New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 722486 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 570852
Owner:
Closed: May 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in webrtc::XErrorTrap::XErrorTrap

Project Member Reported by ClusterFuzz, May 15 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5524962114011136

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7f73ae9217e0
Crash State:
  webrtc::XErrorTrap::XErrorTrap
  webrtc::XServerPixelBuffer::InitShm
  webrtc::XServerPixelBuffer::Init
  
Sanitizer: thread (TSAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5524962114011136


Additional requirements: Requires HTTP

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: msrchandra@chromium.org
Components: Blink>WebRTC
Labels: Test-Predator-Correct-CLs
Owner: sergeyu@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
Regression information is not available. The result is the blame information. 

Author: sergeyu@chromium.org
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/e562e02f31a3d39f06d6cdab11a28104c60bccd8
Time: Fri Aug 23 18:22:12 2013
The CL last changed line 48 of file x_error_trap.cc, which is stack frame 0. 

Author: sergeyu@chromium.org
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/e562e02f31a3d39f06d6cdab11a28104c60bccd8
Time: Fri Aug 23 18:22:12 2013
The CL last changed line 222 of file x_server_pixel_buffer.cc, which is stack frame 1. 

Author: sergeyu@chromium.org
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/e562e02f31a3d39f06d6cdab11a28104c60bccd8
Time: Fri Aug 23 18:22:12 2013
The CL last changed line 188 of file x_server_pixel_buffer.cc, which is stack frame 2. 

Author: sergeyu@chromium.org
Project: chromium-webrtc
Changelist: https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/91685dc421db7dcdc24f6a154de9b92eababf6fd
Time: Sat Oct 12 22:40:05 2013
The CL last changed line 195 of file window_capturer_x11.cc, which is stack frame 3. 

Author: zijiehe
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/483e98b88e15d639bbba5acd472231d5c67de76d
Time: Tue Nov 08 01:06:22 2016
The CL last changed line 191 of file native_desktop_media_list.cc, which is stack frame 4. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/99de02ba952b0a69291f81c5b8ca14d81cc1f74f
Time: Fri Jul 01 05:54:12 2016
The CL last changed line 214 of file bind_internal.h, which is stack frame 5. 

Author: tzik
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ecb1b24070b8cbf7958f05ecad9373b979e212b9
Time: Tue Mar 21 07:25:54 2017
The CL last changed line 91 of file callback.h, which is stack frame 6.

Suspecting Commit#
https://chromium.googlesource.com/external/webrtc/trunk/webrtc.git/+/e562e02f31a3d39f06d6cdab11a28104c60bccd8

@sergeyu -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Mergedinto: 570852
Status: Duplicate (was: Assigned)
Project Member

Comment 3 by ClusterFuzz, Dec 2

ClusterFuzz has detected this issue as fixed in range 502656:502679.

Detailed report: https://clusterfuzz.com/testcase?key=5524962114011136

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7f73ae9217e0
Crash State:
  webrtc::XErrorTrap::XErrorTrap
  webrtc::XServerPixelBuffer::InitShm
  webrtc::XServerPixelBuffer::Init
  
Sanitizer: thread (TSAN)

Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=502656:502679

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5524962114011136

Additional requirements: Requires HTTP

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment