New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 628481 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
please use my google.com address
Closed: Jul 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

Data race in IPCSyncChannelTest.ReentrantReply

Project Member Reported by thestig@chromium.org, Jul 15 2016

Issue description

TSAN reports races in IPCSyncChannelTest.ReentrantReply and IPCSyncChannelTest.RestrictedDispatch4WayDeadlock:

https://build.chromium.org/p/chromium.memory.fyi/builders/Linux%20TSan%20Tests/builds/22545
https://build.chromium.org/p/chromium.memory.fyi/builders/Linux%20TSan%20Tests/builds/22546
https://build.chromium.org/p/chromium.memory.fyi/builders/Linux%20TSan%20Tests/builds/22562

IPCSyncChannelTest.ReentrantReply (run #2):
[ RUN      ] IPCSyncChannelTest.ReentrantReply
==================
WARNING: ThreadSanitizer: data race (pid=1197)
  Write of size 8 at 0x7d500004fc40 by thread T5 (mutexes: write M347):
    #0 reset buildtools/third_party/libc++/trunk/include/memory:2733:24 (ipc_tests+0x00000053f423)
    #1 ClearChannel ipc/ipc_channel_proxy.cc:355 (ipc_tests+0x00000053f423)
    #2 IPC::ChannelProxy::Context::OnChannelClosed() ipc/ipc_channel_proxy.cc:203 (ipc_tests+0x00000053f423)
    #3 IPC::SyncChannel::SyncContext::OnChannelClosed() ipc/ipc_sync_channel.cc:416:12 (ipc_tests+0x00000054ff1d)
...

  Previous read of size 8 at 0x7d500004fc40 by thread T4:
    #0 operator bool buildtools/third_party/libc++/trunk/include/memory:2721:24 (ipc_tests+0x00000053e9f8)
    #1 IPC::ChannelProxy::Context::OnDispatchConnected() ipc/ipc_channel_proxy.cc:327 (ipc_tests+0x00000053e9f8)
(ipc_tests+0x000000540d66)
...

  Location is heap block of size 504 at 0x7d500004fc00 allocated by thread T4:
    #0 operator new(unsigned long) <null> (ipc_tests+0x0000004a9b02)
    #1 IPC::SyncChannel::SyncChannel(IPC::Listener*, scoped_refptr<base::SingleThreadTaskRunner> const&, base::WaitableEvent*) ipc/ipc_sync_channel.cc:480:20 (ipc_tests+0x00000054ffdf)
    #2 Create ipc/ipc_sync_channel.cc:473:11 (ipc_tests+0x00000054ff78)
    #3 IPC::SyncChannel::Create(IPC::ChannelHandle const&, IPC::Channel::Mode, IPC::Listener*, scoped_refptr<base::SingleThreadTaskRunner> const&, bool, base::WaitableEvent*) ipc/ipc_sync_channel.cc:449 (ipc_tests+0x00000054ff78)
    #4 IPC::(anonymous namespace)::ReentrantReplyServer1::Run() ipc/ipc_sync_channel_unittest.cc:1684:24 (ipc_tests+0x0000004f0b34)
    #5 IPC::(anonymous namespace)::Worker::OnStart() ipc/ipc_sync_channel_unittest.cc:193:5 (ipc_tests+0x0000004e0d9d)
...

  Mutex M347 (0x7d500004fc68) created at:
    #0 pthread_mutex_init <null> (ipc_tests+0x00000044c2e3)
    #1 base::internal::LockImpl::LockImpl() base/synchronization/lock_impl_posix.cc:29:3 (ipc_tests+0x00000058aefb)
    #2 Lock base/synchronization/lock.h:24:12 (ipc_tests+0x00000053dc58)
    #3 IPC::ChannelProxy::Context::Context(IPC::Listener*, scoped_refptr<base::SingleThreadTaskRunner> const&) ipc/ipc_channel_proxy.cc:43 (ipc_tests+0x00000053dc58)
    #4 IPC::SyncChannel::SyncContext::SyncContext(IPC::Listener*, scoped_refptr<base::SingleThreadTaskRunner> const&, base::WaitableEvent*) ipc/ipc_sync_channel.cc:276:7 (ipc_tests+0x00000054e30d)
    #5 IPC::SyncChannel::SyncChannel(IPC::Listener*, scoped_refptr<base::SingleThreadTaskRunner> const&, base::WaitableEvent*) ipc/ipc_sync_channel.cc:480:24 (ipc_tests+0x00000054fff3)
    #6 Create ipc/ipc_sync_channel.cc:473:11 (ipc_tests+0x00000054ff78)
    #7 IPC::SyncChannel::Create(IPC::ChannelHandle const&, IPC::Channel::Mode, IPC::Listener*, scoped_refptr<base::SingleThreadTaskRunner> const&, bool, base::WaitableEvent*) ipc/ipc_sync_channel.cc:449 (ipc_tests+0x00000054ff78)
    #8 IPC::(anonymous namespace)::ReentrantReplyServer1::Run() ipc/ipc_sync_channel_unittest.cc:1684:24 (ipc_tests+0x0000004f0b34)
    #9 IPC::(anonymous namespace)::Worker::OnStart() ipc/ipc_sync_channel_unittest.cc:193:5 (ipc_tests+0x0000004e0d9d)
...

  Thread T5 'reentrant_reply1_ipc' (tid=1203, running) created by thread T4 at:
    #0 pthread_create <null> (ipc_tests+0x00000044b2d5)
    #1 base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:109:13 (ipc_tests+0x0000005968ba)
    #2 base::PlatformThread::CreateWithPriority(unsigned long, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:190:10 (ipc_tests+0x0000005967c5)
    #3 base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:119:10 (ipc_tests+0x000000597220)
    #4 StartThread ipc/ipc_sync_channel_unittest.cc:237:13 (ipc_tests+0x0000004e0d37)
    #5 IPC::(anonymous namespace)::Worker::OnStart() ipc/ipc_sync_channel_unittest.cc:190 (ipc_tests+0x0000004e0d37)
...

  Thread T4 'reentrant_reply1_listener' (tid=1202, running) created by main thread at:
    #0 pthread_create <null> (ipc_tests+0x00000044b2d5)
    #1 base::(anonymous namespace)::CreateThread(unsigned long, bool, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:109:13 (ipc_tests+0x0000005968ba)
    #2 base::PlatformThread::CreateWithPriority(unsigned long, base::PlatformThread::Delegate*, base::PlatformThreadHandle*, base::ThreadPriority) base/threading/platform_thread_posix.cc:190:10 (ipc_tests+0x0000005967c5)
    #3 base::Thread::StartWithOptions(base::Thread::Options const&) base/threading/thread.cc:119:10 (ipc_tests+0x000000597220)
    #4 StartThread ipc/ipc_sync_channel_unittest.cc:237:13 (ipc_tests+0x0000004e099c)
    #5 IPC::(anonymous namespace)::Worker::Start() ipc/ipc_sync_channel_unittest.cc:90 (ipc_tests+0x0000004e099c)
    #6 IPC::(anonymous namespace)::RunTest(std::__1::vector<IPC::(anonymous namespace)::Worker*, std::__1::allocator<IPC::(anonymous namespace)::Worker*> >) ipc/ipc_sync_channel_unittest.cc:264:19 (ipc_tests+0x0000004df803)
...
 

Comment 1 by piman@chromium.org, Jul 15 2016

Cc: roc...@chromium.org amistry@chromium.org
+rockot, amistry who modified ipc/ most recently.

Comment 2 by piman@chromium.org, Jul 15 2016

Owner: roc...@chromium.org
The racing read was just added by https://codereview.chromium.org/2147493006
piman: Thanks for triaging. A suppression is in CQ: https://codereview.chromium.org/2149363002/
Project Member

Comment 4 by bugdroid1@chromium.org, Jul 15 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9a4dc47b2dac2f539dc0cd49bf3511145de7423a

commit 9a4dc47b2dac2f539dc0cd49bf3511145de7423a
Author: thestig <thestig@chromium.org>
Date: Fri Jul 15 04:36:23 2016

TSAN: Suppress a IPCSyncChannelTest race.

Also disable a failing SiteDataSizeCollectorTest for DrMemory.

BUG= 628475 , 628481 
TBR=glider@chromium.org

Review-Url: https://codereview.chromium.org/2149363002
Cr-Commit-Position: refs/heads/master@{#405700}

[modify] https://crrev.com/9a4dc47b2dac2f539dc0cd49bf3511145de7423a/build/sanitizers/tsan_suppressions.cc
[modify] https://crrev.com/9a4dc47b2dac2f539dc0cd49bf3511145de7423a/tools/valgrind/gtest_exclude/unit_tests.gtest-drmemory_win32.txt

Comment 5 by roc...@chromium.org, Jul 18 2016

Status: Fixed (was: Untriaged)
Project Member

Comment 6 by bugdroid1@chromium.org, Jul 18 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/078a84e8624eb27e3497bf86ae905550da8acc2d

commit 078a84e8624eb27e3497bf86ae905550da8acc2d
Author: rockot <rockot@chromium.org>
Date: Mon Jul 18 18:05:31 2016

Fix data race in IPC::ChannelProxy

Fixes a missing lock acquisition from the listener thread when
accessing |channel_|.

Also removes the TSAN suppression for this bug.

BUG= 628481 
TBR=glider@chromium.org for suppression removal

Review-Url: https://codereview.chromium.org/2158893002
Cr-Commit-Position: refs/heads/master@{#406033}

[modify] https://crrev.com/078a84e8624eb27e3497bf86ae905550da8acc2d/build/sanitizers/tsan_suppressions.cc
[modify] https://crrev.com/078a84e8624eb27e3497bf86ae905550da8acc2d/ipc/ipc_channel_proxy.cc

Sign in to add a comment