Direct-leak in sw::Nucleus::Nucleus |
|||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4576998155616256 Fuzzer: libFuzzer_gpu_swiftshader_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: sw::Nucleus::Nucleus sw::Function<sw::Void sw::Blitter::generate Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4576998155616256 Issue filed automatically. See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jun 13 2017
We enabled fuzzing on SwiftShader yesterday, so it's expected these initial reports won't have useful regression information. That said, I notice https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819 doesn't list the SwiftShader revisions. Can we add it?
,
Jun 28 2017
The following revision refers to this bug: https://swiftshader.googlesource.com/SwiftShader.git/+/81aa97bd20033674ba28d779c05fbcee1539ebf7 commit 81aa97bd20033674ba28d779c05fbcee1539ebf7 Author: Nicolas Capens <capn@google.com> Date: Wed Jun 28 14:58:18 2017 Make Blitter part of Renderer. This fixes two issues. We had a global 'blitter' instance which doesn't get destroyed until the library us unloaded. This is reported as a memory leak (albeit benign). Potentially worse is that the singleton was shared between all threads, and the Routine cache isn't thread safe. Bug chromium:732691 Change-Id: I7b90d7d2bc67b4a9f78cdf4f54a76fa2f798b7cc Reviewed-on: https://swiftshader-review.googlesource.com/10128 Tested-by: Nicolas Capens <capn@google.com> Reviewed-by: Alexis Hétu <sugoi@google.com> Reviewed-by: Nicolas Capens <capn@google.com> [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/common/Image.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/common/Image.hpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libEGL/Context.hpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Context.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Context.h [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Texture.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/Texture.h [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/libGLES_CM.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLES_CM/main.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Context.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Context.h [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Texture.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/Texture.h [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/libGLESv2.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/libGLESv3.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/OpenGL/libGLESv2/main.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Reactor/SubzeroReactor.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Blitter.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Blitter.hpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Renderer.cpp [modify] https://crrev.com/81aa97bd20033674ba28d779c05fbcee1539ebf7/src/Renderer/Renderer.hpp
,
Jun 28 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/cbb68c26a16ba1215d8bae41459cb5cf5e8ffda9 commit cbb68c26a16ba1215d8bae41459cb5cf5e8ffda9 Author: capn <capn@chromium.org> Date: Wed Jun 28 16:55:41 2017 Roll SwiftShader 9282c6d..81aa97b https://swiftshader.googlesource.com/SwiftShader.git/+log/9282c6d..81aa97b BUG= 736639 BUG= 732691 TEST=bots CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel,linux_chromium_cfi_rel_ng;master.tryserver.chromium.android:android_optional_gpu_tests_rel Change-Id: Id4c9f8ec2a01c1f5dc3d9bfeb7478763d60482ea Review-Url: https://codereview.chromium.org/2957173003 Cr-Commit-Position: refs/heads/master@{#483029} [modify] https://crrev.com/cbb68c26a16ba1215d8bae41459cb5cf5e8ffda9/DEPS
,
Jul 5 2017
The issue wasn't fixed by #3 yet because there's actually no call to eglDestroyContext() being made. This is an issue in the fuzzer implementation. Setting recreate_context_ to true seems to fix that, but I can still reproduce the original leak so I'll continue to look into that.
,
Jul 5 2017
Found the actual cause: https://swiftshader-review.googlesource.com/10408 Also, reverting my local changes to fuzzer_main.cc didn't cause ASan to report any other memory leaks, despite eglDestroyContect() not being called. I believe this is due to ASan actually checking for reachability instead of checking if anything is still allocated.
,
Jul 5 2017
The following revision refers to this bug: https://swiftshader.googlesource.com/SwiftShader.git/+/619a8c5a7275d5b2f6e162e056ac41e37281a569 commit 619a8c5a7275d5b2f6e162e056ac41e37281a569 Author: Nicolas Capens <capn@google.com> Date: Wed Jul 05 18:52:03 2017 Fix memory leak when aborting routine generation. The blitter aborts generating a Reactor routine when a less common format is being used (causing fallback to statically compiled code). But the intermediate Reactor and Subzero structures were not being freed. It is fixed by deleting the global routine when the Function<> goes out of scope and it hasn't been acquired yet. Bug chromium:732691 Change-Id: I4904a467454e8e8d2ff0dbf64545823c9fd15802 Reviewed-on: https://swiftshader-review.googlesource.com/10408 Reviewed-by: Alexis Hétu <sugoi@google.com> Reviewed-by: Nicolas Capens <capn@google.com> Tested-by: Nicolas Capens <capn@google.com> [modify] https://crrev.com/619a8c5a7275d5b2f6e162e056ac41e37281a569/src/Reactor/SubzeroReactor.cpp [modify] https://crrev.com/619a8c5a7275d5b2f6e162e056ac41e37281a569/src/Renderer/LRUCache.hpp
,
Jul 5 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/e9be2af23b67c48d8e92201b8eee0e47ea725a6e commit e9be2af23b67c48d8e92201b8eee0e47ea725a6e Author: capn <capn@chromium.org> Date: Wed Jul 05 23:52:19 2017 Roll SwiftShader 81aa97b..83a6bb9 https://swiftshader.googlesource.com/SwiftShader.git/+log/81aa97b..83a6bb9 BUG= 732691 BUG= 732739 BUG= 732690 TEST=bots CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel,linux_chromium_cfi_rel_ng;master.tryserver.chromium.android:android_optional_gpu_tests_rel Change-Id: Ia846062e48673f40879b60c87a8e2b5b12256036 Review-Url: https://codereview.chromium.org/2964913004 Cr-Commit-Position: refs/heads/master@{#484372} [modify] https://crrev.com/e9be2af23b67c48d8e92201b8eee0e47ea725a6e/DEPS
,
Jul 6 2017
ClusterFuzz has detected this issue as fixed in range 484343:484459. Detailed report: https://clusterfuzz.com/testcase?key=4576998155616256 Fuzzer: libFuzzer_gpu_swiftshader_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: sw::Nucleus::Nucleus sw::Function<sw::Void sw::Blitter::generate Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=478745:478819 Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=484343:484459 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4576998155616256 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jul 6 2017
ClusterFuzz testcase 4576998155616256 is verified as fixed, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||
►
Sign in to add a comment |
|||
Comment 1 by msrchandra@chromium.org
, Jun 13 2017Components: Internals>GPU>SwiftShader
Labels: M-61 Test-Predator-Wrong-CLs
Owner: capn@chromium.org
Status: Assigned (was: Untriaged)