New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 655236 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 654895
Owner:
Closed: Oct 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Segmentation fault in base::FileDescriptorWatcher::Controller::Controller

Project Member Reported by krasin@chromium.org, Oct 12 2016

Issue description

CFI Linux buildbot has one test case (LocalInputMonitorTest.Basic) failing in remoting_unittests:
https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux/builds/6679

The reason is a segfault:
Starting program: /usr/local/google/home/krasin/chr31/src/out/cfi-diag/remoting_unittests --gtest_filter=LocalInputMonitorTest.Basic --single_process
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/grte/v4/lib64/libthread_db.so.1".
Debugger detected, switching to single process mode.
Pass --test-launcher-debug-launcher to debug the launcher itself.
Detected presence of a debugger, running without test timeouts.
Note: Google Test filter = LocalInputMonitorTest.Basic
[==========] Running 1 test from 1 test case.
[----------] Global test environment set-up.
[----------] 1 test from LocalInputMonitorTest
[ RUN      ] LocalInputMonitorTest.Basic

Program received signal SIGSEGV, Segmentation fault.
scoped_refptr<net::IOBuffer>::scoped_refptr (this=0x3f5c36a10e78, r=...) at ../../base/memory/ref_counted.h:283
283       scoped_refptr(const scoped_refptr<T>& r) : ptr_(r.ptr_) {
(gdb) bt
#0  scoped_refptr<net::IOBuffer>::scoped_refptr (this=0x3f5c36a10e78, r=...) at ../../base/memory/ref_counted.h:283
#1  0x00000000006c7189 in base::FileDescriptorWatcher::Controller::Controller(base::MessageLoopForIO::Mode, int, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) (this=0x3f5c36a10e70, mode=<optimized out>, fd=<optimized out>, callback=...) at ../../base/files/file_descriptor_watcher_posix.cc:154
#2  0x00000000006c75f4 in base::FileDescriptorWatcher::WatchReadable(int, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) (fd=-134525552, callback=...) at ../../base/files/file_descriptor_watcher_posix.cc:198
#3  0x0000000000fe6fa4 in remoting::(anonymous namespace)::LocalInputMonitorX11::Core::StartOnInputThread (this=0x3f5c369eff60) at ../../remoting/host/local_input_monitor_x11.cc:213
#4  0x0000000000731425 in base::debug::TaskAnnotator::RunTask (this=<optimized out>, queue_function=0x13e16ef "MessageLoop::PostTask", pending_task=...) at ../../base/debug/task_annotator.cc:54
#5  0x00000000006dac10 in base::MessageLoop::RunTask (this=0x3f5c3692e810, pending_task=...) at ../../base/message_loop/message_loop.cc:411
#6  0x00000000006db5e4 in base::MessageLoop::DeferOrRunPendingTask (this=0x3f5c3692e810, pending_task=<error reading variable: Cannot access memory at address 0x188>) at ../../base/message_loop/message_loop.cc:420
#7  0x00000000006da7f5 in base::MessageLoop::DoWork (this=0x3f5c3692e810) at ../../base/message_loop/message_loop.cc:513
#8  0x00000000006dee09 in base::MessagePumpLibevent::Run (this=0x3f5c36a353c0, delegate=0x3f5c3692e810) at ../../base/message_loop/message_pump_libevent.cc:217
#9  0x00000000006dd9ab in base::MessageLoop::RunHandler (this=0x3f5c3692e810) at ../../base/message_loop/message_loop.cc:376
#10 0x00000000006f2f83 in base::RunLoop::Run (this=0x3f5c3692e9b0) at ../../base/run_loop.cc:35
#11 0x00000000005c7b76 in remoting::LocalInputMonitorTest_Basic_Test::TestBody (this=<optimized out>) at ../../remoting/host/local_input_monitor_unittest.cc:87
#12 0x0000000000755d51 in testing::Test::Run (this=0x3f5c3692e800) at ../../testing/gtest/src/gtest.cc:2474
#13 0x0000000000757824 in testing::TestInfo::Run (this=0x3f5c369db240) at ../../testing/gtest/src/gtest.cc:2656
#14 0x0000000000757b42 in testing::TestCase::Run (this=0x3f5c369d10e0) at ../../testing/gtest/src/gtest.cc:2774
#15 0x000000000075a932 in testing::internal::UnitTestImpl::RunAllTests (this=0x3f5c36948a00) at ../../testing/gtest/src/gtest.cc:4647
#16 0x000000000075a4cd in testing::UnitTest::Run (this=0x1cccd68 <testing::UnitTest::GetInstance()::instance>) at ../../testing/gtest/src/gtest.cc:4255
#17 0x00000000010392a7 in base::TestSuite::Run (this=0x7fffffffd990) at ../../base/test/test_suite.cc:246
#18 0x0000000000457f6e in base::internal::Invoker<base::internal::BindState<int (base::TestSuite::*)(), base::internal::UnretainedWrapper<base::TestSuite> >, int ()>::RunImpl<int (base::TestSuite::* const&)(), std::tuple<base::internal::UnretainedWrapper<base::TestSuite> > const&, 0ul>(int (base::TestSuite::* const&)(), std::tuple<base::internal::UnretainedWrapper<base::TestSuite> > const&, base::IndexSequence<0ul>) (functor=<optimized out>, bound=...) at ../../base/bind_internal.h:361
#19 0x000000000103ac2f in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback<int (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, int, int, bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) (run_test_suite=..., default_jobs=48, default_batch_limit=10, use_job_objects=true, gtest_init=...) at ../../base/test/launcher/unit_test_launcher.cc:210
#20 0x000000000103aaa2 in base::LaunchUnitTests(int, char**, base::Callback<int (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) (argc=<optimized out>, argv=0x7fffffffdac8, run_test_suite=...) at ../../base/test/launcher/unit_test_launcher.cc:452
#21 0x0000000000457d84 in main (argc=3, argv=0x7fffffffdac8) at ../../remoting/base/run_all_unittests.cc:16

The CL affected this behavior is https://codereview.chromium.org/2402593003

Use FileDescriptorWatcher in LocalInputMonitorX11.

This allows LocalInputMonitorX11 to be used from any thread that
instantiates a FileDescriptorWatcher (not just threads that run
a MessageLoopForIO). This will facilitate the migration of
BrowserThreads to base/task_scheduler.

BUG= 645114 
Committed: https://crrev.com/9f0e84139b0c8c3e40798e135f37bde5b0e3c7ad
Cr-Commit-Position: refs/heads/master@{#424469}

To reproduce the issue on Linux x86-64:

1. Sync Chrome checkout to the head of tree
2. Download gold plugin with:
build/download_gold_plugin.py
3. Generate Ninja build files with CFI enabled:

gn gen out/cfi-diag '--args=is_debug=false is_cfi=true use_cfi_diag=true use_cfi_cast=true symbol_level=2' --check

4. Build remoting_unittests:
ninja -C out/cfi-diag/ remoting_unittests

5. Run the test case under GDB:
gdb --args ./out/cfi-diag/remoting_unittests --gtest_filter=LocalInputMonitorTest.Basic --single_process

6. Observe the crash like above.
 

Comment 1 by fdoray@chromium.org, Oct 12 2016

Cc: sergeyu@chromium.org joedow@chromium.org
A CL to fix this crash is being reviewed https://codereview.chromium.org/2412733002/

Comment 2 by fdoray@chromium.org, Oct 12 2016

Mergedinto: 654895
Status: Duplicate (was: Untriaged)

Sign in to add a comment