New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 629167 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jul 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

UNADDRESSABLE ACCESS at LayerTreeHostAnimationTestAddAnimationAfterAnimating::DrawLayersOnThread

Project Member Reported by isheriff@chromium.org, Jul 18 2016

Issue description

UNADDRESSABLE ACCESS: reading 0x00000008-0x0000000c 4 byte(s)
# 0 cc.dll!cc::TaskRunnerProvider::ImplThreadTaskRunner                        [cc\trees\task_runner_provider.cc:19]
# 1 cc::`anonymous namespace'::LayerTreeHostAnimationTestAddAnimationAfterAnimating::DrawLayersOnThread [cc\trees\layer_tree_host_unittest_animation.cc:1348]
# 2 cc::LayerTreeHostImplForTesting::DrawLayers                                [cc\test\layer_tree_test.cc:242]
# 3 cc.dll!cc::ProxyImpl::DrawAndSwapInternal                                  [cc\trees\proxy_impl.cc:648]
# 4 cc.dll!cc::ProxyImpl::ScheduledActionDrawAndSwapIfPossible                 [cc\trees\proxy_impl.cc:532]
# 5 cc::ProxyImplForTest::ScheduledActionDrawAndSwapIfPossible                 [cc\test\proxy_impl_for_test.cc:41]
# 6 cc.dll!cc::Scheduler::DrawAndSwapIfPossible                                [cc\scheduler\scheduler.cc:614]
# 7 cc.dll!cc::Scheduler::ProcessScheduledActions                              [cc\scheduler\scheduler.cc:691]
# 8 cc.dll!cc::Scheduler::OnBeginImplFrameDeadline                             [cc\scheduler\scheduler.cc:603]
# 9 cc.dll!base::internal::Invoker<>::Run                                      [base\bind_internal.h:324]
#10 cc.dll!base::CancelableCallback<>::Forward                                 [base\cancelable_callback.h:107]
#11 base.dll!base::debug::TaskAnnotator::RunTask                               [base\debug\task_annotator.cc:51]
#12 base.dll!base::MessageLoop::RunTask                                        [base\message_loop\message_loop.cc:494]
#13 base.dll!base::MessageLoop::DeferOrRunPendingTask                          [base\message_loop\message_loop.cc:503]
#14 base.dll!base::MessageLoop::DoWork                                         [base\message_loop\message_loop.cc:627]
#15 base.dll!base::MessagePumpDefault::Run                                     [base\message_loop\message_pump_default.cc:35]
#16 base.dll!base::MessageLoop::RunHandler                                     [base\message_loop\message_loop.cc:457]
#17 base.dll!base::Thread::Run                                                 [base\threading\thread.cc:205]
#18 base.dll!base::Thread::ThreadMain                                          [base\threading\thread.cc:256]
#19 base.dll!base::`anonymous namespace'::ThreadFunc                           [base\threading\platform_thread_win.cc:83]
#20 KERNEL32.dll!BaseThreadInitThunk                                          +0x11     (0x75bb337a <KERNEL32.dll+0x1337a>)
Note: @0:06:38.358 in thread 9232
Note: instruction: mov    0x08(%ecx) -> %eax
Suppression (error hash=#627BAF519404A899#):
For more info on using suppressions see http://dev.chromium.org/developers/how-tos/using-drmemory#TOC-Suppressing-error-reports-from-the-
{
UNADDRESSABLE ACCESS
name=<insert_a_suppression_name_here>
cc.dll!cc::TaskRunnerProvider::ImplThreadTaskRunner
*!cc::`anonymous namespace'::LayerTreeHostAnimationTestAddAnimationAfterAnimating::DrawLayersOnThread
*!cc::LayerTreeHostImplForTesting::DrawLayers
cc.dll!cc::ProxyImpl::DrawAndSwapInternal
cc.dll!cc::ProxyImpl::ScheduledActionDrawAndSwapIfPossible
*!cc::ProxyImplForTest::ScheduledActionDrawAndSwapIfPossible
cc.dll!cc::Scheduler::DrawAndSwapIfPossible
cc.dll!cc::Scheduler::ProcessScheduledActions
cc.dll!cc::Scheduler::OnBeginImplFrameDeadline
cc.dll!base::internal::Invoker<>::Run
cc.dll!base::CancelableCallback<>::Forward
base.dll!base::debug::TaskAnnotator::RunTask
base.dll!base::MessageLoop::RunTask
base.dll!base::MessageLoop::DeferOrRunPendingTask
base.dll!base::MessageLoop::DoWork
base.dll!base::MessagePumpDefault::Run
base.dll!base::MessageLoop::RunHandler
base.dll!base::Thread::Run
base.dll!base::Thread::ThreadMain
base.dll!base::`anonymous namespace'::ThreadFunc
KERNEL32.dll!BaseThreadInitThunk
}

First occurence appears to be at https://build.chromium.org/p/chromium.memory.fyi/builders/Windows%20Unit%20%28DrMemory%20full%29%20%285%29/builds/7742

CL of concern at https://codereview.chromium.org/2151433004
 

Comment 1 by danakj@chromium.org, Jul 18 2016

Status: Started (was: Untriaged)
Project Member

Comment 2 by bugdroid1@chromium.org, Jul 18 2016

Project Member

Comment 3 by bugdroid1@chromium.org, Jul 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/833b2e5026669ee6c7167cdff371452ab47cd2dc

commit 833b2e5026669ee6c7167cdff371452ab47cd2dc
Author: danakj <danakj@chromium.org>
Date: Tue Jul 19 01:55:55 2016

cc: Fix use-after-frees for LayerTreeHostAnimationTest.

This fixes the LayerTreeHostAnimationTestAddAnimationAfterAnimating test
directly by only doing the animations check a single time.

While trying to understand the crash (I still don't), I uncovered some
maybe questionable things in LayerTreeTest, so I tried to clean that up
a bit:
- Do not go through layer_tree_host() from the compositor thread to get
the compositor thread task runner. Instead store it at test startup on
the main thread.
- Stop allowing the task runner provider to be null in tests, just don't
allow tests to call into layer_tree_host() after the test has stopped.

R=enne, vmpstr
BUG= 629167 
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2155123003
Cr-Commit-Position: refs/heads/master@{#406176}

[modify] https://crrev.com/833b2e5026669ee6c7167cdff371452ab47cd2dc/cc/test/layer_tree_test.cc
[modify] https://crrev.com/833b2e5026669ee6c7167cdff371452ab47cd2dc/cc/test/layer_tree_test.h
[modify] https://crrev.com/833b2e5026669ee6c7167cdff371452ab47cd2dc/cc/trees/layer_tree_host_unittest_animation.cc
[modify] https://crrev.com/833b2e5026669ee6c7167cdff371452ab47cd2dc/cc/trees/task_runner_provider.h

Comment 4 by danakj@chromium.org, Jul 19 2016

Status: Fixed (was: Started)
Project Member

Comment 5 by bugdroid1@chromium.org, Jul 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/79a558a9666b5a09aa69167dd1b436a2ed5add2c

commit 79a558a9666b5a09aa69167dd1b436a2ed5add2c
Author: danakj <danakj@chromium.org>
Date: Tue Jul 19 02:06:17 2016

Revert of Exclude flaky test on DrMemory (patchset #2 id:20001 of https://codereview.chromium.org/2160783002/ )

Reason for revert:
Test should be fixed, this is no longer needed.

Original issue's description:
> Exclude flaky test on DrMemory
>
> TBR=thestig@chromium.org
> BUG= 629167 
>
> Committed: https://crrev.com/ad440f02c69a7e7ef7efb0129d881a445ca2e8d6
> Cr-Commit-Position: refs/heads/master@{#406113}

TBR=thestig@chromium.org,isheriff@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= 629167 

Review-Url: https://codereview.chromium.org/2165463002
Cr-Commit-Position: refs/heads/master@{#406186}

[modify] https://crrev.com/79a558a9666b5a09aa69167dd1b436a2ed5add2c/tools/valgrind/gtest_exclude/cc_unittests.gtest-drmemory_win32.txt

Sign in to add a comment