New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 627045 link

Starred by 1 user
Status: WontFix
Owner:
haraken@chromium.org
Closed: Dec 2016
Cc:
jochen@chromium.org
█ alexclarke@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in content::WebMessagePortChannelImpl::CreatePair

Project Member Reported by ClusterFuzz, Jul 11 2016 
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4908218652557312

Fuzzer: mbarbella_js_mutation_layout
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  content::WebMessagePortChannelImpl::CreatePair
  blink::MessageChannel::MessageChannel
  blink::SharedWorker::create
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_lsan_chrome_mp&range=404191:404237

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv94R-N_1hKfEQ0SOl_YN5X5iDW8zhWZR3wzGHyBFtFgdTnkrtTuJwB00_G14SZSMyWXFbkxHO0S9tzwZpsl8JJU0jEE8cI6HJYhiJz5h_3cFz3l_FaqTWyijM7u2SNpOvZhrMW9Q08W4XaggYO4rs1LoJ0Oi7Q?testcase_id=4908218652557312


Additional requirements: Requires Gestures

Filer: kavvaru

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by kavvaru@chromium.org, Jul 11 2016

Components: Blink>DOM Tools>Test>FindIt>CorrectResult
Labels: Te-Logged M-53
Owner: alexclarke@chromium.org
Status: Assigned (was: Available)
Find it tool information
============================
No CL in the regression range changes the crashed files. The result is the blame information.

Author: alexclarke
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/d75fd9468b48334ade1c76f41b5351345e88c6a5
Time: Mon Nov 17 13:31:42 2014
The CL last changed line 72 of file webmessageportchannel_impl.cc, which is stack frame 1.

Author: sunil.ratnu@samsung.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/bfd55902fba77f69264295b4e7e28adea39795fa
Time: Wed Aug 13 15:14:16 2014
The CL last changed line 39 of file MessageChannel.cpp, which is stack frame 2.

Author: adamk@chromium.org
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/47c96a67c7778dff89f5c1e3490d4a224dda8789
Time: Fri Nov 15 02:35:16 2013
The CL last changed line 52 of file MessageChannel.cpp, which is stack frame 3.

Author: sigbjornf@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/63821fc3422aeccfe6cff44ba3fd70090feda904
Time: Tue Apr 28 05:07:33 2015
The CL last changed line 43 of file MessageChannel.h, which is stack frame 4.

Author: sigbjornf@opera.com
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src//+/63821fc3422aeccfe6cff44ba3fd70090feda904
Time: Tue Apr 28 05:07:33 2015
The CL last changed line 65 of file SharedWorker.cpp, which is stack frame 5.

Suspected Project: chromium
Suspected Component: Blink>DOM
=================

Above is the only CL from findit and the changes made to file "webmessageportchannel_impl.cc" from the frame # 1 is more related to it.

alexclarke@: Could you please re-assign to an appropriate dev person if its not related to your change,else please help us in finding the appropriate owner for this issue.

Thanks,

Comment 2 by alexclarke@chromium.org, Jul 11 2016

Cc: alexclarke@chromium.org
Owner: jochen@chromium.org
Jochen could you please help triage this.

Comment 3 by jochen@chromium.org, Jul 11 2016

Cc: jochen@chromium.org
Components: Infra>Client>Oilpan
Owner: haraken@chromium.org
Seems like an oilpan issue? Why is the worker and with it the message channel collected when we error out in the SharedWorker::create method?

Comment 4 by haraken@chromium.org, Jul 11 2016 

Hmm, what do you mean? (Why do you think the message channel is collected?) This is a memory leak, not a crash.

Comment 5 by jochen@chromium.org, Jul 11 2016 

sorry, I meant *not* collected.
Project Member

Comment 6 by sheriffbot@chromium.org, Jul 11 2016

Labels: -M-53 M-54 MovedFrom-53
Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by ClusterFuzz, Dec 22 2016

Status: WontFix (was: Assigned)
ClusterFuzz testcase 4908218652557312 is flaky and no longer reproduces, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
►

Sign in to add a comment