suspected cl :https://chromium.googlesource.com/chromium/src/+/01875a5b228e8d84bc92db4b634df054efcf9216%5E%21/third_party/WebKit/Source/wtf/HashTable.h

yutak@ could you please look into this. Thanks

mmohammad: Definitely not me. Please read the stack and assign more carefully.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6188066607202304

Fuzzer: inferno_flicker
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7e9bd822d8c0
Crash State:
  blink::AudioListener::addPanner
  blink::PannerHandler::initialize
  blink::PannerHandler::PannerHandler
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=393907:394251

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97Up8h4HdguGnbJdoMEkR9WGMd9ZROtEUNSOHDQgma_veyTJ3peY0DnbVfMD4iX9hSKjRtiNw5dMTB6cFasbOr9IBw43IGcXmqestza27PVvYEqks1oTvy2-iyTYhSJMeapwiaphL1HHOTrUzwZ-zGuH1peKVHWvk3BdehMPnNSARUApgE


Filer: ranjitkan

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Although not the same, this is very closely related to  issue 612948 . I haven't been able to reproduce this locally, but 612948 is easily reproducible, and the fix for 612948 very likely will fix this.  AudioListener::updateState() will no longer be processing the hash table of panners when the main thread is also trying to add to the hash table.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a6beb9f31fba1c7892fbfb4911f34e5a13492183

commit a6beb9f31fba1c7892fbfb4911f34e5a13492183
Author: rtoy <rtoy@chromium.org>
Date: Tue May 24 23:48:06 2016

Simplify notification of a dirty listener.

Instead of the listener updating the dirty state of all panners, just
set a dirty state flag in the listener.  Then, when a panner needs
to compute a new azimuth/elevation gain or cone gain, the panner
just checks to see if the listener is dirty.

This gets rid of the data race where both the audio thread and the
main thread are updating the dirty state of a panner.  The checking
and setting of the listener state happens on the audio thread.

The race from reading from the hash table of panners in AudioListener
and adding to the table from the main thread is also removed.

BUG= 612948 ,  612955 ,  613332 
TEST=none

Review-Url: https://codereview.chromium.org/2006563003
Cr-Commit-Position: refs/heads/master@{#395738}

[modify] https://crrev.com/a6beb9f31fba1c7892fbfb4911f34e5a13492183/third_party/WebKit/Source/modules/webaudio/AudioListener.cpp
[modify] https://crrev.com/a6beb9f31fba1c7892fbfb4911f34e5a13492183/third_party/WebKit/Source/modules/webaudio/AudioListener.h
[modify] https://crrev.com/a6beb9f31fba1c7892fbfb4911f34e5a13492183/third_party/WebKit/Source/modules/webaudio/PannerNode.cpp
[modify] https://crrev.com/a6beb9f31fba1c7892fbfb4911f34e5a13492183/third_party/WebKit/Source/modules/webaudio/PannerNode.h

ClusterFuzz has detected this issue as fixed in range 395707:395767.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6188066607202304

Fuzzer: inferno_flicker
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7e9bd822d8c0
Crash State:
  blink::AudioListener::addPanner
  blink::PannerHandler::initialize
  blink::PannerHandler::PannerHandler
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=393907:394251
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=395707:395767

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv97Up8h4HdguGnbJdoMEkR9WGMd9ZROtEUNSOHDQgma_veyTJ3peY0DnbVfMD4iX9hSKjRtiNw5dMTB6cFasbOr9IBw43IGcXmqestza27PVvYEqks1oTvy2-iyTYhSJMeapwiaphL1HHOTrUzwZ-zGuH1peKVHWvk3BdehMPnNSARUApgE


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

The new crash stack for c#1 shows that the original crash is gone.  However, there is another issue having to do with ff_fft_init.  That is  issue 508425 .

Based on this and c#7, closing as fixed.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/84ecd66b39c24e7614412f08571b98380d7cd41d

commit 84ecd66b39c24e7614412f08571b98380d7cd41d
Author: Raymond Toy <rtoy@chromium.org>
Date: Thu May 26 17:16:31 2016

Simplify notification of a dirty listener.

Instead of the listener updating the dirty state of all panners, just
set a dirty state flag in the listener.  Then, when a panner needs
to compute a new azimuth/elevation gain or cone gain, the panner
just checks to see if the listener is dirty.

This gets rid of the data race where both the audio thread and the
main thread are updating the dirty state of a panner.  The checking
and setting of the listener state happens on the audio thread.

The race from reading from the hash table of panners in AudioListener
and adding to the table from the main thread is also removed.

BUG= 612948 ,  612955 ,  613332 
TEST=none

Review-Url: https://codereview.chromium.org/2006563003
Cr-Commit-Position: refs/heads/master@{#395738}
(cherry picked from commit a6beb9f31fba1c7892fbfb4911f34e5a13492183)

Review URL: https://codereview.chromium.org/2012773005 .

Cr-Commit-Position: refs/branch-heads/2743@{#78}
Cr-Branched-From: 2b3ae3b8090361f8af5a611712fc1a5ab2de53cb-refs/heads/master@{#394939}

[modify] https://crrev.com/84ecd66b39c24e7614412f08571b98380d7cd41d/third_party/WebKit/Source/modules/webaudio/AudioListener.cpp
[modify] https://crrev.com/84ecd66b39c24e7614412f08571b98380d7cd41d/third_party/WebKit/Source/modules/webaudio/AudioListener.h
[modify] https://crrev.com/84ecd66b39c24e7614412f08571b98380d7cd41d/third_party/WebKit/Source/modules/webaudio/PannerNode.cpp
[modify] https://crrev.com/84ecd66b39c24e7614412f08571b98380d7cd41d/third_party/WebKit/Source/modules/webaudio/PannerNode.h

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4985150688985088

Fuzzer: inferno_twister_custom_bundle
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 4
Crash Address: 0x7eaf2336e24c
Crash State:
  blink::AudioListener::updateState
  blink::AbstractAudioContext::handlePreRenderTasks
  blink::AudioDestinationHandler::render
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=393907:394251

Minimized Testcase (0.08 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv953VsPeh_6FHo6JsZ3aiNT8CG336Li8UhvCZkbSOHNX4gimTMDifgFXb55iqnb3GS7_4IvA_lps7vy6yEEkB1qLoVzMNMRiOd0rq9qMAAXlq8LGldIIlfvBdrh1oL-rcSNW761LjC2Xg_vaiSEqNYqJwjtlFw
<script>
 o1 = new window.AudioContext(); 
 o6 = o1.createPanner(); 
 </script>


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot