Data race in blink::setIndexedDBClientCreateFunction |
|||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=5040361197535232 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 8 Crash Address: 0x7f4f7a385498 Crash State: blink::setIndexedDBClientCreateFunction blink::WebLocalFrameImpl::WebLocalFrameImpl blink::WebLocalFrame::create Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95xm2ohM1soLlNSICNX3YkZ4u8T7NZNYtx0wffhV-Ui0X2-ayaXhRVoIMKpui5wXWzPiFPhRvL_znUwwblPgBLSmTh279wQND7Hm2b3nSh8Y2RQ-Zni69QuqWPER57mDpmHWk263uUyW47Gf-UUr7W6Ppz9_Q Additional requirements: Requires HTTP Filer: durga.behera See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Apr 7 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5723b5345281cbc8d3cbe7d4715003a2ee206edd commit 5723b5345281cbc8d3cbe7d4715003a2ee206edd Author: sigbjornf <sigbjornf@opera.com> Date: Thu Apr 07 13:14:21 2016 Avoid setIndexedDBClientCreateFunction() write race. R=haraken BUG= 599011 Review URL: https://codereview.chromium.org/1862403002 Cr-Commit-Position: refs/heads/master@{#385733} [modify] https://crrev.com/5723b5345281cbc8d3cbe7d4715003a2ee206edd/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp
,
Apr 7 2016
,
Apr 8 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4fa5dd8ee1e6f6c8719935152f3b48f82626d595 commit 4fa5dd8ee1e6f6c8719935152f3b48f82626d595 Author: sigbjornf <sigbjornf@opera.com> Date: Fri Apr 08 05:55:16 2016 Add setIndexedDBClientCreateFunction() explanatory comment. Follow up changes in r385772 and r385733 with a comment to try to explain why update atomicity matters here. R= BUG= 598551 , 599011 NOTRY=true Review URL: https://codereview.chromium.org/1862223005 Cr-Commit-Position: refs/heads/master@{#386000} [modify] https://crrev.com/4fa5dd8ee1e6f6c8719935152f3b48f82626d595/third_party/WebKit/Source/modules/indexeddb/IndexedDBClient.cpp
,
Apr 24 2016
ClusterFuzz has detected this issue as fixed in range 385751:385831. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5040361197535232 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 8 Crash Address: 0x7f4f7a385498 Crash State: blink::setIndexedDBClientCreateFunction blink::WebLocalFrameImpl::WebLocalFrameImpl blink::WebLocalFrame::create Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=385751:385831 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv95xm2ohM1soLlNSICNX3YkZ4u8T7NZNYtx0wffhV-Ui0X2-ayaXhRVoIMKpui5wXWzPiFPhRvL_znUwwblPgBLSmTh279wQND7Hm2b3nSh8Y2RQ-Zni69QuqWPER57mDpmHWk263uUyW47Gf-UUr7W6Ppz9_Q Additional requirements: Requires HTTP See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||
►
Sign in to add a comment |
|||
Comment 1 by durga.behera@chromium.org
, Mar 30 2016Owner: haraken@chromium.org
Status: Assigned (was: Available)