New issue
Advanced search Search tips

Issue 736802 link

Starred by 1 user
Status: Duplicate
Merged: issue 739361
Owner:
yhirano@chromium.org
Closed: Jul 2017
Cc:
tzik@chromium.org
hirosh...@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 3
Type: Bug



Sign in to add a comment

serviceworker-proxied/thorough/cors-preflight2-other-https.html crashes on MSAN

Project Member Reported by xidac...@chromium.org, Jun 26 2017 
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20Trusty%20MSAN/builds/1573

From chromium flakiness dashboard, the first time it starts flaky is here:
https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20Trusty%20MSAN/builds/1525

I cannot find which CL on the blame list would be responsible

hiroshige@: the test added by you quite long time ago, could you assign this to the right owner.
Project Member

Comment 1 by bugdroid1@chromium.org, Jun 26 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7e6f303110c999354c0d343d40e5ac23be3f81d5

commit 7e6f303110c999354c0d343d40e5ac23be3f81d5
Author: Xida Chen <xidachen@chromium.org>
Date: Mon Jun 26 17:34:00 2017

Mark serviceworker-proxied/thorough/cors-preflight2-other-https.html crash on MSAN

TBR=imcheng@chromium.org
NOTRY=true

Bug:  736802 
Change-Id: I9938a569ad9fe8001fe0b3385c519ca95ad9a70b
Reviewed-on: https://chromium-review.googlesource.com/548836
Reviewed-by: Xida Chen <xidachen@chromium.org>
Commit-Queue: Xida Chen <xidachen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#482304}
[modify] https://crrev.com/7e6f303110c999354c0d343d40e5ac23be3f81d5/third_party/WebKit/LayoutTests/MSANExpectations

Comment 2 by hirosh...@chromium.org, Jul 6 2017

Cc: hirosh...@chromium.org tzik@chromium.org
Components: Blink>Loader
Owner: yhirano@chromium.org
Looks like mojo-related. yhirano@, could you take a look?

Comment 3 by yhirano@chromium.org, Jul 10 2017 

==1==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0xb16c172 in mojo::edk::DataPipeConsumerDispatcher::UpdateSignalsStateNoLock() mojo/edk/system/data_pipe_consumer_dispatcher.cc:581:7
    #1 0xb16d5cc in OnPortStatusChanged mojo/edk/system/data_pipe_consumer_dispatcher.cc:521:3
    #2 0xb16d5cc in mojo::edk::DataPipeConsumerDispatcher::PortObserverThunk::OnPortStatusChanged() mojo/edk/system/data_pipe_consumer_dispatcher.cc:67:0
    #3 0xb1972c2 in mojo::edk::NodeController::PortStatusChanged(mojo::edk::ports::PortRef const&) mojo/edk/system/node_controller.cc:745:15
    #4 0x10d2a0b in mojo::edk::ports::Node::OnObserveClosure(std::__1::unique_ptr<mojo::edk::ports::ObserveClosureEvent, std::__1::default_delete<mojo::edk::ports::ObserveClosureEvent> >) mojo/edk/system/ports/node.cc:698:16
    #5 0x10cfeb5 in mojo::edk::ports::Node::AcceptEvent(std::__1::unique_ptr<mojo::edk::ports::Event, std::__1::default_delete<mojo::edk::ports::Event> >) mojo/edk/system/ports/node.cc:344:14
    #6 0xb19d019 in mojo::edk::NodeController::OnEventMessage(mojo::edk::ports::NodeName const&, std::__1::unique_ptr<mojo::edk::Channel::Message, std::__1::default_delete<mojo::edk::Channel::Message> >) mojo/edk/system/node_controller.cc:1000:10
    #7 0xb1f40c1 in mojo::edk::NodeChannel::OnChannelMessage(void const*, unsigned long, std::__1::unique_ptr<std::__1::vector<mojo::edk::PlatformHandle, std::__1::allocator<mojo::edk::PlatformHandle> >, mojo::edk::PlatformHandleVectorDeleter>) mojo/edk/system/node_channel.cc:616:18
    #8 0xb1db76a in mojo::edk::Channel::OnReadComplete(unsigned long, unsigned long*) mojo/edk/system/channel.cc:662:18
    #9 0xb1e3d03 in mojo::edk::(anonymous namespace)::ChannelPosix::OnFileCanReadWithoutBlocking(int) mojo/edk/system/channel_posix.cc:317:14
    #10 0x6871777 in base::MessagePumpLibevent::OnLibeventNotification(int, short, void*) base/message_loop/message_pump_libevent.cc:0:13
    #11 0x6b1402a in event_process_active base/third_party/libevent/event.c:381:4
    #12 0x6b1402a in event_base_loop base/third_party/libevent/event.c:521:0
    #13 0x6872842 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:223:5
    #14 0x68ffe70 in base::RunLoop::Run() base/run_loop.cc:111:14
    #15 0x69b4b53 in base::Thread::ThreadMain() base/threading/thread.cc:338:3
    #16 0x6999c55 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:71:13
    #17 0x7f4bd7379183 in start_thread /build/eglibc-SvCtMH/eglibc-2.19/nptl/pthread_create.c:312:0
    #18 0x7f4bd4fb8ffc in clone /build/eglibc-SvCtMH/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111:0

  Uninitialized value was stored to memory at
    #0 0xb16bf28 in mojo::edk::DataPipeConsumerDispatcher::UpdateSignalsStateNoLock() mojo/edk/system/data_pipe_consumer_dispatcher.cc:533:16
    #1 0xb16d5cc in OnPortStatusChanged mojo/edk/system/data_pipe_consumer_dispatcher.cc:521:3
    #2 0xb16d5cc in mojo::edk::DataPipeConsumerDispatcher::PortObserverThunk::OnPortStatusChanged() mojo/edk/system/data_pipe_consumer_dispatcher.cc:67:0
    #3 0xb1972c2 in mojo::edk::NodeController::PortStatusChanged(mojo::edk::ports::PortRef const&) mojo/edk/system/node_controller.cc:745:15
    #4 0x10d2a0b in mojo::edk::ports::Node::OnObserveClosure(std::__1::unique_ptr<mojo::edk::ports::ObserveClosureEvent, std::__1::default_delete<mojo::edk::ports::ObserveClosureEvent> >) mojo/edk/system/ports/node.cc:698:16
    #5 0x10cfeb5 in mojo::edk::ports::Node::AcceptEvent(std::__1::unique_ptr<mojo::edk::ports::Event, std::__1::default_delete<mojo::edk::ports::Event> >) mojo/edk/system/ports/node.cc:344:14
    #6 0xb19d019 in mojo::edk::NodeController::OnEventMessage(mojo::edk::ports::NodeName const&, std::__1::unique_ptr<mojo::edk::Channel::Message, std::__1::default_delete<mojo::edk::Channel::Message> >) mojo/edk/system/node_controller.cc:1000:10
    #7 0xb1f40c1 in mojo::edk::NodeChannel::OnChannelMessage(void const*, unsigned long, std::__1::unique_ptr<std::__1::vector<mojo::edk::PlatformHandle, std::__1::allocator<mojo::edk::PlatformHandle> >, mojo::edk::PlatformHandleVectorDeleter>) mojo/edk/system/node_channel.cc:616:18
    #8 0xb1db76a in mojo::edk::Channel::OnReadComplete(unsigned long, unsigned long*) mojo/edk/system/channel.cc:662:18
    #9 0xb1e3d03 in mojo::edk::(anonymous namespace)::ChannelPosix::OnFileCanReadWithoutBlocking(int) mojo/edk/system/channel_posix.cc:317:14
    #10 0x6871777 in base::MessagePumpLibevent::OnLibeventNotification(int, short, void*) base/message_loop/message_pump_libevent.cc:0:13
    #11 0x6b1402a in event_process_active base/third_party/libevent/event.c:381:4
    #12 0x6b1402a in event_base_loop base/third_party/libevent/event.c:521:0
    #13 0x6872842 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) base/message_loop/message_pump_libevent.cc:223:5
    #14 0x68ffe70 in base::RunLoop::Run() base/run_loop.cc:111:14
    #15 0x69b4b53 in base::Thread::ThreadMain() base/threading/thread.cc:338:3
    #16 0x6999c55 in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:71:13
    #17 0x7f4bd7379183 in start_thread /build/eglibc-SvCtMH/eglibc-2.19/nptl/pthread_create.c:312:0

  Uninitialized value was created by an allocation of 'port_status' in the stack frame of function '_ZN4mojo3edk26DataPipeConsumerDispatcher24UpdateSignalsStateNoLockEv'
    #0 0xb16b650 in mojo::edk::DataPipeConsumerDispatcher::UpdateSignalsStateNoLock() mojo/edk/system/data_pipe_consumer_dispatcher.cc:524:0

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/s/w/ir/out/Release/content_shell+0xb16c172)
Exiting

Comment 4 by yhirano@chromium.org, Jul 10 2017

Components: Internals>Mojo
Mergedinto: 739361
Status: Duplicate (was: Assigned)
It's definitely a mojo issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Jul 10 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6959be1ffaab698f2a0990ed4d2ba30f245bfba1

commit 6959be1ffaab698f2a0990ed4d2ba30f245bfba1
Author: Yutaka Hirano <yhirano@chromium.org>
Date: Mon Jul 10 14:52:11 2017

Revert "Mark serviceworker-proxied/thorough/cors-preflight2-other-https.html crash on MSAN"

This reverts commit 7e6f303110c999354c0d343d40e5ac23be3f81d5.

Reason for revert: The crash is fixed by https://chromium.googlesource.com/chromium/src/+/b5ac971cfbf3afa2230534369912bffccefb0fc1.

Original change's description:
> Mark serviceworker-proxied/thorough/cors-preflight2-other-https.html crash on MSAN
> 
> TBR=imcheng@chromium.org
> NOTRY=true
> 
> Bug:  736802 
> Change-Id: I9938a569ad9fe8001fe0b3385c519ca95ad9a70b
> Reviewed-on: https://chromium-review.googlesource.com/548836
> Reviewed-by: Xida Chen <xidachen@chromium.org>
> Commit-Queue: Xida Chen <xidachen@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#482304}

TBR=imcheng@chromium.org,xidachen@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug:  736802 
Change-Id: If05af3b9aa3df36c160b756cebf8ee1a3a38df76
Reviewed-on: https://chromium-review.googlesource.com/564878
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#485268}
[modify] https://crrev.com/6959be1ffaab698f2a0990ed4d2ba30f245bfba1/third_party/WebKit/LayoutTests/MSANExpectations
►

Sign in to add a comment