New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 646615 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Sep 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

CFI: invalid cast in BytesConsumerTeeTest

Project Member Reported by krasin@chromium.org, Sep 13 2016

Issue description

CFI Linux Full bot is currently broken:
https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux%20Full/builds/357

In particular, BytesConsumerTeeTest of webkit_unit_tests is failing under CFI (https://www.chromium.org/developers/testing/control-flow-integrity) check:

Starting program: /usr/local/google/home/krasin/chr22/src/out/cfi-diag-tot/webkit_unit_tests --gtest_filter=BytesConsumerTeeTest.Error
Note: Google Test filter = BytesConsumerTeeTest.Error
[==========] Running 1 test from 1 test case.
[----------] Global test environment set-up.
[----------] 1 test from BytesConsumerTeeTest
[ RUN      ] BytesConsumerTeeTest.Error
[       OK ] BytesConsumerTeeTest.Error (3 ms)
[----------] 1 test from BytesConsumerTeeTest (3 ms total)

[----------] Global test environment tear-down
[==========] 1 test from 1 test case ran. (3 ms total)
[  PASSED  ] 1 test.
../../third_party/WebKit/Source/platform/heap/GCInfo.h:37:9: runtime error: control flow integrity check for type 'blink::BytesConsumerTestUtil::Reader' failed during cast to unrelated type (vtable address 0x000003404d30)
0x000003404d30: note: vtable is of type 'blink::BytesConsumerTestUtil::TwoPhaseReader'
 00 00 00 00  40 5c ad 00 00 00 00 00  00 ed ac 00 00 00 00 00  d0 5c ad 00 00 00 00 00  f0 ec ac 00
              ^ 
../../third_party/WebKit/Source/platform/heap/GarbageCollected.h:230:9: runtime error: control flow integrity check for type 'blink::BytesConsumerTestUtil::Reader' failed during base-to-derived cast (vtable address 0x000003404d30)
0x000003404d30: note: vtable is of type 'blink::BytesConsumerTestUtil::TwoPhaseReader'
 00 00 00 00  40 5c ad 00 00 00 00 00  00 ed ac 00 00 00 00 00  d0 5c ad 00 00 00 00 00  f0 ec ac 00

The test was introduced in https://codereview.chromium.org/2269953004

The bug is a copy-paste issue here:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/modules/fetch/BytesConsumerTestUtil.h?sq=package:chromium&dr=CSs&l=107

class TwoPhaseReader final : public GarbageCollectedFinalized<Reader>, public BytesConsumer::Client

I will send a fix in a moment.
 

Comment 2 by krasin@chromium.org, Sep 13 2016

Cc: euge...@chromium.org
+eugenis, the sanitizers bots sheriff for this week.
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 14 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/92e83e4271b8e16920342834bb6948e9d2604eab

commit 92e83e4271b8e16920342834bb6948e9d2604eab
Author: krasin <krasin@chromium.org>
Date: Wed Sep 14 03:11:37 2016

Fix copy-paste issue in BytesConsumerTestUtil::TwoPhaseReader.

It was causing an invalid cast and was the reason for
'CFI Linux Full' bot being red.

BUG= 646615 

Review-Url: https://codereview.chromium.org/2339563003
Cr-Commit-Position: refs/heads/master@{#418473}

[modify] https://crrev.com/92e83e4271b8e16920342834bb6948e9d2604eab/third_party/WebKit/Source/modules/fetch/BytesConsumerTestUtil.h

Comment 4 by krasin@chromium.org, Sep 14 2016

Status: Fixed (was: Untriaged)

Sign in to add a comment