additional requirements: Requires HTTP See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by durga.behera@chromium.org
, Mar 29 2016Owner: jsb...@chromium.org
Status: Assigned (was: Available)