Issue metadata
Sign in to add a comment
|
Data race in blink::BaseAudioContext::HandleStoppableSourceNodes |
||||||||||||||||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5370096213295104 Fuzzer: inferno_twister_c Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 8 Crash Address: 0x7ea23c441d58 Crash State: blink::BaseAudioContext::HandleStoppableSourceNodes blink::BaseAudioContext::HandlePreRenderTasks blink::AudioDestinationHandler::Render Sanitizer: thread (TSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5370096213295104 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 8 2017
,
Jun 8 2017
I believe this is the same (or very closely related to) issue 727091 . This is being worked on in https://codereview.chromium.org/2913303002 sigbjornf@ Is that right?
,
Jun 8 2017
Yes, I agree - same underlying issue.
,
Jun 8 2017
,
Jun 8 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/548a4efe0d1cf9aa4958b1b73d53a9f0b1126a89 commit 548a4efe0d1cf9aa4958b1b73d53a9f0b1126a89 Author: sigbjornf <sigbjornf@opera.com> Date: Thu Jun 08 21:10:42 2017 Avoid unsafe heap access from audio thread. The audio thread tries to touch main thread Blink GCed objects in a select few places, which isn't safe as a GC might concurrently run. Avoid such cross off-thread usage, rearrange the processing of finished nodes from the audio thread to the main thread. R=hongchan,rtoy,haraken BUG= 727091 , 729275 Review-Url: https://codereview.chromium.org/2913303002 Cr-Commit-Position: refs/heads/master@{#478084} [modify] https://crrev.com/548a4efe0d1cf9aa4958b1b73d53a9f0b1126a89/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.cpp [modify] https://crrev.com/548a4efe0d1cf9aa4958b1b73d53a9f0b1126a89/third_party/WebKit/Source/modules/webaudio/BaseAudioContext.h [modify] https://crrev.com/548a4efe0d1cf9aa4958b1b73d53a9f0b1126a89/third_party/WebKit/Source/modules/webaudio/OfflineAudioContext.cpp
,
Jun 9 2017
ClusterFuzz has detected this issue as fixed in range 478007:478121. Detailed report: https://clusterfuzz.com/testcase?key=5370096213295104 Fuzzer: inferno_twister_c Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 8 Crash Address: 0x7ea23c441d58 Crash State: blink::BaseAudioContext::HandleStoppableSourceNodes blink::BaseAudioContext::HandlePreRenderTasks blink::AudioDestinationHandler::Render Sanitizer: thread (TSAN) Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=478007:478121 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5370096213295104 See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by ranjitkan@chromium.org
, Jun 8 2017Components: Blink>WebAudio
Labels: -Type-Bug M-61 Test-Predator-Wrong Type-Bug-Regression
Owner: tzik@chromium.org
Status: Assigned (was: Untriaged)