New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 603526 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in page_load_metrics::PageTimingMetricsSender::DidObserveLoadingBehavior

Project Member Reported by ClusterFuzz, Apr 14 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6596088676483072

Fuzzer: attekett_surku_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000088
Crash State:
  page_load_metrics::PageTimingMetricsSender::DidObserveLoadingBehavior
  content::RenderFrameImpl::didObserveLoadingBehavior
  blink::FrameLoaderClientImpl::didObserveLoadingBehavior
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=387082:387190

Minimized Testcase (0.27 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97pwRxNdIeDCZepwMQG3XznvqViTam8KB457aOKNJb6-dS_Eh-Std7U11G7Puav_4wIwjw9HcnSIcEA5E6pacoTY06Q71OrU1HOIytEe35ssWsYdhSa068hJAwHLMjLH1wnLmOT2iN-xHidTyjxdslptv7eFg

Filer: tkonchada

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: brettw@chromium.org
Components: Blink
Labels: findit-for-crash Te-Logged M-52
Owner: csharrison@chromium.org
Status: Assigned (was: Available)
The result is a list of CLs that change the crashed files.

Author: csharrison
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/b9a657db596e85b738c56f0ef896428ba5997227
Time: Thu Apr 14 00:41:40 2016
Lines 37-43, 59-62 of file page_timing_metrics_sender.cc which potentially caused crash are changed in this cl (frame #0, "page_load_metrics::PageTimingMetricsSender::DidObserveLoadingBehavior").
Minimum distance from crash line to modified line: 0. (file: page_timing_metrics_sender.cc, crashed on: 37, modified: 37).

Suspected Project: chromium
Issue 603531 has been merged into this issue.
I have a fix for this coming.
Project Member

Comment 4 by bugdroid1@chromium.org, Apr 14 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1e2463244f2a1dd7a20c511b4b7b17f311129a5d

commit 1e2463244f2a1dd7a20c511b4b7b17f311129a5d
Author: csharrison <csharrison@chromium.org>
Date: Thu Apr 14 14:15:44 2016

Add null check for page_load_metrics timing sender

BUG= 603526 

Review URL: https://codereview.chromium.org/1890853002

Cr-Commit-Position: refs/heads/master@{#387305}

[modify] https://crrev.com/1e2463244f2a1dd7a20c511b4b7b17f311129a5d/components/page_load_metrics/renderer/metrics_render_frame_observer.cc

Labels: Merge-Request-51
Project Member

Comment 6 by ClusterFuzz, Apr 15 2016

ClusterFuzz has detected this issue as fixed in range 387299:387336.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6596088676483072

Fuzzer: attekett_surku_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000088
Crash State:
  page_load_metrics::PageTimingMetricsSender::DidObserveLoadingBehavior
  content::RenderFrameImpl::didObserveLoadingBehavior
  blink::FrameLoaderClientImpl::didObserveLoadingBehavior
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=387082:387190
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=387299:387336

Minimized Testcase (0.27 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97pwRxNdIeDCZepwMQG3XznvqViTam8KB457aOKNJb6-dS_Eh-Std7U11G7Puav_4wIwjw9HcnSIcEA5E6pacoTY06Q71OrU1HOIytEe35ssWsYdhSa068hJAwHLMjLH1wnLmOT2iN-xHidTyjxdslptv7eFg

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 7 by keishi@chromium.org, Apr 15 2016

Status: Fixed (was: Assigned)

Comment 8 by tin...@google.com, Apr 15 2016

Labels: -Merge-Request-51 Merge-Approved-51 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M51 (branch: 2704)
Project Member

Comment 9 by bugdroid1@chromium.org, Apr 15 2016

Labels: -merge-approved-51 merge-merged-2704
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/60c614c48b08d9d2173077156d9ebf5da8bdd945

commit 60c614c48b08d9d2173077156d9ebf5da8bdd945
Author: Charles Harrison <csharrison@chromium.org>
Date: Fri Apr 15 15:07:46 2016

Add null check for page_load_metrics timing sender

BUG= 603526 

Review URL: https://codereview.chromium.org/1890853002

Cr-Commit-Position: refs/heads/master@{#387305}
(cherry picked from commit 1e2463244f2a1dd7a20c511b4b7b17f311129a5d)

Plumb experiment flags through page_load_metrics and add a new observer

This patch is the second of two patches to plumb experimental flags into
the page_load_metrics system to separate histograms. This change adds
an int flag to the IPC message, which can then be used by various metrics
observers so they can log histograms only when the feature is triggered.

BUG=594159

Review URL: https://codereview.chromium.org/1857443002

(cherry picked from commit b9a657db596e85b738c56f0ef896428ba5997227)

Cr-Original-Commit-Position: refs/heads/master@{#387175}
Cr-Commit-Position: refs/branch-heads/2704@{#74}
Cr-Branched-From: 6e53600def8f60d8c632fadc70d7c1939ccea347-refs/heads/master@{#386251}

[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/DEPS
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/observers/core_page_load_metrics_observer.cc
[add] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/observers/document_write_page_load_metrics_observer.cc
[add] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/observers/document_write_page_load_metrics_observer.h
[add] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/observers/document_write_page_load_metrics_observer_unittest.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/observers/page_load_metrics_observer_test_harness.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/observers/page_load_metrics_observer_test_harness.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/chrome_browser.gypi
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/chrome_tests_unit.gypi
[add] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/test/data/page_load_metrics/document_write_external_script.html
[add] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/test/data/page_load_metrics/document_write_no_script.html
[add] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/chrome/test/data/page_load_metrics/empty.js
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/DEPS
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/browser/metrics_web_contents_observer.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/browser/metrics_web_contents_observer.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/browser/metrics_web_contents_observer_unittest.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/browser/page_load_metrics_observer.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/browser/page_load_metrics_observer.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/common/page_load_metrics_messages.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/common/page_load_timing.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/common/page_load_timing.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/renderer/metrics_render_frame_observer.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/renderer/metrics_render_frame_observer.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/renderer/metrics_render_frame_observer_unittest.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/renderer/page_timing_metrics_sender.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/renderer/page_timing_metrics_sender.h
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/components/page_load_metrics/renderer/page_timing_metrics_sender_unittest.cc
[modify] https://crrev.com/60c614c48b08d9d2173077156d9ebf5da8bdd945/tools/metrics/histograms/histograms.xml

Project Member

Comment 10 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment