Direct-leak in v8::internal::CreateICUDateFormat |
||||||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4916694501031936 Fuzzer: inferno_js_fuzzer Job Type: mac_asan_d8 Platform Id: mac Crash Type: Direct-leak Crash Address: Crash State: v8::internal::CreateICUDateFormat v8::internal::DateFormat::InitializeDateTimeFormat __RT_impl_Runtime_CreateDateTimeFormat Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_d8&range=466203:466217 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4916694501031936 Issue filed automatically. See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 6 2017
Working on reproducing it, thanks for triaging it to me.
,
Jun 7 2017
,
Jun 7 2017
,
Jun 7 2017
To reproduce, build a debug asan d8 with these gn flags: is_asan = true is_component_build = false is_debug = true is_lsan = true use_goma = true target_cpu = "x64" Then, set ASAN_OPTIONS, e.g. like this (the most important one is probably "detect_leaks=1"): export ASAN_OPTIONS=redzone=128:symbolize=0:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:detect_leaks=1:print_scariness=1:check_malloc_usable_size=0:max_uar_stack_size_log=16:use_sigaltstack=1:handle_abort=1:strict_memcmp=0:detect_container_overflow=0:coverage=0:detect_odr_violation=0:allocator_may_return_null=1:handle_sigill=1:handle_segv=1:fast_unwind_on_fatal=1 Then, run d8 with the reproducer from above: out/Debug.asan/d8 -e 'new Intl.DateTimeFormat();'
,
Jun 7 2017
Thanks for the reproduction instructions. They worked for me. It seems like the leak occurs when exiting V8 before performing a GC. I can see, when running it interactively, that the DeleteDateFormat call, which is supposed to free the data that's leaking, is never reached. However, after an explicit call to gc(), DeleteDateFormat is reached, and there is no leak. I was under the impression that GC and various other kinds of cleanup might not be performed on shutdown because typically, we'll be discarding the whole process. Is that the case? If so, it might not be a problem to "leak" these ICU-allocated objects.
,
Jun 8 2017
Michael, as explained above, I believe this is not a bug but rather an artifact of the infrastructure. Is there some general way we could categorize reports like this in the future more automatically?
,
Jun 8 2017
I asked the question elsewhere: Why are we detecting leaks on mac asan if we're not doing it on the main waterfall in the first place? What prevents us from doing it there? Or is this issue also happening on linux? Otherwise, I have no good suggestion for what to do with this kind of leaks. I have no insights in how the sanitizers work in regards to our shutdown. Maybe forward this to v8-dev? One thing maybe: Our test runner also passes two additional flags for testing with asan on the main waterfall: https://cs.chromium.org/chromium/src/v8/tools/run-tests.py?q=%22--omit-quit%22+package:%5Echromium$&l=546 Does this still repro with d8 when --invoke-weak-callbacks and --omit-quit is passed?
,
Jun 9 2017
--invoke-weak-callbacks makes the leak not happen. This makes sense, since it's weak callbacks that are responsible for freeing the data. Should we add this flag to CF ASAN runs? (--omit-quit seems to have no effect)
,
Jun 12 2017
Offline discussion with mstarzinger (+jochen who added the --invoke-weak-callbacks flag): The flag --invoke-weak-callbacks should be added on all jobs using lsan to not produce extra noise coming from untidy weak links. Real leaks will still be found when passing the flag. We already pass the flag on all ASAN jobs in APP_ARGS list, but not in REQUIRED_APP_ARGS list. So I assume the fuzzer fuzzed it away in this bug. I'll do the changes to the jobs. Not sure what to do with bugs like this. Maybe just set to Wontfix? And manually set the underlying clusterfuzz test case to fixed?
,
Jun 15 2017
,
Jun 15 2017
Issue 728018 has been merged into this issue.
,
Jun 15 2017
As machenbach recommended, I manually set the ClusterFuzz test cases to fixed; I look forward to seeing more bug reports that aren't spurious in this code :)
,
Jul 12 2017
,
Jul 14 2017
ClusterFuzz testcase 4916694501031936 is still reproducing on tip-of-tree build (trunk). If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase. Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
,
Jul 15 2017
As noted above, the CF test is invalid, as it uses flag settings which are expected to leak data. |
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by clemensh@chromium.org
, Jun 6 2017Status: Assigned (was: Untriaged)