LayerTreeHostScrollbarsPixelTest.HugeTransformScale fails on MSAN |
||||
Issue descriptionFirst seen at https://build.chromium.org/p/chromium.memory.full/builders/Linux%20MSan%20Tests/builds/767 Since it shows up on third_party/mesa, not sure what the best course of action is. === LayerTreeHostScrollbarsPixelTest.HugeTransformScale (run #1): [ RUN ] LayerTreeHostScrollbarsPixelTest.HugeTransformScale ==24184==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x7fc0e1972ffe in ?? third_party/mesa/src/src/mesa/swrast/s_texfetch_tmp.h:397:19 #1 0x7fc0e19ccae6 in sample_2d_linear third_party/mesa/src/src/mesa/swrast/s_texfilter.c:1182:7 #2 0x7fc0e19b4630 in ?? third_party/mesa/src/src/mesa/swrast/s_texfilter.c:1396:10 #3 0x7fc0e192d173 in fetch_texel_lod third_party/mesa/src/src/mesa/swrast/s_fragprog.c:91:7 #4 0x7fc0e18809ae in fetch_texel third_party/mesa/src/src/mesa/program/prog_execute.c:408:7 #5 0x7fc0e18809ae in _mesa_execute_program third_party/mesa/src/src/mesa/program/prog_execute.c:1662:0 #6 0x7fc0e192c2b4 in run_program third_party/mesa/src/src/mesa/swrast/s_fragprog.c:227:14 #7 0x7fc0e192c2b4 in _swrast_exec_fragment_program third_party/mesa/src/src/mesa/swrast/s_fragprog.c:284:0 #8 0x7fc0e194cfe4 in _swrast_write_rgba_span third_party/mesa/src/src/mesa/swrast/s_span.c:1261:7 #9 0x7fc0e19edeb4 in general_triangle third_party/mesa/src/src/mesa/swrast/s_tritemp.h:819:22 #10 0x7fc0e1a8d2df in ?? third_party/mesa/src/src/mesa/tnl/t_vb_rendertmp.h:352:3 #11 0x7fc0e1a8de7f in ?? third_party/mesa/src/src/mesa/tnl/t_vb_render.c:245:4 #12 0x7fc0e1a9f34b in clip_tri_4 third_party/mesa/src/src/mesa/tnl/t_vb_cliptmp.h:259:4 #13 0x7fc0e1a8e9e7 in ?? third_party/mesa/src/src/mesa/tnl/t_vb_render.c:174:6 #14 0x7fc0e1a8e399 in run_render third_party/mesa/src/src/mesa/tnl/t_vb_render.c:321:6 #15 0x7fc0e1a54ee0 in _tnl_run_pipeline third_party/mesa/src/src/mesa/tnl/t_pipeline.c:163:12 #16 0x7fc0e1a51de7 in _tnl_draw_prims third_party/mesa/src/src/mesa/tnl/t_draw.c:524:13 #17 0x7fc0e1a43bd8 in ?? third_party/mesa/src/src/mesa/tnl/t_draw.c:424:4 #18 0x7fc0e1b33123 in vbo_handle_primitive_restart third_party/mesa/src/src/mesa/vbo/vbo_exec_array.c:570:7 #19 0x7fc0e1b33123 in vbo_validated_drawrangeelements third_party/mesa/src/src/mesa/vbo/vbo_exec_array.c:867:0 #20 0x7fc0e1b2deed in ?? third_party/mesa/src/src/mesa/vbo/vbo_exec_array.c:997:4 #21 0x57caaf6 in DoDrawElements gpu/command_buffer/service/gles2_cmd_decoder.cc:9427:9 #22 0x56d2fd2 in ?? gpu/command_buffer/service/gles2_cmd_decoder.cc:9462:10 #23 0x578e1df in DoCommandsImpl\u003Cfalse> gpu/command_buffer/service/gles2_cmd_decoder.cc:5034:18 #24 0x590ee4e in ?? gpu/command_buffer/service/cmd_parser.cc:53:35 #25 0x5639058 in PutChanged gpu/command_buffer/service/command_executor.cc:61:22 #26 0x556e1e9 in PumpCommandsOnGpuThread gpu/command_buffer/service/in_process_command_buffer.cc:249:14 #27 0x55775da in FlushOnGpuThread gpu/command_buffer/service/in_process_command_buffer.cc:520:22 #28 0x3f0b306 in Run base/callback.h:388:12 #29 0x3f0b306 in RunTask base/debug/task_annotator.cc:54:0 #30 0x3dceedb in RunTask base/message_loop/message_loop.cc:488:19 #31 0x3dd0a17 in DeferOrRunPendingTask base/message_loop/message_loop.cc:497:5 #32 0x3dd25b8 in DoWork base/message_loop/message_loop.cc:621:13 #33 0x3dddefa in Run base/message_loop/message_pump_default.cc:35:31 #34 0x3e1d89c in Run base/run_loop.cc:35:10 #35 0x3e6bb8c in ThreadMain base/threading/thread.cc:301:3 #36 0x3e5e745 in ThreadFunc base/threading/platform_thread_posix.cc:71:13 #37 0x7fc0e5d06e99 in start_thread /build/eglibc-oqps9y/eglibc-2.15/nptl/pthread_create.c:308:0 #38 0x7fc0e581e36c in ?? /build/eglibc-oqps9y/eglibc-2.15/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:112:0 Uninitialized value was stored to memory at #0 0x7fc0e17864cb in swizzle_copy third_party/mesa/src/src/mesa/main/texstore.c:714:10 #1 0x7fc0e17834f7 in _mesa_swizzle_ubyte_image third_party/mesa/src/src/mesa/main/texstore.c:900:7 #2 0x7fc0e175295a in _mesa_texstore_rgba8888 third_party/mesa/src/src/mesa/main/texstore.c:1282:7 #3 0x7fc0e1750e7d in store_texsubimage third_party/mesa/src/src/mesa/main/texstore.c:4361:20 #4 0x7fc0e1751319 in ?? third_party/mesa/src/src/mesa/main/texstore.c:4425:4 #5 0x7fc0e1722a72 in texsubimage third_party/mesa/src/src/mesa/main/teximage.c:3280:10 #6 0x7fc0e172344f in ?? third_party/mesa/src/src/mesa/main/teximage.c:3316:4 #7 0x3cd6dad in CustomTexSubImage2D ui/gl/gl_gl_api_implementation.cc:245:3 #8 0x3d209eb in ?? ui/gl/gl_bindings_autogen_gl.cc:8579:3 #9 0x562b9a7 in ValidateAndDoTexSubImage gpu/command_buffer/service/texture_manager.cc:2708:7 #10 0x570bce6 in HandleTexSubImage2D gpu/command_buffer/service/gles2_cmd_decoder.cc:13390:22 #11 0x578e1df in DoCommandsImpl\u003Cfalse> gpu/command_buffer/service/gles2_cmd_decoder.cc:5034:18 #12 0x590ee4e in ?? gpu/command_buffer/service/cmd_parser.cc:53:35 #13 0x5639058 in PutChanged gpu/command_buffer/service/command_executor.cc:61:22 #14 0x556e1e9 in PumpCommandsOnGpuThread gpu/command_buffer/service/in_process_command_buffer.cc:249:14 #15 0x55775da in FlushOnGpuThread gpu/command_buffer/service/in_process_command_buffer.cc:520:22 #16 0x3f0b306 in Run base/callback.h:388:12 #17 0x3f0b306 in RunTask base/debug/task_annotator.cc:54:0 #18 0x3dceedb in RunTask base/message_loop/message_loop.cc:488:19 #19 0x3dd0a17 in DeferOrRunPendingTask base/message_loop/message_loop.cc:497:5 #20 0x3dd25b8 in DoWork base/message_loop/message_loop.cc:621:13 Uninitialized value was stored to memory at #0 0x7fc0e17863f7 in COPY_4UBV third_party/mesa/src/src/mesa/main/macros.h:245:4 #1 0x7fc0e17863f7 in swizzle_copy third_party/mesa/src/src/mesa/main/texstore.c:714:0 #2 0x7fc0e17834f7 in _mesa_swizzle_ubyte_image third_party/mesa/src/src/mesa/main/texstore.c:900:7 #3 0x7fc0e175295a in _mesa_texstore_rgba8888 third_party/mesa/src/src/mesa/main/texstore.c:1282:7 #4 0x7fc0e1750e7d in store_texsubimage third_party/mesa/src/src/mesa/main/texstore.c:4361:20 #5 0x7fc0e1751319 in ?? third_party/mesa/src/src/mesa/main/texstore.c:4425:4 #6 0x7fc0e1722a72 in texsubimage third_party/mesa/src/src/mesa/main/teximage.c:3280:10 #7 0x7fc0e172344f in ?? third_party/mesa/src/src/mesa/main/teximage.c:3316:4 #8 0x3cd6dad in CustomTexSubImage2D ui/gl/gl_gl_api_implementation.cc:245:3 #9 0x3d209eb in ?? ui/gl/gl_bindings_autogen_gl.cc:8579:3 #10 0x562b9a7 in ValidateAndDoTexSubImage gpu/command_buffer/service/texture_manager.cc:2708:7 #11 0x570bce6 in HandleTexSubImage2D gpu/command_buffer/service/gles2_cmd_decoder.cc:13390:22 #12 0x578e1df in DoCommandsImpl\u003Cfalse> gpu/command_buffer/service/gles2_cmd_decoder.cc:5034:18 #13 0x590ee4e in ?? gpu/command_buffer/service/cmd_parser.cc:53:35 #14 0x5639058 in PutChanged gpu/command_buffer/service/command_executor.cc:61:22 #15 0x556e1e9 in PumpCommandsOnGpuThread gpu/command_buffer/service/in_process_command_buffer.cc:249:14 #16 0x55775da in FlushOnGpuThread gpu/command_buffer/service/in_process_command_buffer.cc:520:22 #17 0x3f0b306 in Run base/callback.h:388:12 #18 0x3f0b306 in RunTask base/debug/task_annotator.cc:54:0 #19 0x3dceedb in RunTask base/message_loop/message_loop.cc:488:19 #20 0x3dd0a17 in DeferOrRunPendingTask base/message_loop/message_loop.cc:497:5 #21 0x3dd25b8 in DoWork base/message_loop/message_loop.cc:621:13 Uninitialized value was stored to memory at #0 0x626904 in __msan_memcpy ??:0 #1 0x534cbdb in CopyRectToBuffer gpu/command_buffer/client/gles2_implementation.cc:72:5 #2 0x534cbdb in TexSubImage2DImpl gpu/command_buffer/client/gles2_implementation.cc:3062:0 #3 0x535448c in TexSubImage2D gpu/command_buffer/client/gles2_implementation.cc:2878:3 #4 0x3601305 in CopyToResource cc/resources/resource_provider.cc:872:11 #5 0x37dca26 in CreateUIResource cc/trees/layer_tree_host_impl.cc:3827:25 #6 0x3819c5f in ProcessUIResourceRequestQueue cc/trees/layer_tree_impl.cc:1576:32 #7 0x37beabc in ActivateSyncTree cc/trees/layer_tree_host_impl.cc:2038:20 #8 0x39e5d46 in ?? cc/test/layer_tree_test.cc:225:24 #9 0x3956941 in ScheduledActionActivateSyncTree cc/trees/proxy_impl.cc:552:26 #10 0x365dc13 in ProcessScheduledActions cc/scheduler/scheduler.cc:682:18 #11 0x3660608 in NotifyReadyToCommit cc/scheduler/scheduler.cc:177:3 #12 0x394c979 in NotifyReadyToCommitOnImpl cc/trees/proxy_impl.cc:270:15 #13 0x3f0b306 in Run base/callback.h:388:12 #14 0x3f0b306 in RunTask base/debug/task_annotator.cc:54:0 #15 0x3dceedb in RunTask base/message_loop/message_loop.cc:488:19 #16 0x3dd0a17 in DeferOrRunPendingTask base/message_loop/message_loop.cc:497:5 #17 0x3dd25b8 in DoWork base/message_loop/message_loop.cc:621:13 #18 0x3dddefa in Run base/message_loop/message_pump_default.cc:35:31 #19 0x3e1d89c in Run base/run_loop.cc:35:10 #20 0x3e6bb8c in ThreadMain base/threading/thread.cc:301:3 #21 0x3e5e745 in ThreadFunc base/threading/platform_thread_posix.cc:71:13 Uninitialized value was created by a heap allocation #0 0x62d232 in malloc ??:0 #1 0x3e1b659 in ?? base/process/memory_linux.cc:203:13 #2 0x3f5cd06 in sk_malloc_nothrow skia/ext/SkMemory_new_handler.cpp:75:19 #3 0x3f5cd06 in sk_malloc_flags skia/ext/SkMemory_new_handler.cpp:87:0 #4 0x407cc7a in operator() third_party/skia/src/core/SkMallocPixelRef.cpp:93:55 #5 0x407cc7a in __invoke third_party/skia/src/core/SkMallocPixelRef.cpp:93:0 #6 0x407cc7a in SkMallocPixelRef third_party/skia/src/core/SkMallocPixelRef.cpp:186:0 #7 0x407cc7a in NewUsing third_party/skia/src/core/SkMallocPixelRef.cpp:87:0 #8 0x407cc7a in NewAllocate third_party/skia/src/core/SkMallocPixelRef.cpp:94:0 #9 0x3f6f4d5 in tryAllocPixels third_party/skia/src/core/SkBitmap.cpp:302:37 #10 0x37dc70f in allocPixels third_party/skia/include/core/SkBitmap.h:265:20 #11 0x37dc70f in allocPixels third_party/skia/include/core/SkBitmap.h:275:0 #12 0x37dc70f in allocN32Pixels third_party/skia/include/core/SkBitmap.h:287:0 #13 0x37dc70f in CreateUIResource cc/trees/layer_tree_host_impl.cc:3820:0 #14 0x3819c5f in ProcessUIResourceRequestQueue cc/trees/layer_tree_impl.cc:1576:32 #15 0x37beabc in ActivateSyncTree cc/trees/layer_tree_host_impl.cc:2038:20 #16 0x39e5d46 in ?? cc/test/layer_tree_test.cc:225:24 #17 0x3956941 in ScheduledActionActivateSyncTree cc/trees/proxy_impl.cc:552:26 #18 0x365dc13 in ProcessScheduledActions cc/scheduler/scheduler.cc:682:18 #19 0x3660608 in NotifyReadyToCommit cc/scheduler/scheduler.cc:177:3 #20 0x394c979 in NotifyReadyToCommitOnImpl cc/trees/proxy_impl.cc:270:15 #21 0x3f0b306 in Run base/callback.h:388:12 #22 0x3f0b306 in RunTask base/debug/task_annotator.cc:54:0 #23 0x3dceedb in RunTask base/message_loop/message_loop.cc:488:19 #24 0x3dd0a17 in DeferOrRunPendingTask base/message_loop/message_loop.cc:497:5 #25 0x3dd25b8 in DoWork base/message_loop/message_loop.cc:621:13 #26 0x3dddefa in Run base/message_loop/message_pump_default.cc:35:31 #27 0x3e1d89c in Run base/run_loop.cc:35:10 #28 0x3e6bb8c in ThreadMain base/threading/thread.cc:301:3 SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/swarm_slave/w/irYNv7Zf/out/Release/libosmesa.so+0x776ffe) Exiting
,
Aug 29 2016
Well, I want to repro but msan fails much earlier for me.. when opening the X display:
Uninitialized bytes in __interceptor_fopen at offset 0 inside [0x70300003f060, 42)
==30094==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f9d8b7f82b6 in XauGetBestAuthByAddr (/usr/lib/x86_64-linux-gnu/libXau.so.6+0x12b6)
#1 0x7f9d925121b3 (/usr/lib/x86_64-linux-gnu/libxcb.so.1+0xd1b3)
#2 0x7f9d925123bc (/usr/lib/x86_64-linux-gnu/libxcb.so.1+0xd3bc)
#3 0x7f9d92511fe3 in xcb_connect_to_display_with_auth_info (/usr/lib/x86_64-linux-gnu/libxcb.so.1+0xcfe3)
#4 0x7f9d92962329 in _XConnectXCB (/usr/lib/x86_64-linux-gnu/libX11.so.6+0x3b329)
#5 0x7f9d9295388e in XOpenDisplay (/usr/lib/x86_64-linux-gnu/libX11.so.6+0x2c88e)
#6 0x7f9d9092423f in gfx::OpenNewXDisplay() ui/gfx/x/x11_types.cc:29:10
#7 0x7f9d90923fb2 in gfx::GetXDisplay() ui/gfx/x/x11_types.cc:19:15
#8 0x7f9d97a25235 in gl::GLSurfaceOSMesaX11::InitializeOneOff() ui/gl/gl_surface_osmesa_x11.cc:35:8
#9 0x7f9d9a0fcd8f in gl::init::InitializeGLOneOffPlatform() ui/gl/init/gl_initializer_x11.cc:135:12
#10 0x7f9d9a0f2deb in gl::init::InitializeGLOneOffImplementation(gl::GLImplementation, bool, bool, bool) ui/gl/init/gl_factory.cc:65:43
#11 0x34e5f98 in gl::GLSurfaceTestSupport::InitializeOneOff() ui/gl/test/gl_surface_test_support.cc:62:3
#12 0x3183274 in cc::CCTestSuite::Initialize() cc/test/cc_test_suite.cc:21:3
#13 0x33b74ac in base::TestSuite::Run() base/test/test_suite.cc:234:3
#14 0x33bd02b in Run base/callback.h:388:12
#15 0x33bd02b in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback<int (), (base::internal::CopyMode)1> const&, int, int, bool, base::Callback<void (), (base::internal::CopyMode)1> const&) base/test/launcher/unit_test_launcher.cc:206
#16 0x33bc8a7 in base::LaunchUnitTests(int, char**, base::Callback<int (), (base::internal::CopyMode)1> const&) base/test/launcher/unit_test_launcher.cc:445:10
#17 0x31837f7 in main cc/test/run_all_unittests.cc:15:10
#18 0x7f9d909dbf44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287
#19 0x651684 in _start (/usr/local/google/home/danakj/s/c/src/out_desktop/Release/cc_unittests+0x651684)
Uninitialized value was created by a heap allocation
#0 0x676c92 in __interceptor_malloc (/usr/local/google/home/danakj/s/c/src/out_desktop/Release/cc_unittests+0x676c92)
#1 0x7f9d8b7f8040 in XauFileName (/usr/lib/x86_64-linux-gnu/libXau.so.6+0x1040)
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/usr/lib/x86_64-linux-gnu/libXau.so.6+0x12b6) in XauGetBestAuthByAddr
Exiting
[0829/130624:ERROR:unit_test_launcher.cc(316)] no test result for LayerTreeHostScrollbarsPixelTest.HugeTransformScale
[1/1] LayerTreeHostScrollbarsPixelTest.HugeTransformScale (UNKNOWN)
,
Aug 29 2016
any tips? ^
,
Aug 29 2016
,
Aug 29 2016
Did you set use_prebuilt_instrumented_libraries=true as documented at http://dev.chromium.org/developers/testing/memorysanitizer? I get the failure in libosmesa.so.
,
Aug 29 2016
Interestingly enough, I think this explains https://bugs.chromium.org/p/chromium/issues/detail?id=641056 somewhat. For some reason the background of the bitmap is initialized different or something when DCHECKs are on, and so in some modes (DCHECK on or off, not sure..) it ends up with uninit memory. So Ill fix both in one swoop.
,
Aug 29 2016
,
Aug 29 2016
> Did you set use_prebuilt_instrumented_libraries=true as documente Ah, nope thanks for pointing it out.
,
Aug 29 2016
Although that fails differently when I try to compile instead:
[1/342] ACTION //third_party/instrumented_libraries:extrac..._instrumented_libraries(//build/toolchain/linux:clang_x64)
FAILED: obj/third_party/instrumented_libraries/msan-chained-origins.txt
python ../../third_party/instrumented_libraries/scripts/unpack_binaries.py msan-chained-origins /usr/local/google/home/danakj/s/c/src/third_party/instrumented_libraries/binaries /usr/local/google/home/danakj/s/c/src/out_desktop/Release/instrumented_libraries_prebuilt obj/third_party/instrumented_libraries
tar (child): /usr/local/google/home/danakj/s/c/src/third_party/instrumented_libraries/binaries/msan-chained-origins-trusty.tgz: Cannot open: No such file or directory
tar (child): Error is not recoverable: exiting now
tar: Child returned status 2
tar: Error is not recoverable: exiting now
Traceback (most recent call last):
File "../../third_party/instrumented_libraries/scripts/unpack_binaries.py", line 42, in <module>
sys.exit(main(*sys.argv[1:]))
File "../../third_party/instrumented_libraries/scripts/unpack_binaries.py", line 29, in main
target_dir])
File "/usr/lib/python2.7/subprocess.py", line 540, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['tar', '-zxf', '/usr/local/google/home/danakj/s/c/src/third_party/instrumented_libraries/binaries/msan-chained-origins-trusty.tgz', '-C', '/usr/local/google/home/danakj/s/c/src/out_desktop/Release/instrumented_libraries_prebuilt']' returned non-zero exit status 2
ninja: build stopped: cannot make progress due to previous errors.
% ls third_party/instrumented_libraries/binaries/
msan-chained-origins-precise.tgz.sha1 msan-no-origins-precise.tgz.sha1
msan-chained-origins-trusty.tgz.sha1 msan-no-origins-trusty.tgz.sha1
I don't think I have the binaries.
,
Aug 29 2016
Anyhow.. I think I have a fix I just can't verify it makes msan happy, but it fixes my problem from 641056
,
Aug 29 2016
Libraries are downloaded in a DEPS hook that needs to know about MSan: GYP_DEFINES='msan=1 use_prebuilt_instrumented_libraries=1' gclient runhooks
,
Aug 29 2016
ohh.. I totally read GYP_DEFINES and glossed over that section. :|
,
Aug 29 2016
Ok thanks! Confirmed that https://codereview.chromium.org/2292713002/# fixes it.
,
Aug 29 2016
We just had the GYP_DEFINES discussion on chromium-dev last week. I'll add some <blink> tags. ;-)
,
Aug 30 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8d737f8882e170b93ec3224642fa7f6a552817f3 commit 8d737f8882e170b93ec3224642fa7f6a552817f3 Author: danakj <danakj@chromium.org> Date: Tue Aug 30 04:56:47 2016 Clear the scaled bitmap before drawing into it for huge UIResources. When the UIResource is larger than max_texture_size, we downsample it into a smaller bitmap. However floating point precision can cause some of the pixels to not be fully initialized if the scale doesn't exactly cause the bitmap to be filled. So clear the bitmap before doing this scaling operation into it. R=enne BUG= 642011 CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel Review-Url: https://codereview.chromium.org/2292713002 Cr-Commit-Position: refs/heads/master@{#415124} [modify] https://crrev.com/8d737f8882e170b93ec3224642fa7f6a552817f3/cc/test/data/spiral_64_scale.png [modify] https://crrev.com/8d737f8882e170b93ec3224642fa7f6a552817f3/cc/trees/layer_tree_host_impl.cc [modify] https://crrev.com/8d737f8882e170b93ec3224642fa7f6a552817f3/cc/trees/layer_tree_host_pixeltest_scrollbars.cc
,
Sep 6 2016
|
||||
►
Sign in to add a comment |
||||
Comment 1 by danakj@chromium.org
, Aug 29 2016Status: Started (was: Untriaged)