MSan: ash_unittests has some tests with use-of-uninitialized-value in RealGLXApi
Reported by
apisa...@yandex-team.ru,
May 22 2017
|
|||||||
Issue description
UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
Steps to reproduce the problem:
If build ui_service_unittests with MSan and run it next tests tests will fail:
CursorStateTest.CursorLockTest (../../services/ui/ws/cursor_state_unittest.cc:57)
CursorStateTest.CursorOverrideLockTest (../../services/ui/ws/cursor_state_unittest.cc:99)
CursorStateTest.CursorOverrideTest (../../services/ui/ws/cursor_state_unittest.cc:87)
CursorStateTest.CursorOverrideVisibilityTest (../../services/ui/ws/cursor_state_unittest.cc:115)
CursorStateTest.CursorVisibilityTest (../../services/ui/ws/cursor_state_unittest.cc:69)
CursorTest.ChangeByClientAreaChange (../../services/ui/ws/cursor_unittest.cc:131)
CursorTest.ChangeByMouseMove (../../services/ui/ws/cursor_unittest.cc:113)
CursorTest.IgnoreClientCursorChangeInNonClientArea (../../services/ui/ws/cursor_unittest.cc:165)
CursorTest.NonClientCursorChange (../../services/ui/ws/cursor_unittest.cc:150)
CursorTest.NonClientToClientByBoundsChange (../../services/ui/ws/cursor_unittest.cc:180)
DisplayTest.CreateDisplay (../../services/ui/ws/display_unittest.cc:124)
DisplayTest.CreateDisplayBeforeWM (../../services/ui/ws/display_unittest.cc:145)
DisplayTest.CreateDisplayWithDeviceScaleFactor (../../services/ui/ws/display_unittest.cc:199)
DisplayTest.CreateDisplayWithTwoWindowManagers (../../services/ui/ws/display_unittest.cc:172)
DisplayTest.DestroyingDisplayDoesntDelete (../../services/ui/ws/display_unittest.cc:392)
DisplayTest.Destruction (../../services/ui/ws/display_unittest.cc:225)
DisplayTest.EventStateResetOnUserSwitch (../../services/ui/ws/display_unittest.cc:256)
DisplayTest.FocusFailsForInactiveUser (../../services/ui/ws/display_unittest.cc:329)
DisplayTest.MultipleDisplays (../../services/ui/ws/display_unittest.cc:364)
DisplayTest.SetCaptureFromWindowManager (../../services/ui/ws/display_unittest.cc:301)
GpuHostTest.GpuClientDestructionOrder (../../services/ui/ws/gpu_host_unittest.cc:114)
UserDisplayManagerTest.AddObserverAfterFrameDecorationsSet (../../services/ui/ws/user_display_manager_unittest.cc:154)
UserDisplayManagerTest.AddRemoveDisplay (../../services/ui/ws/user_display_manager_unittest.cc:176)
UserDisplayManagerTest.OnlyNotifyWhenFrameDecorationsSet (../../services/ui/ws/user_display_manager_unittest.cc:126)
WindowManagerStateShutdownTest.DestroyTreeBeforeDisplay (../../services/ui/ws/window_manager_state_unittest.cc:623)
WindowManagerStateTest.AcceleratorDeleted (../../services/ui/ws/window_manager_state_unittest.cc:366)
WindowManagerStateTest.AckTimeout (../../services/ui/ws/window_manager_state_unittest.cc:485)
WindowManagerStateTest.AckWithProperties (../../services/ui/ws/window_manager_state_unittest.cc:273)
WindowManagerStateTest.ClientHandlesEvent (../../services/ui/ws/window_manager_state_unittest.cc:348)
WindowManagerStateTest.CursorResetOverNoTarget (../../services/ui/ws/window_manager_state_unittest.cc:645)
WindowManagerStateTest.DeleteNonRootTree (../../services/ui/ws/window_manager_state_unittest.cc:433)
WindowManagerStateTest.DeleteTree (../../services/ui/ws/window_manager_state_unittest.cc:416)
WindowManagerStateTest.DontSendQueuedEventsToADeadTree (../../services/ui/ws/window_manager_state_unittest.cc:458)
WindowManagerStateTest.EnqueuedAccelerators (../../services/ui/ws/window_manager_state_unittest.cc:385)
WindowManagerStateTest.InterceptingEmbedderReceivesEvents (../../services/ui/ws/window_manager_state_unittest.cc:499)
WindowManagerStateTest.NullAccelerator (../../services/ui/ws/window_manager_state_unittest.cc:180)
WindowManagerStateTest.PostAcceleratorForgotten (../../services/ui/ws/window_manager_state_unittest.cc:593)
WindowManagerStateTest.PostTargetAccelerator (../../services/ui/ws/window_manager_state_unittest.cc:199)
WindowManagerStateTest.PreTargetConsumed (../../services/ui/ws/window_manager_state_unittest.cc:217)
WindowTreeManualDisplayTest.ClientCreatesDisplayRoot (../../services/ui/ws/window_tree_unittest.cc:1547)
WindowTreeShutdownTest.DontSendMessagesDuringShutdown (../../services/ui/ws/window_tree_unittest.cc:1489)
WindowTreeTest.BasicInputEventTarget (../../services/ui/ws/window_tree_unittest.cc:298)
WindowTreeTest.CaptureNotifiesWm (../../services/ui/ws/window_tree_unittest.cc:1411)
WindowTreeTest.CaptureWindowMustBeVisible (../../services/ui/ws/window_tree_unittest.cc:817)
WindowTreeTest.ChangingWindowBoundsChangesCursor (../../services/ui/ws/window_tree_unittest.cc:563)
WindowTreeTest.CursorChangesWhenEnteringWindowWithDifferentCursor (../../services/ui/ws/window_tree_unittest.cc:498)
WindowTreeTest.CursorChangesWhenMouseOverWindowAndWindowSetsCursor (../../services/ui/ws/window_tree_unittest.cc:480)
WindowTreeTest.CursorMultipleTrees (../../services/ui/ws/window_tree_unittest.cc:610)
WindowTreeTest.DragOutsideWindow (../../services/ui/ws/window_tree_unittest.cc:532)
WindowTreeTest.Embed (../../services/ui/ws/window_tree_unittest.cc:682)
WindowTreeTest.EventAck (../../services/ui/ws/window_tree_unittest.cc:648)
WindowTreeTest.ExplicitSetCapture (../../services/ui/ws/window_tree_unittest.cc:789)
WindowTreeTest.FocusOnPointer (../../services/ui/ws/window_tree_unittest.cc:212)
WindowTreeTest.InvalidMoveLoopStillAcksAttempt (../../services/ui/ws/window_tree_unittest.cc:1375)
WindowTreeTest.KeyEventSentToWindowManagerWhenNothingFocused (../../services/ui/ws/window_tree_unittest.cc:473)
WindowTreeTest.MoveCaptureWindowToModalParent (../../services/ui/ws/window_tree_unittest.cc:1073)
WindowTreeTest.MoveLoopAckOKByWM (../../services/ui/ws/window_tree_unittest.cc:1219)
WindowTreeTest.NewTopLevelWindow (../../services/ui/ws/window_tree_unittest.cc:710)
WindowTreeTest.PointerWatcherGetsWindow (../../services/ui/ws/window_tree_unittest.cc:371)
WindowTreeTest.RevertWindowBoundsOnMoveLoopFailure (../../services/ui/ws/window_tree_unittest.cc:1319)
WindowTreeTest.SetCanAcceptEvents (../../services/ui/ws/window_tree_unittest.cc:1395)
WindowTreeTest.SetCaptureTargetsRightConnection (../../services/ui/ws/window_tree_unittest.cc:1152)
WindowTreeTest.SetModalTypeForwardedToWindowManager (../../services/ui/ws/window_tree_unittest.cc:1453)
WindowTreeTest.SetOpacity (../../services/ui/ws/window_tree_unittest.cc:1117)
WindowTreeTest.SetOpacityFailsOnUnknownWindow (../../services/ui/ws/window_tree_unittest.cc:1135)
WindowTreeTest.ShowModalWindowWithDescendantCapture (../../services/ui/ws/window_tree_unittest.cc:834)
WindowTreeTest.ShowModalWindowWithNonDescendantCapture (../../services/ui/ws/window_tree_unittest.cc:921)
WindowTreeTest.ShowSystemModalWindowWithCapture (../../services/ui/ws/window_tree_unittest.cc:1006)
WindowTreeTest.StartPointerWatcher (../../services/ui/ws/window_tree_unittest.cc:319)
WindowTreeTest.StartPointerWatcherKeyEventsDisallowed (../../services/ui/ws/window_tree_unittest.cc:455)
WindowTreeTest.StartPointerWatcherNonMatching (../../services/ui/ws/window_tree_unittest.cc:395)
WindowTreeTest.StartPointerWatcherSendsOnce (../../services/ui/ws/window_tree_unittest.cc:412)
WindowTreeTest.StartPointerWatcherWrongUser (../../services/ui/ws/window_tree_unittest.cc:436)
WindowTreeTest.TouchesDontChangeCursor (../../services/ui/ws/window_tree_unittest.cc:515)
WindowTreeTest.ValidMoveLoopWithWM (../../services/ui/ws/window_tree_unittest.cc:1174)
WindowTreeTest.VisibleWindowToModalWithDescendantCapture (../../services/ui/ws/window_tree_unittest.cc:878)
WindowTreeTest.VisibleWindowToModalWithNonDescendantCapture (../../services/ui/ws/window_tree_unittest.cc:965)
WindowTreeTest.VisibleWindowToSystemModalWithCapture (../../services/ui/ws/window_tree_unittest.cc:1040)
WindowTreeTest.WindowManagerCantMoveLoop (../../services/ui/ws/window_tree_unittest.cc:1274)
WindowTreeTest.WindowReorderingChangesCursor (../../services/ui/ws/window_tree_unittest.cc:585)
What is the expected behavior?
All work fine.
What went wrong?
Crash stack example:
[ RUN ] WindowTreeManualDisplayTest.ClientCreatesDisplayRoot
libGL error: failed to load driver: swrast
Uninitialized bytes in __interceptor_strlen at offset 20 inside [0x71f00000fc00, 3280)
==707890==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x7f715ff654c8 in _init ??:0:0
#1 0x7f715ff6a599 in glXMakeCurrent ??:?
#2 0x7f715ff6a599 in ?? ??:0
#3 0x7f715ff66f3a in glXQueryContext ??:?
#4 0x7f715ff66f3a in ?? ??:0
#5 0x7f715ff670ee in glXQueryExtensionsString ??:0:0
#6 0x180918b in gl::RealGLXApi::glXQueryExtensionsStringFn(_XDisplay*, int) /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/gl_glx_api_implementation.cc:99:33
#7 0x180a49f in gl::DriverGLX::GetPlatformExtensions() /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/gl_bindings.cc:59:21
#8 0x17f3948 in gl::DriverGLX::InitializeExtensionBindings() /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/gl_bindings_autogen_glx.cc:117:26
#9 0x34570fa in InitializeStaticGLXInternal /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/init/gl_initializer_x11.cc:79:3
#10 0x34570fa in gl::init::InitializeStaticGLBindings(gl::GLImplementation) /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/init/gl_initializer_x11.cc:194:0
#11 0x3451e3f in gl::init::InitializeGLOneOffImplementation(gl::GLImplementation, bool, bool, bool) /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/init/gl_factory.cc:68:7
#12 0x345141f in gl::init::InitializeGLOneOff() /home/apisarev/workspace/chromium.d/src/out/msan/../../ui/gl/init/gl_factory.cc:59:10
#13 0x3603a28 in gpu::GpuInit::InitializeAndStartSandbox(base::CommandLine const&) /home/apisarev/workspace/chromium.d/src/out/msan/../../gpu/ipc/service/gpu_init.cc:225:22
#14 0x88bb3e in ui::GpuMain::InitOnGpuThread(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>) /home/apisarev/workspace/chromium.d/src/out/msan/../../services/ui/gpu/gpu_main.cc:157:29
#15 0x894957 in void base::internal::FunctorTraits<void (ui::GpuMain::*)(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>), void>::Invoke<ui::GpuMain*, scoped_refptr<base::SingleThreadTaskRunner> const&, scoped_refptr<base::SingleThreadTaskRunner> const&>(void (ui::GpuMain::*)(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>), ui::GpuMain*&&, scoped_refptr<base::SingleThreadTaskRunner> const&, scoped_refptr<base::SingleThreadTaskRunner> const&) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/bind_internal.h:214:12
#16 0x894682 in MakeItSo<void (ui::GpuMain::*const &)(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>), ui::GpuMain *, const scoped_refptr<base::SingleThreadTaskRunner> &, const scoped_refptr<base::SingleThreadTaskRunner> &> /home/apisarev/workspace/chromium.d/src/out/msan/../../base/bind_internal.h:285:12
#17 0x894682 in RunImpl<void (ui::GpuMain::*const &)(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>), const std::__1::tuple<base::internal::UnretainedWrapper<ui::GpuMain>, scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner> > &, 0, 1, 2> /home/apisarev/workspace/chromium.d/src/out/msan/../../base/bind_internal.h:361:0
#18 0x894682 in base::internal::Invoker<base::internal::BindState<void (ui::GpuMain::*)(scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner>), base::internal::UnretainedWrapper<ui::GpuMain>, scoped_refptr<base::SingleThreadTaskRunner>, scoped_refptr<base::SingleThreadTaskRunner> >, void ()>::Run(base::internal::BindStateBase*) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/bind_internal.h:339:0
#19 0xc0be1e in base::Callback<void (), (base::internal::CopyMode)0, (base::internal::RepeatMode)0>::Run() && /home/apisarev/workspace/chromium.d/src/out/msan/../../base/callback.h:91:12
#20 0x131ee1f in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/debug/task_annotator.cc:59:33
#21 0x116beb9 in base::MessageLoop::RunTask(base::PendingTask*) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/message_loop/message_loop.cc:409:19
#22 0x116ddb7 in base::MessageLoop::DeferOrRunPendingTask(base::PendingTask) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/message_loop/message_loop.cc:420:5
#23 0x116ea28 in base::MessageLoop::DoWork() /home/apisarev/workspace/chromium.d/src/out/msan/../../base/message_loop/message_loop.cc:508:13
#24 0x117d622 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/message_loop/message_pump_default.cc:33:31
#25 0x116abae in base::MessageLoop::Run() /home/apisarev/workspace/chromium.d/src/out/msan/../../base/message_loop/message_loop.cc:360:10
#26 0x11df14b in base::RunLoop::Run() /home/apisarev/workspace/chromium.d/src/out/msan/../../base/run_loop.cc:111:14
#27 0x126bbf7 in base::Thread::Run(base::RunLoop*) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/threading/thread.cc:255:13
#28 0x126ca22 in base::Thread::ThreadMain() /home/apisarev/workspace/chromium.d/src/out/msan/../../base/threading/thread.cc:338:3
#29 0x124c904 in base::(anonymous namespace)::ThreadFunc(void*) /home/apisarev/workspace/chromium.d/src/out/msan/../../base/threading/platform_thread_posix.cc:71:13
[705642:705650:0522/152939.918373:885882399236:ERROR:kill_posix.cc(84)] Unable to terminate process group 707932: No such process
#30 0x7f7167fe5183 in start_thread /build/eglibc-MjiXCM/eglibc-2.19/nptl/pthread_create.c:312:0
#31 0x7f7167afcbec in clone /build/eglibc-MjiXCM/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111:0
Uninitialized value was created by a heap allocation
#0 0x47259d in __interceptor_malloc ??:0:0
#1 0x7f715ff6aae3 in glXMakeCurrent ??:?
#2 0x7f715ff6aae3 in ?? ??:0
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/usr/lib/x86_64-linux-gnu/mesa/libGL.so.1+0x194c8)
Exiting
[231/233] WindowTreeManualDisplayTest.ClientCreatesDisplayRoot (CRASHED)
Did this work before? No
Chrome version: dev Channel: dev
OS Version: Ubuntu 14.04.5 LTS
Flash Version:
,
Feb 15 2018
,
Feb 26 2018
,
Jul 19
+kylechar and rjkroege . Would either of you guys happen to have an idea on this? This is preventing us from running some tests on the msan/asan bots.
,
Jul 19
,
Jul 20
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f76e64ab0b989f724ae60e0c2f61175cd84c50cd commit f76e64ab0b989f724ae60e0c2f61175cd84c50cd Author: Scott Violet <sky@chromium.org> Date: Fri Jul 20 05:17:03 2018 chromeos: nukes mash_unittests All interesting tests have been moved into ash_unittest and/or nuked. BUG=842365, 725095 , 838520 TEST=covered by tests Change-Id: I27069966c2ea214a071371b7959f4e44b533dd83 Reviewed-on: https://chromium-review.googlesource.com/1142622 Commit-Queue: Scott Violet <sky@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: Michael Wasserman <msw@chromium.org> Cr-Commit-Position: refs/heads/master@{#576786} [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ash/BUILD.gn [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ash/app_launch_unittest.cc [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ash/ash_service.cc [rename] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ash/ash_service_unittest.cc [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/ash/display/display_synchronizer_unittest.cc [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ash/main.cc [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/ash/wm/top_level_window_factory_mash_unittest.cc [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/mash/BUILD.gn [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/mash/OWNERS [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/mash/test/DEPS [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/mash/test/mash_test_suite.cc [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/mash/test/mash_test_suite.h [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/mash/test/mash_unittests.cc [delete] https://crrev.com/749ae1edb70c73899710bba0bd5c66e9606c00af/mash/unittests_manifest.json [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/testing/buildbot/chromium.chromiumos.json [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/testing/buildbot/chromium.fyi.json [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/testing/buildbot/chromium.memory.json [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/testing/buildbot/gn_isolate_map.pyl [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/testing/buildbot/test_suites.pyl [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ui/aura/mus/in_flight_change.cc [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ui/aura/mus/window_tree_client.cc [modify] https://crrev.com/f76e64ab0b989f724ae60e0c2f61175cd84c50cd/ui/aura/mus/window_tree_client.h
,
Jul 24
What is the current issue? The ui_service_unittests target doesn't exist anymore.
,
Jul 24
I updated the bug to reflect the issue is with ash_unittests now. Specifically AshServiceTest.OpenWindow and AppLaunchTest.TestQuickLaunch. Both of these are disabled in msan builds. When enabled they fail with the same stack stack in comment #1.
,
Jul 25
The failure is happening during GLX initialization. Trybots run tests inside Xvfb which doesn't support GLX so that's not surprising it fails. If you programatically add the kOverrideUseSoftwareGLForTests flag before the GL initialization runs do the tests still fail msan? Also, I thought ash_unittests didn't start a GPU process? The stack trace above looks like it's trying to start the old mus GPU thread. I'm not sure if the current stack trace is different but maybe it points to the test doing something it shouldn't.
,
Jul 25
Will look into adding kOverrideUseSoftwareGLForTests on the command line at the test runner level. As to ash_unittests spinning up the GPU process. There are a couple of tests that trigger launching the ash service, which does start the gpu. Thanks!
,
Aug 9
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/cb3102cf8efe4af75e40d01e293a809439d5d279 commit cb3102cf8efe4af75e40d01e293a809439d5d279 Author: Scott Violet <sky@chromium.org> Date: Thu Aug 09 22:27:20 2018 chromeos: enable a couple of tests on memory sanitizers These now pass because of adding kOverrideUseSoftwareGLForTests in AshTestSuite. BUG= 838520 , 725095 TEST=test only changes Change-Id: I070d5749486338e2fd72815b4dd75d13a391204f Reviewed-on: https://chromium-review.googlesource.com/1169535 Commit-Queue: Scott Violet <sky@chromium.org> Reviewed-by: James Cook <jamescook@chromium.org> Cr-Commit-Position: refs/heads/master@{#581921} [modify] https://crrev.com/cb3102cf8efe4af75e40d01e293a809439d5d279/ash/app_launch_unittest.cc [modify] https://crrev.com/cb3102cf8efe4af75e40d01e293a809439d5d279/ash/ash_service_unittest.cc
,
Aug 10
Kyle, you were absolutely right! Adding the switch fixed this. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by rbasuvula@chromium.org
, Jul 20 2017Labels: TE-NeedsTriageHelp