New issue
Advanced search Search tips

Issue 623724 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Jan 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Crash in content::DeviceMotionEventPump::SendFakeDataForTesting

Project Member Reported by ClusterFuzz, Jun 27 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6247775906037760

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  content::DeviceMotionEventPump::SendFakeDataForTesting
  base::debug::TaskAnnotator::RunTask
  scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=398006:398017

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94Ovca7TTR_IwAanUXATFE8nEvOPou8Jrop7ghn7rWAllfAuKIoqtVI7I9lEyMcWSj9teCaJVig2L_SIhGETM26OKdDWimg4FHkduZwo4A6Vea_che7NXZggRUi6S_naLccVNl38YwEZwUDYvbFQnOHCOx9Om9c8Xy7vcb_lZkYgiN5aYg?testcase_id=6247775906037760


Additional requirements: Requires HTTP

Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Owner: alexclarke@chromium.org
Status: Assigned (was: Available)
Suspected CL could be
https://chromium.googlesource.com/chromium/src/+/d4b2c47b8488ca4f943735c663bcb45c42765cdc%5E%21/components/scheduler/base/task_queue_manager.cc

Last updated by  alexclarke@ weeks ago , please have a look and reassign if needed.

Thank you.
Cc: mlamouri@chromium.org
Owner: timvolod...@chromium.org
I'd be really surprised if that CL was the root cause.  At first blush it looks like the listener in the PlatformEventObserver is null, possibly because PlatformEventObserver::Stop has been called.  I had a look but I can't see any obvious recent patches that might have caused that.

Assigning to Tim for triage.
Project Member

Comment 3 by ClusterFuzz, Jul 2 2016

ClusterFuzz has detected this testcase as flaky and is unable to reproduce it in the original crash revision. Skipping fixed testing check and marking it as potentially fixed.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6247775906037760

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  content::DeviceMotionEventPump::SendFakeDataForTesting
  base::debug::TaskAnnotator::RunTask
  scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=398006:398017

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94Ovca7TTR_IwAanUXATFE8nEvOPou8Jrop7ghn7rWAllfAuKIoqtVI7I9lEyMcWSj9teCaJVig2L_SIhGETM26OKdDWimg4FHkduZwo4A6Vea_che7NXZggRUi6S_naLccVNl38YwEZwUDYvbFQnOHCOx9Om9c8Xy7vcb_lZkYgiN5aYg?testcase_id=6247775906037760


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Jul 12 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5863385522765824

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  content::DeviceMotionEventPump::SendFakeDataForTesting
  base::debug::TaskAnnotator::RunTask
  scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=290818:290912

Minimized Testcase (7.60 Kb): https://cluster-fuzz.appspot.com/download/AMIfv9752F_y6TV3hkSetAuxpGgvWXZ5iYCuuECT9bVvfI41TPAVzsPem0ETkFTxxzbREWBXaI--nRAVnMp4NJy9eXMVLpV96kc0GojYUwX0nuqkSyE_I4fOOLME5wAKcVVDOK2t_GObMwg9Z1it5zdvh7FtMf7UQQ?testcase_id=5863385522765824

Additional requirements: Requires HTTP

Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 5 by ClusterFuzz, Jul 27 2016

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6739178620715008

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  content::DeviceMotionEventPump::SendFakeDataForTesting
  base::debug::TaskAnnotator::RunTask
  scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=333283:333350

Minimized Testcase (6.17 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96abd9Yp9rCvACfdvWZqfubASmSLa3Tc7-HhVY0Wz6aevXkDpXdo0i4EMJKs8Pl488Bb1ULGXH-gTO-VdmrghitN3mve8IsyVNvf2yN12eYEwvE7NQE4XByntcwMuqcZ81sfkLDsWx_VUy-PDpmUWX5HXZBNA?testcase_id=6739178620715008

Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
Project Member

Comment 6 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 7 by ClusterFuzz, Dec 24 2016

ClusterFuzz has detected this issue as fixed in range 431798:431800.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6739178620715008

Fuzzer: inferno_twister
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: UNKNOWN READ
Crash Address: 0x000000000000
Crash State:
  content::DeviceMotionEventPump::SendFakeDataForTesting
  base::debug::TaskAnnotator::RunTask
  scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=333283:333350
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_content_shell_drt&range=431798:431800

Minimized Testcase (6.17 Kb): https://cluster-fuzz.appspot.com/download/AMIfv96abd9Yp9rCvACfdvWZqfubASmSLa3Tc7-HhVY0Wz6aevXkDpXdo0i4EMJKs8Pl488Bb1ULGXH-gTO-VdmrghitN3mve8IsyVNvf2yN12eYEwvE7NQE4XByntcwMuqcZ81sfkLDsWx_VUy-PDpmUWX5HXZBNA?testcase_id=6739178620715008

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jan 23 2017

Status: WontFix (was: Assigned)
ClusterFuzz testcase 5863385522765824 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment