New issue
Advanced search Search tips

Issue 724492 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 724367
Owner:
Closed: May 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security



Sign in to add a comment

MSan Chrome builds crashing on startup after skia roll.

Project Member Reported by infe...@chromium.org, May 19 2017

Issue description

can't bisect this since this is a startup crash. Heather, can you please find an owner to revert this recent regression.

linux_msan_chrome (r473072)
/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome --user-data-dir=/mnt/scratch0/tmp/user_profile_0 --log-net-log=/mnt/scratch0/tmp/net_log_0 --ignore-gpu-blacklist --allow-file-access-from-files --disable-gesture-requirement-for-media-playback --disable-click-to-play --disable-hang-monitor --dns-prefetch-disable --disable-default-apps --disable-component-update --safebrowsing-disable-auto-update --metrics-recording-only --disable-gpu-watchdog --disable-metrics --disable-popup-blocking --disable-prompt-on-repost --enable-experimental-extension-apis --enable-extension-apps --js-flags="--expose-gc" --new-window --no-default-browser-check --no-first-run --no-process-singleton-dialog --enable-shadow-dom --enable-media-stream --use-gl=osmesa --disable-gl-drawing-for-tests --use-fake-device-for-media-stream --use-fake-ui-for-media-stream --disable-namespace-sandbox 

Xlib: extension "RANDR" missing on display ":1".
==10323==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fe9dbc09abd in is_nan_or_clipped /mnt/data/b/c/b/MSAN_Release__no_origins_/src/third_party/skia/src/core/SkCanvas.cpp:1574:19
#1 0x7fe9dbc09abd in SkCanvas::quickReject(SkRect const&) const /mnt/data/b/c/b/MSAN_Release__no_origins_/src/third_party/skia/src/core/SkCanvas.cpp:1636
#2 0x7fe9dcce238b in cc::(anonymous namespace)::RasterItem(cc::DisplayItem const&, SkCanvas*, SkPicture::AbortCallback*) /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/paint/display_item_list.cc:101:19
#3 0x7fe9dcce19c5 in cc::DisplayItemList::Raster(SkCanvas*, SkPicture::AbortCallback*) const /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/paint/display_item_list.cc:226:5
#4 0x7fe9ddad9990 in RasterCommon /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/raster_source.cc:218:20
#5 0x7fe9ddad9990 in cc::RasterSource::PlaybackToCanvas(SkCanvas*, gfx::ColorSpace const&, cc::RasterSource::PlaybackSettings const&) const /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/raster_source.cc:120
#6 0x7fe9ddad8eb0 in cc::RasterSource::PlaybackToCanvas(SkCanvas*, gfx::ColorSpace const&, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&) const /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/raster_source.cc:84:3
#7 0x7fe9ddad72d6 in cc::RasterBufferProvider::PlaybackToMemory(void*, cc::ResourceFormat, gfx::Size const&, unsigned long, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, gfx::ColorSpace const&, cc::RasterSource::PlaybackSettings const&) /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/raster_buffer_provider.cc:85:22
#8 0x7fe9ddad54d5 in cc::OneCopyRasterBufferProvider::PlaybackToStagingBuffer(cc::StagingBuffer*, cc::Resource const*, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, gfx::ColorSpace const&, cc::RasterSource::PlaybackSettings const&, unsigned long, unsigned long) /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/one_copy_raster_buffer_provider.cc:311:5
#9 0x7fe9ddad3172 in cc::OneCopyRasterBufferProvider::PlaybackAndCopyOnWorkerThread(cc::Resource const*, cc::ResourceProvider::ScopedWriteLockGL*, gpu::SyncToken const&, cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&, unsigned long, unsigned long) /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/one_copy_raster_buffer_provider.cc:247:3
#10 0x7fe9ddad2b0c in cc::OneCopyRasterBufferProvider::RasterBufferImpl::Playback(cc::RasterSource const*, gfx::Rect const&, gfx::Rect const&, unsigned long, gfx::AxisTransform2d const&, cc::RasterSource::PlaybackSettings const&) /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/one_copy_raster_buffer_provider.cc:63:12
#11 0x7fe9ddbd3b83 in cc::(anonymous namespace)::RasterTaskImpl::RunOnWorkerThread() /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/tiles/tile_manager.cc:130:21
#12 0x7fe9dd905e5c in cc::SingleThreadTaskGraphRunner::RunTaskWithLockAcquired() /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/single_thread_task_graph_runner.cc:154:28
#13 0x7fe9dd906675 in Run /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/single_thread_task_graph_runner.cc:117:10
#14 0x7fe9dd906675 in non-virtual thunk to cc::SingleThreadTaskGraphRunner::Run() /mnt/data/b/c/b/MSAN_Release__no_origins_/src/cc/raster/single_thread_task_graph_runner.cc:0
#15 0x7fe9da499c7e in base::SimpleThread::ThreadMain() /mnt/data/b/c/b/MSAN_Release__no_origins_/src/base/threading/simple_thread.cc:68:3
#16 0x7fe9da488851 in base::(anonymous namespace)::ThreadFunc(void*) /mnt/data/b/c/b/MSAN_Release__no_origins_/src/base/threading/platform_thread_posix.cc:71:13
#17 0x7fe9caba3183 in start_thread /build/eglibc-MjiXCM/eglibc-2.19/nptl/pthread_create.c:312
#18 0x7fe9ca6babec in clone /build/eglibc-MjiXCM/eglibc-2.19/sysdeps/unix/sysv/linux/x86_64/clone.S:111

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x8b02abd)
Exiting


Xlib: extension "RANDR" missing on display ":1".
==10323==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7fe9dbc09abd (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x8b02abd)
#1 0x7fe9dcce238b (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x9bdb38b)
#2 0x7fe9dcce19c5 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x9bda9c5)
#3 0x7fe9ddad9990 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa9d2990)
#4 0x7fe9ddad8eb0 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa9d1eb0)
#5 0x7fe9ddad72d6 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa9d02d6)
#6 0x7fe9ddad54d5 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa9ce4d5)
#7 0x7fe9ddad3172 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa9cc172)
#8 0x7fe9ddad2b0c (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa9cbb0c)
#9 0x7fe9ddbd3b83 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xaaccb83)
#10 0x7fe9dd905e5c (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa7fee5c)
#11 0x7fe9dd906675 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0xa7ff675)
#12 0x7fe9da499c7e (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x7392c7e)
#13 0x7fe9da488851 (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x7381851)
#14 0x7fe9caba3183 (/lib/x86_64-linux-gnu/libpthread.so.0+0x8183)
#15 0x7fe9ca6babec (/lib/x86_64-linux-gnu/libc.so.6+0xfdbec)

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/mnt/scratch0/clusterfuzz/slave-bot/builds/chromium-browser-msan_linux-release_f0f2293113719a4112901bbc60e753785f9ad484/revisions/msan-no-origins-linux-release-473072/chrome+0x8b02abd)
Exiting
 
Any chance this is related to changes in cc/paint/display_item_list.cc in https://chromium.googlesource.com/chromium/src/+/c5f1b6126a7657234b9abc0c4359cbab45850b69, which is currently suspect in some graphics glitchiness ( Issue 724474 ) ?
Cc: hcm@chromium.org
Owner: danakj@chromium.org
Yes, that could be, it is definitely in the caller. Reassigning to danakj

Comment 3 by danakj@chromium.org, May 19 2017

Mergedinto: 724367
Status: Duplicate (was: Assigned)
Note that this is a blocker for MSan fuzzing on ClusterFuzz, please revert it if you can't fix it today.

Comment 5 by danakj@chromium.org, May 19 2017

It was already reverted

Comment 6 by danakj@chromium.org, May 19 2017

https://codereview.chromium.org/2894843002/ is the revert from 4 hours ago.
Project Member

Comment 7 by sheriffbot@chromium.org, Aug 26 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment