New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 633145 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Aug 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in jsimd_can_ycc_rgb

Project Member Reported by ClusterFuzz, Aug 1 2016

Issue description

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4814683098054656

Fuzzer: attekett_dom_fuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 4
Crash Address: 0x7f4de7e1c9c8
Crash State:
  jsimd_can_ycc_rgb
  chromium_jinit_color_deconverter
  chromium_jinit_master_decompress
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=391873:391931

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96SkP4M_zaFkOq-X1nd0pnC_zVBdhBV2Q3fvyXFQJEB8MRhy-5ghCNd2C6Ik4-_D1X0HIPDXKWP4qEPiFNo88Y04KzSqVxaIWYY7JKYSGhj6ahsJYRRZh7CeBjddcousecjF6l1jxwRr2jU3pnfpkiz5fq0RdMDR0iapP-18fQtbeHOxbU?testcase_id=4814683098054656


Filer: nyerramilli

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: nyerramilli@chromium.org
Components: Tools>Test>FindIt>CorrectResult
Labels: Findit-for-crash Te-Logged
Owner: tomhud...@chromium.org
Status: Assigned (was: Untriaged)
based on Findit results, assigning to 'Tom Hudson@, Would you mind checking the above issue & see if it's related, please re-assign if it is not related to your change.

Suspected CLs	The result is a list of CLs that change the crashed files.

Author: Tom Hudson
Project: chromium-libjpeg_turbo
Changelist: https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git/+/0d47d2d3a728e78676a15b1d818cc668cb7e5a9c
Time: Wed May 04 17:22:56 2016
Lines 46-53 of file jsimd_x86_64.c which potentially caused crash are changed in this cl (frame #0, "jsimd_can_ycc_rgb").

Files jdmaster.c, jdcolor.c, jdapistd.c are changed in this cl (and is part of stack frame #2, "chromium_jinit_master_decompress")
Minimum distance from crash line to modified line: 0. (file: jsimd_x86_64.c, crashed on: 43, modified: 43).

Suspected Project: chromium-libjpeg_turbo
Cc: tomhud...@chromium.org
Owner: msarett@chromium.org
Matt knows that code well.
Cc: scroggo@chromium.org
This race is benign.  It's a known issue in libjpeg-turbo, and they aren't going to fix it.
https://github.com/libjpeg-turbo/libjpeg-turbo/issues/87

This is fixed in Google3 - they've made downstream modifications to the library.
https://critique.corp.google.com/#review/126435871

I'd prefer to keep the copy in Chrome clean and suppress the error.  Will look if Chrome has TSAN suppressions.
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 2 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b8135adecd3983318355c8d069b06165351635f4

commit b8135adecd3983318355c8d069b06165351635f4
Author: msarett <msarett@google.com>
Date: Tue Aug 02 19:53:00 2016

Suppress benign race in libjpeg-turbo

BUG= 633145 

Review-Url: https://codereview.chromium.org/2201163002
Cr-Commit-Position: refs/heads/master@{#409284}

[modify] https://crrev.com/b8135adecd3983318355c8d069b06165351635f4/build/sanitizers/tsan_suppressions.cc

Status: Fixed (was: Assigned)
Project Member

Comment 6 by ClusterFuzz, Aug 3 2016

ClusterFuzz has detected this issue as fixed in range 409223:409418.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4814683098054656

Fuzzer: attekett_dom_fuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race READ 4
Crash Address: 0x7f4de7e1c9c8
Crash State:
  jsimd_can_ycc_rgb
  chromium_jinit_color_deconverter
  chromium_jinit_master_decompress
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=391873:391931
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=409223:409418

Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96SkP4M_zaFkOq-X1nd0pnC_zVBdhBV2Q3fvyXFQJEB8MRhy-5ghCNd2C6Ik4-_D1X0HIPDXKWP4qEPiFNo88Y04KzSqVxaIWYY7JKYSGhj6ahsJYRRZh7CeBjddcousecjF6l1jxwRr2jU3pnfpkiz5fq0RdMDR0iapP-18fQtbeHOxbU?testcase_id=4814683098054656


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by sheriffbot@chromium.org, Nov 22 2016

Labels: -Restrict-View-EditIssue
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment