Data race in jsimd_can_ycc_rgb |
|||||
Issue descriptionDetailed report: https://cluster-fuzz.appspot.com/testcase?key=4814683098054656 Fuzzer: attekett_dom_fuzzer Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 4 Crash Address: 0x7f4de7e1c9c8 Crash State: jsimd_can_ycc_rgb chromium_jinit_color_deconverter chromium_jinit_master_decompress Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=391873:391931 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96SkP4M_zaFkOq-X1nd0pnC_zVBdhBV2Q3fvyXFQJEB8MRhy-5ghCNd2C6Ik4-_D1X0HIPDXKWP4qEPiFNo88Y04KzSqVxaIWYY7JKYSGhj6ahsJYRRZh7CeBjddcousecjF6l1jxwRr2jU3pnfpkiz5fq0RdMDR0iapP-18fQtbeHOxbU?testcase_id=4814683098054656 Filer: nyerramilli See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Aug 1 2016
Matt knows that code well.
,
Aug 2 2016
This race is benign. It's a known issue in libjpeg-turbo, and they aren't going to fix it. https://github.com/libjpeg-turbo/libjpeg-turbo/issues/87 This is fixed in Google3 - they've made downstream modifications to the library. https://critique.corp.google.com/#review/126435871 I'd prefer to keep the copy in Chrome clean and suppress the error. Will look if Chrome has TSAN suppressions.
,
Aug 2 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/b8135adecd3983318355c8d069b06165351635f4 commit b8135adecd3983318355c8d069b06165351635f4 Author: msarett <msarett@google.com> Date: Tue Aug 02 19:53:00 2016 Suppress benign race in libjpeg-turbo BUG= 633145 Review-Url: https://codereview.chromium.org/2201163002 Cr-Commit-Position: refs/heads/master@{#409284} [modify] https://crrev.com/b8135adecd3983318355c8d069b06165351635f4/build/sanitizers/tsan_suppressions.cc
,
Aug 2 2016
,
Aug 3 2016
ClusterFuzz has detected this issue as fixed in range 409223:409418. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4814683098054656 Fuzzer: attekett_dom_fuzzer Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 4 Crash Address: 0x7f4de7e1c9c8 Crash State: jsimd_can_ycc_rgb chromium_jinit_color_deconverter chromium_jinit_master_decompress Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=391873:391931 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_tsan_chrome_mp&range=409223:409418 Unminimized Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96SkP4M_zaFkOq-X1nd0pnC_zVBdhBV2Q3fvyXFQJEB8MRhy-5ghCNd2C6Ik4-_D1X0HIPDXKWP4qEPiFNo88Y04KzSqVxaIWYY7JKYSGhj6ahsJYRRZh7CeBjddcousecjF6l1jxwRr2jU3pnfpkiz5fq0RdMDR0iapP-18fQtbeHOxbU?testcase_id=4814683098054656 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Nov 22 2016
Removing EditIssue view restrictions from ClusterFuzz filed bugs. If you believe that this issue should still be restricted, please reapply the label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by nyerramilli@google.com
, Aug 1 2016Components: Tools>Test>FindIt>CorrectResult
Labels: Findit-for-crash Te-Logged
Owner: tomhud...@chromium.org
Status: Assigned (was: Untriaged)