New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 728213 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 570852
Owner:
Closed: Jun 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in webrtc::XErrorTrap::XErrorTrap

Project Member Reported by ClusterFuzz, May 31 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6170238956863488

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7ff537464f90
Crash State:
  webrtc::XErrorTrap::XErrorTrap
  webrtc::XServerPixelBuffer::Init
  webrtc::WindowCapturerLinux::SelectSource
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=475858:475860

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6170238956863488


Additional requirements: Requires HTTP

Issue filed automatically.

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
 
Cc: ranjitkan@chromium.org
Labels: M-61 Test-Predator-Correct-CLs
Owner: fdoray@chromium.org
Status: Assigned (was: Untriaged)
Assigning to the concern owner from Predator results --
The result is a list of CLs that change the crashed files.

Author: fdoray
Project: chromium
Changelist: https://chromium.googlesource.com/chromium/src/+/ea326b6451c3b0b6176c65bf517e66a26fc3a543
Time: Fri May 19 21:44:19 2017
The CL last changed line 326 of file task_tracker.cc, which is stack frame 6.

@fdoray: Assigning to you, kindly take a look into it. Please help us to find an owner if not with respect to your change.

Thanks.!
Components: Blink>WebRTC
Owner: sergeyu@chromium.org
TaskTracker is running a task. At first sight, the error seems to be in that task rather than in TaskTracker. Assigning to Webrtc owner. Reassign to me if you think this is incorrect.
This bug was reported because of a race when writing |g_last_xserver_error_code| in XErrorTrap::XErrorTrap. Is XErrorTrap::XErrorTrap supposed to be called from different threads/sequences? If so, synchronization would be required to access |g_last_xserver_error_code|.
Mergedinto: 570852
Status: Duplicate (was: Assigned)
Project Member

Comment 5 by ClusterFuzz, Jun 2 2017

ClusterFuzz has detected this issue as fixed in range 476532:476536.

Detailed report: https://clusterfuzz.com/testcase?key=6170238956863488

Fuzzer: phoglund_webrtc_peerconnection
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 4
Crash Address: 0x7ff537464f90
Crash State:
  webrtc::XErrorTrap::XErrorTrap
  webrtc::XServerPixelBuffer::Init
  webrtc::WindowCapturerLinux::SelectSource
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=475858:475860
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=476532:476536

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6170238956863488


Additional requirements: Requires HTTP

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Sign in to add a comment