New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 717335 link

Starred by 1 user
Status: Fixed
Owner:
chrishtr@chromium.org
Closed: May 2017
Cc:
wangxianzhu@chromium.org
█ msrchandra@chromium.org
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: new_cached_subsequences_.find(&client) == new_cached_subsequences_.end() in Pain

Project Member Reported by ClusterFuzz, May 2 2017 
Detailed report: https://clusterfuzz.com/testcase?key=6145325103579136

Fuzzer: inferno_twister
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  new_cached_subsequences_.find(&client) == new_cached_subsequences_.end() in Pain
  blink::PaintController::AddCachedSubsequence
  blink::SubsequenceRecorder::~SubsequenceRecorder
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_debug_content_shell_drt&range=462610:462863

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6145325103579136


Additional requirements: Requires HTTP

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

Comment 1 by msrchandra@chromium.org, May 2 2017

Cc: msrchandra@chromium.org wangxianzhu@chromium.org
Labels: Test-Predator-Wrong M-59
Owner: chrishtr@chromium.org
Status: Assigned (was: Untriaged)
Predator did not provide any possible suspects.
Assigning to the concern owner from CL --
https://chromium.googlesource.com/chromium/src/+log/46a8dce41297331415c5d0ecbfe05acd181d1e80..fc14e3a2a3e43bacbca4b48f0ba3e66b4af9a50a?pretty=fuller

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/67161fd023615beeb90c01c878220b5485cd057c

@chrishtr -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by chrishtr@chromium.org, May 9 2017

Status: Started (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, May 11 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3d763bf3e6615ac7e407af1b9ffbe61f451186b3

commit 3d763bf3e6615ac7e407af1b9ffbe61f451186b3
Author: chrishtr <chrishtr@chromium.org>
Date: Thu May 11 22:18:25 2017

Don't allow subsequence caching for fragmented PaintLayers.

Fragmented PaintLayers do not paint atomically (though each fragment
does). PaintController, however does not support a fragment as a
DisplayItemClient key for subsequences.

BUG= 717335 
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2

Review-Url: https://codereview.chromium.org/2865403002
Cr-Commit-Position: refs/heads/master@{#471087}

[modify] https://crrev.com/3d763bf3e6615ac7e407af1b9ffbe61f451186b3/third_party/WebKit/Source/core/paint/PaintLayer.cpp
[modify] https://crrev.com/3d763bf3e6615ac7e407af1b9ffbe61f451186b3/third_party/WebKit/Source/core/paint/PaintLayerTest.cpp

Comment 4 by chrishtr@chromium.org, May 11 2017

Status: Fixed (was: Started)
►

Sign in to add a comment