New issue
Advanced search Search tips

Issue 702767 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 705306
Owner:
Closed: Mar 2017
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

browser_tests failing on chromium.memory/Linux Chromium OS ASan LSan Tests (1)

Project Member Reported by dim...@chromium.org, Mar 17 2017

Issue description

browser_tests failing on chromium.memory/Linux Chromium OS ASan LSan Tests (1)

Builders failed on: 
- Linux Chromium OS ASan LSan Tests (1): 
  https://build.chromium.org/p/chromium.memory/builders/Linux%20Chromium%20OS%20ASan%20LSan%20Tests%20%281%29

Reported as use-after-free:

DevToolsBeforeUnloadTest.TestUndockedDevToolsInspectedTabClose (run #1):
[ RUN      ] DevToolsBeforeUnloadTest.TestUndockedDevToolsInspectedTabClose
[11887:11887:0317/124040.399861:WARNING:chrome_browser_main_chromeos.cc(371)] Running as stub user with profile dir: test-user
[11887:11887:0317/124040.671413:WARNING:audio_manager.cc(295)] Multiple instances of AudioManager detected
[11887:11887:0317/124040.671455:WARNING:audio_manager.cc(254)] Multiple instances of AudioManager detected
[11887:11887:0317/124040.770859:ERROR:logging_chrome.cc(175)] Unable to create symlink /b/s/w/itoKYJHE/.org.chromium.Chromium.XHnYQe/doDtZ4n/test-user/chrome_debug.log pointing at /b/s/w/itoKYJHE/.org.chromium.Chromium.XHnYQe/doDtZ4n/test-user/chrome_debug_20170317-124040.log: No such file or directory
Xlib:  extension "RANDR" missing on display ":99".
[11887:11887:0317/124041.508729:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : ahfgeienlihckogmohjhadlkjgocpleb / Web Store because of 'signin_screen' is only allowed for packaged apps, but this is a hosted app.
[11887:11887:0317/124041.508970:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : eemcgdkfndhakfknompkggombfjjjeno / Bookmark Manager because of 'signin_screen' is only allowed for packaged apps, but this is a extension.
[11887:11887:0317/124041.509232:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : mgndgikekgjfcpckkfioiadnlibdjbkf / Chromium because of 'signin_screen' is only allowed for packaged apps, but this is a hosted app.
[11887:11887:0317/124041.509454:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : nkoccljplnhpfnfiajclkommnmllphnl / crosh_builtin because of 'signin_screen' is only allowed for packaged apps, but this is a extension.
[11887:11946:0317/124041.566896:WARNING:freezer_cgroup_process_manager.cc(61)] Cgroup freezer does not exist or is not writable. Unable to freeze renderer processes.
[11887:11887:0317/124041.987488:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : ahfgeienlihckogmohjhadlkjgocpleb / Web Store because of 'signin_screen' is only allowed for packaged apps, but this is a hosted app.
[11887:11887:0317/124041.989226:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : eemcgdkfndhakfknompkggombfjjjeno / Bookmark Manager because of 'signin_screen' is only allowed for packaged apps, but this is a extension.
[11887:11887:0317/124041.989414:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : mgndgikekgjfcpckkfioiadnlibdjbkf / Chromium because of 'signin_screen' is only allowed for packaged apps, but this is a hosted app.
[11887:11887:0317/124041.989674:WARNING:signin_screen_policy_provider.cc(61)] Denying load of Extension  : nkoccljplnhpfnfiajclkommnmllphnl / crosh_builtin because of 'signin_screen' is only allowed for packaged apps, but this is a extension.
HTTP server started on http://127.0.0.1:60620...
sending server_data: {"host": "127.0.0.1", "port": 60620} (36 bytes)
[11887:11944:0317/124043.110247:WARNING:simple_synchronous_entry.cc(1054)] Could not open platform files for entry.
[11887:11887:0317/124047.123574:WARNING:tab_manager_delegate_chromeos.cc(89)] Set OOM score error:
=================================================================
==11887==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000134c78 at pc 0x000000e25f3a bp 0x7ffe9475ab60 sp 0x7ffe9475ab58
READ of size 8 at 0x617000134c78 thread T0 (browser_tests)
    #0 0xe25f39 in get build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:217:16
    #1 0xe25f39 in tab_strip_model chrome/browser/ui/browser.h:256
    #2 0xe25f39 in DevToolsBeforeUnloadTest::CloseInspectedTab() chrome/browser/devtools/devtools_sanity_browsertest.cc:372
    #3 0xe25b23 in Run base/callback.h:85:12
    #4 0xe25b23 in DevToolsBeforeUnloadTest::RunBeforeUnloadSanityTest(bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1>, bool) chrome/browser/devtools/devtools_sanity_browsertest.cc:410
    #5 0xe263a1 in DevToolsBeforeUnloadTest_TestUndockedDevToolsInspectedTabClose_Test::RunTestOnMainThread() chrome/browser/devtools/devtools_sanity_browsertest.cc:773:3
    #6 0xb698a8b in InProcessBrowserTest::RunTestOnMainThreadLoop() chrome/test/base/in_process_browser_test.cc:574:5
    #7 0xcdeeb7c in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:346:5
    #8 0xb79a439 in Run base/callback.h:85:12
    #9 0xb79a439 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:1935
    #10 0xb797a99 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1255:18
    #11 0x45098ac in chromeos::ChromeBrowserMainPartsChromeos::PreMainMessageLoopRun() chrome/browser/chromeos/chrome_browser_main_chromeos.cc:469:32
    #12 0x6509cda in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1181:13
    #13 0x7441d2d in Run base/callback.h:85:12
    #14 0x7441d2d in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:45
    #15 0x6503c96 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:989:25
    #16 0x65177e7 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner.cc:125:17
    #17 0x64fb5dc in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:42:32
    #18 0xb055e0e in content::RunNamedProcessTypeMain(std::string const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:490:14
    #19 0xb058797 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:835:12
    #20 0xb053542 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:29:28
    #21 0xcded862 in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:312:3
    #22 0xb6935d7 in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:265:20
    #23 0xe96258c in HandleExceptionsInMethodIfSupported<testing::Test, void> testing/gtest/src/gtest.cc:2458:12
    #24 0xe96258c in testing::Test::Run() testing/gtest/src/gtest.cc:2470
    #25 0xe964904 in testing::TestInfo::Run() testing/gtest/src/gtest.cc:2656:11
    #26 0xe9655b6 in testing::TestCase::Run() testing/gtest/src/gtest.cc:2774:28
    #27 0xe97a386 in testing::internal::UnitTestImpl::RunAllTests() testing/gtest/src/gtest.cc:4647:43
    #28 0xe9798f9 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> testing/gtest/src/gtest.cc:2458:12
    #29 0xe9798f9 in testing::UnitTest::Run() testing/gtest/src/gtest.cc:4255
    #30 0xb6dcdb9 in RUN_ALL_TESTS testing/gtest/include/gtest/gtest.h:2237:46
    #31 0xb6dcdb9 in base::TestSuite::Run() base/test/test_suite.cc:271
    #32 0xb319b5a in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/chrome_test_launcher.cc:62:38
    #33 0xceeaf29 in content::LaunchTests(content::TestLauncherDelegate*, int, int, char**) content/public/test/test_launcher.cc:520:31
    #34 0xb31296a in main chrome/test/base/browser_tests_main_chromeos.cc:20:10
    #35 0x7f727036ff44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

0x617000134c78 is located 376 bytes inside of 712-byte region [0x617000134b00,0x617000134dc8)
freed by thread T0 (browser_tests) here:
    #0 0xa3528b in operator delete(void*) (/b/s/w/irO_rqqc/out/Release/browser_tests+0xa3528b)
    #1 0x14e5238d in operator() build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:63:2
    #2 0x14e5238d in reset build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:245
    #3 0x14e5238d in BrowserView::~BrowserView() chrome/browser/ui/views/frame/browser_view.cc:467
    #4 0x14e52c74 in ~BrowserView chrome/browser/ui/views/frame/browser_view.cc:423:29
    #5 0x14e52c74 in non-virtual thunk to BrowserView::~BrowserView() chrome/browser/ui/views/frame/browser_view.cc
    #6 0xecb5397 in views::View::~View() ui/views/view.cc:163:9
    #7 0xed0a72a in ~NonClientView ui/views/window/non_client_view.cc:56:1
    #8 0xed0a72a in views::NonClientView::~NonClientView() ui/views/window/non_client_view.cc:52
    #9 0xecb9e60 in operator() build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:63:2
    #10 0xecb9e60 in reset build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:245
    #11 0xecb9e60 in ~unique_ptr build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:169
    #12 0xecb9e60 in views::View::DoRemoveChildView(views::View*, bool, bool, bool, views::View*) ui/views/view.cc:1971
    #13 0xecbabf8 in views::View::RemoveAllChildViews(bool) ui/views/view.cc:301:5
    #14 0xed92463 in views::internal::RootView::~RootView() ui/views/widget/root_view.cc:182:5
    #15 0x14e50afd in BrowserRootView::~BrowserRootView() chrome/browser/ui/views/frame/browser_root_view.h:23:7
    #16 0xece104d in operator() build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:63:2
    #17 0xece104d in reset build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:245
    #18 0xece104d in DestroyRootView ui/views/widget/widget.cc:1440
    #19 0xece104d in views::Widget::~Widget() ui/views/widget/widget.cc:181
    #20 0x14e48e7d in BrowserFrame::~BrowserFrame() chrome/browser/ui/views/frame/browser_frame.cc:61:31
    #21 0xed1d428 in views::NativeWidgetAura::~NativeWidgetAura() ui/views/widget/native_widget_aura.cc
    #22 0x14f4569d in ~BrowserFrameAsh chrome/browser/ui/views/frame/browser_frame_ash.cc:175:1
    #23 0x14f4569d in BrowserFrameAsh::~BrowserFrameAsh() chrome/browser/ui/views/frame/browser_frame_ash.cc:174
    #24 0x116a7485 in aura::Window::~Window() ui/aura/window.cc:119:16
    #25 0x116a8abd in aura::Window::~Window() ui/aura/window.cc:73:19
    #26 0xed1e5fb in void base::internal::FunctorTraits<void (views::NativeWidgetAura::*)(), void>::Invoke<base::WeakPtr<views::NativeWidgetAura> const&>(void (views::NativeWidgetAura::*)(), base::WeakPtr<views::NativeWidgetAura> const&) base/bind_internal.h:214:12
    #27 0x589f582 in base::internal::RunMixin<base::Callback<void (), (base::internal::CopyMode)0, (base::internal::RepeatMode)0> >::Run() && base/callback.h:68:12
    #28 0xb5ce5ba in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) base/debug/task_annotator.cc:59:33
    #29 0xb3d1519 in base::MessageLoop::RunTask(base::PendingTask*) base/message_loop/message_loop.cc:423:19
    #30 0xb3d3b6f in DeferOrRunPendingTask base/message_loop/message_loop.cc:434:5
    #31 0xb3d3b6f in base::MessageLoop::DoWork() base/message_loop/message_loop.cc:527
    #32 0xb3de5c6 in HandleDispatch base/message_loop/message_pump_glib.cc:267:25
    #33 0xb3de5c6 in base::(anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) base/message_loop/message_pump_glib.cc:109
    #34 0x7f727552ee03 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x48e03)

previously allocated by thread T0 (browser_tests) here:
    #0 0xa3464b in operator new(unsigned long) (/b/s/w/irO_rqqc/out/Release/browser_tests+0xa3464b)
    #1 0x14b19595 in StartupBrowserCreatorImpl::OpenTabsInBrowser(Browser*, bool, std::vector<StartupTab, std::allocator<StartupTab> > const&) chrome/browser/ui/startup/startup_browser_creator_impl.cc:457:15
    #2 0x14b1bc64 in StartupBrowserCreatorImpl::RestoreOrCreateBrowser(std::vector<StartupTab, std::allocator<StartupTab> > const&, StartupBrowserCreatorImpl::BrowserOpenBehavior, unsigned int, bool, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:776:13
    #3 0x14b177b8 in StartupBrowserCreatorImpl::ProcessLaunchUrlsUsingConsolidatedFlow(bool, std::vector<GURL, std::allocator<GURL> > const&) chrome/browser/ui/startup/startup_browser_creator_impl.cc:675:22
    #4 0x14b16391 in StartupBrowserCreatorImpl::Launch(Profile*, std::vector<GURL, std::allocator<GURL> > const&, bool) chrome/browser/ui/startup/startup_browser_creator_impl.cc:385:7
    #5 0x14b0f176 in StartupBrowserCreator::LaunchBrowser(base::CommandLine const&, Profile*, base::FilePath const&, chrome::startup::IsProcessStartup, chrome::startup::IsFirstRun) chrome/browser/ui/startup/startup_browser_creator.cc:374:13
    #6 0x14b0e0a9 in StartupBrowserCreator::ProcessCmdLineImpl(base::CommandLine const&, base::FilePath const&, bool, Profile*, std::vector<Profile*, std::allocator<Profile*> > const&) chrome/browser/ui/startup/startup_browser_creator.cc:758:10
    #7 0x14b0bfae in StartupBrowserCreator::Start(base::CommandLine const&, base::FilePath const&, Profile*, std::vector<Profile*, std::allocator<Profile*> > const&) chrome/browser/ui/startup/startup_browser_creator.cc:329:10
    #8 0xb79a1fa in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:1881:42
    #9 0xb797a99 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1255:18
    #10 0x45098ac in chromeos::ChromeBrowserMainPartsChromeos::PreMainMessageLoopRun() chrome/browser/chromeos/chrome_browser_main_chromeos.cc:469:32
    #11 0x6509cda in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:1181:13
    #12 0x7441d2d in Run base/callback.h:85:12
    #13 0x7441d2d in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:45
    #14 0x6503c96 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:989:25
    #15 0x65177e7 in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner.cc:125:17
    #16 0x64fb5dc in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:42:32
    #17 0xb055e0e in content::RunNamedProcessTypeMain(std::string const&, content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner.cc:490:14
    #18 0xb058797 in content::ContentMainRunnerImpl::Run() content/app/content_main_runner.cc:835:12
    #19 0xb053542 in content::ContentMain(content::ContentMainParams const&) content/app/content_main.cc:29:28
    #20 0xcded862 in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:312:3
    #21 0xb6935d7 in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:265:20
    #22 0xe96258c in HandleExceptionsInMethodIfSupported<testing::Test, void> testing/gtest/src/gtest.cc:2458:12
    #23 0xe96258c in testing::Test::Run() testing/gtest/src/gtest.cc:2470
    #24 0xe964904 in testing::TestInfo::Run() testing/gtest/src/gtest.cc:2656:11
    #25 0xe9655b6 in testing::TestCase::Run() testing/gtest/src/gtest.cc:2774:28
    #26 0xe97a386 in testing::internal::UnitTestImpl::RunAllTests() testing/gtest/src/gtest.cc:4647:43
    #27 0xe9798f9 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> testing/gtest/src/gtest.cc:2458:12
    #28 0xe9798f9 in testing::UnitTest::Run() testing/gtest/src/gtest.cc:4255
    #29 0xb6dcdb9 in RUN_ALL_TESTS testing/gtest/include/gtest/gtest.h:2237:46
    #30 0xb6dcdb9 in base::TestSuite::Run() base/test/test_suite.cc:271
    #31 0xb319b5a in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/chrome_test_launcher.cc:62:38
    #32 0xceeaf29 in content::LaunchTests(content::TestLauncherDelegate*, int, int, char**) content/public/test/test_launcher.cc:520:31
    #33 0xb31296a in main chrome/test/base/browser_tests_main_chromeos.cc:20:10

SUMMARY: AddressSanitizer: heap-use-after-free build/linux/ubuntu_precise_amd64-sysroot/usr/lib/gcc/x86_64-linux-gnu/4.6/../../../../include/c++/4.6/bits/unique_ptr.h:217:16 in get
Shadow bytes around the buggy address:
  0x0c2e8001e930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e8001e940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c2e8001e950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8001e960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e8001e970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2e8001e980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
  0x0c2e8001e990: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e8001e9a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e8001e9b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c2e8001e9c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e8001e9d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11887==ABORTING



 

Comment 1 by dim...@chromium.org, Mar 17 2017

Labels: -Sheriff-Chromium Pri-1 Type-Bug
Owner: pfeldman@chromium.org
Status: Assigned (was: Available)
Merge with  bug 702171 ?

Comment 3 by a...@chromium.org, Mar 28 2017

Quite possibly a dup with  bug 702171  and  bug 705306 .

I'm looking at  bug 705306 .

Comment 4 by a...@chromium.org, Mar 28 2017

Mergedinto: 705306
Status: Duplicate (was: Assigned)

Sign in to add a comment