New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 732691 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jul 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in sw::Nucleus::Nucleus

Project Member Reported by ClusterFuzz, Jun 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4576998155616256

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  sw::Nucleus::Nucleus
  sw::Function<sw::Void
  sw::Blitter::generate
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4576998155616256


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Components: Internals>GPU>SwiftShader
Labels: M-61 Test-Predator-Wrong-CLs
Owner: capn@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "SubzeroReactor.cpp" assigning to the concern owner.
Suspecting Commit#
https://swiftshader.googlesource.com/SwiftShader.git/+/e745f5a9ba3780d6bf5b0904d398ccc82104febf

@capn -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by capn@chromium.org, Jun 13 2017

We enabled fuzzing on SwiftShader yesterday, so it's expected these initial reports won't have useful regression information. That said, I notice https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819 doesn't list the SwiftShader revisions. Can we add it?
Project Member

Comment 3 by bugdroid1@chromium.org, Jun 28 2017

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/81aa97bd20033674ba28d779c05fbcee1539ebf7

commit 81aa97bd20033674ba28d779c05fbcee1539ebf7
Author: Nicolas Capens <capn@google.com>
Date: Wed Jun 28 14:58:18 2017

Make Blitter part of Renderer.

This fixes two issues. We had a global 'blitter' instance which doesn't
get destroyed until the library us unloaded. This is reported as a
memory leak (albeit benign). Potentially worse is that the singleton was
shared between all threads, and the Routine cache isn't thread safe.

 Bug chromium:732691 

Change-Id: I7b90d7d2bc67b4a9f78cdf4f54a76fa2f798b7cc
Reviewed-on: https://swiftshader-review.googlesource.com/10128
Tested-by: Nicolas Capens <capn@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <capn@google.com>

[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/common/Image.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/common/Image.hpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libEGL/Context.hpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Context.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Context.h
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Texture.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Texture.h
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/libGLES_CM.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/main.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Context.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Context.h
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Texture.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Texture.h
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/libGLESv2.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/libGLESv3.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/main.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Reactor/SubzeroReactor.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Blitter.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Blitter.hpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Renderer.cpp
[modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Renderer.hpp

Project Member

Comment 4 by bugdroid1@chromium.org, Jun 28 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cbb68c26a16ba1215d8bae41459cb5cf5e8ffda9

commit cbb68c26a16ba1215d8bae41459cb5cf5e8ffda9
Author: capn <capn@chromium.org>
Date: Wed Jun 28 16:55:41 2017

Roll SwiftShader 9282c6d..81aa97b

https://swiftshader.googlesource.com/SwiftShader.git/+log/9282c6d..81aa97b

BUG= 736639 
BUG= 732691 

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel,linux_chromium_cfi_rel_ng;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Change-Id: Id4c9f8ec2a01c1f5dc3d9bfeb7478763d60482ea
Review-Url: https://codereview.chromium.org/2957173003
Cr-Commit-Position: refs/heads/master@{#483029}

[modify] https://crrev.com/cbb68c26a16ba1215d8bae41459cb5cf5e8ffda9/DEPS

Comment 5 by capn@chromium.org, Jul 5 2017

Cc: geoffl...@chromium.org piman@chromium.org
Status: Started (was: Assigned)
The issue wasn't fixed by #3 yet because there's actually no call to eglDestroyContext() being made. This is an issue in the fuzzer implementation. Setting recreate_context_ to true seems to fix that, but I can still reproduce the original leak so I'll continue to look into that.

Comment 6 by capn@chromium.org, Jul 5 2017

Found the actual cause: https://swiftshader-review.googlesource.com/10408

Also, reverting my local changes to fuzzer_main.cc didn't cause ASan to report any other memory leaks, despite eglDestroyContect() not being called. I believe this is due to ASan actually checking for reachability instead of checking if anything is still allocated.
Project Member

Comment 7 by bugdroid1@chromium.org, Jul 5 2017

The following revision refers to this bug:
  https://swiftshader.googlesource.com/SwiftShader.git/+/619a8c5a7275d5b2f6e162e056ac41e37281a569

commit 619a8c5a7275d5b2f6e162e056ac41e37281a569
Author: Nicolas Capens <capn@google.com>
Date: Wed Jul 05 18:52:03 2017

Fix memory leak when aborting routine generation.

The blitter aborts generating a Reactor routine when a less common
format is being used (causing fallback to statically compiled code). But
the intermediate Reactor and Subzero structures were not being freed. It
is fixed by deleting the global routine when the Function<> goes out of
scope and it hasn't been acquired yet.

 Bug chromium:732691 

Change-Id: I4904a467454e8e8d2ff0dbf64545823c9fd15802
Reviewed-on: https://swiftshader-review.googlesource.com/10408
Reviewed-by: Alexis Hétu <sugoi@google.com>
Reviewed-by: Nicolas Capens <capn@google.com>
Tested-by: Nicolas Capens <capn@google.com>

[modify] https://crrev.com/619a8c5a7275d5b2f6e162e056ac41e37281a569/src/Reactor/SubzeroReactor.cpp
[modify] https://crrev.com/619a8c5a7275d5b2f6e162e056ac41e37281a569/src/Renderer/LRUCache.hpp

Project Member

Comment 8 by bugdroid1@chromium.org, Jul 5 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e9be2af23b67c48d8e92201b8eee0e47ea725a6e

commit e9be2af23b67c48d8e92201b8eee0e47ea725a6e
Author: capn <capn@chromium.org>
Date: Wed Jul 05 23:52:19 2017

Roll SwiftShader 81aa97b..83a6bb9

https://swiftshader.googlesource.com/SwiftShader.git/+log/81aa97b..83a6bb9

BUG= 732691 
BUG= 732739 
BUG= 732690 

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel,linux_chromium_cfi_rel_ng;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Change-Id: Ia846062e48673f40879b60c87a8e2b5b12256036
Review-Url: https://codereview.chromium.org/2964913004
Cr-Commit-Position: refs/heads/master@{#484372}

[modify] https://crrev.com/e9be2af23b67c48d8e92201b8eee0e47ea725a6e/DEPS

Project Member

Comment 9 by ClusterFuzz, Jul 6 2017

ClusterFuzz has detected this issue as fixed in range 484343:484459.

Detailed report: https://clusterfuzz.com/testcase?key=4576998155616256

Fuzzer: libFuzzer_gpu_swiftshader_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  sw::Nucleus::Nucleus
  sw::Function<sw::Void
  sw::Blitter::generate
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=484343:484459

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4576998155616256


See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 10 by ClusterFuzz, Jul 6 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 4576998155616256 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment