Data race in base::PersistentHistogramAllocator::CreateHistogram |
||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4653417418194944 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 4 Crash Address: 0x7f57b8a60194 Crash State: base::PersistentHistogramAllocator::CreateHistogram base::PersistentHistogramAllocator::GetHistogram base::GlobalHistogramAllocator::ImportHistogramsToStatisticsRecorder Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=468321:468328 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4653417418194944 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
May 12 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e0ecce46642e1d001deae09f41429c44517d84b9 commit e0ecce46642e1d001deae09f41429c44517d84b9 Author: bcwhite <bcwhite@chromium.org> Date: Fri May 12 00:30:18 2017 Copy only accessed PersistentHistogramData fields when validating. The DelayedPersistentAllocation added an atomic field to the PersistentHistogramData structure that cannot be copied using operator= (at least not without redefining it). Copies of only some of the fields are needed so explicitly copy only those; the atomic field is not one of them. BUG= 721352 Review-Url: https://codereview.chromium.org/2875643004 Cr-Commit-Position: refs/heads/master@{#471143} [modify] https://crrev.com/e0ecce46642e1d001deae09f41429c44517d84b9/base/metrics/persistent_histogram_allocator.cc
,
May 12 2017
,
May 16 2017
ClusterFuzz has detected this issue as fixed in range 471790:471812. Detailed report: https://clusterfuzz.com/testcase?key=4653417418194944 Fuzzer: inferno_layout_test_unmodified Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 4 Crash Address: 0x7f57b8a60194 Crash State: base::PersistentHistogramAllocator::CreateHistogram base::PersistentHistogramAllocator::GetHistogram base::GlobalHistogramAllocator::ImportHistogramsToStatisticsRecorder Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=468321:468328 Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=471790:471812 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4653417418194944 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 17 2017
New report appears to be Issue 722169 , which is also (just) fixed. |
||
►
Sign in to add a comment |
||
Comment 1 by msrchandra@chromium.org
, May 11 2017Components: Internals>Metrics
Labels: M-60 Test-Predator-Correct-CLs
Owner: bcwh...@chromium.org
Status: Assigned (was: Untriaged)