New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 751011 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug

Blocking:
issue 751811
issue 750868



Sign in to add a comment

CHECK failure: !queue_empty_closure_ in scoped_task_environment.cc

Project Member Reported by ClusterFuzz, Aug 1 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5380821979758592

Fuzzer: afl_media_pipeline_integration_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !queue_empty_closure_ in scoped_task_environment.cc
  AssertOnQueueEmptyClosureIsNull
  base::test::ScopedTaskEnvironment::RunUntilIdle
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=490799:490827

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5380821979758592


Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Cc: msrchandra@chromium.org
Labels: M-62 Test-Predator-Wrong
Owner: robliao@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL did not provide any possible suspects.
Using Code Search for the file, "scoped_task_environment.cc" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/48de879ed5cb3ea81d10710caaf33eec1e2c5d08

@robliao -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Cc: -msrchandra@chromium.org
Components: Internals>TaskScheduler
Owner: msrchandra@chromium.org
There aren't any usable stack traces:
[0731/201429.609909:FATAL:scoped_task_environment.cc(192)] Check failed: !queue_empty_closure_.
#0 0x000000473581 <unknown>
#1 0x00000098a95e <unknown>
#2 0x0000009a2056 <unknown>
#3 0x00000286f0c1 <unknown>
#4 0x00000050bb92 <unknown>
#5 0x0000004f4dc2 <unknown>
#6 0x0000005566d0 <unknown>

Can you get a case where stack traces are available?
Cc: mmoroz@chromium.org wolenetz@chromium.org
Cc: fdoray@chromium.org dalecur...@chromium.org
+fdoray@ and dalecurtis@

Given when this uptick in fuzzer crash rate occurred, I suspect:
https://chromium.googlesource.com/chromium/src/+/26486308a3f4f2443a15f4c5813c0cab0b53c8d8
Blocking: 751811
This is still unfixed, and I need the fuzzer running again so that I can close  bug 751811  with confidence. So I consulted fdoray@ and produced https://chromium-review.googlesource.com/c/604504, in review now.
Project Member

Comment 7 by bugdroid1@chromium.org, Aug 9 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7ab03b1282bf1526e3b3619253d202d9db0fd8c3

commit 7ab03b1282bf1526e3b3619253d202d9db0fd8c3
Author: Matt Wolenetz <wolenetz@chromium.org>
Date: Wed Aug 09 18:32:37 2017

Update ScopedTaskEnvironment to be resilient to tests quitting the RunLoop

Various tests (such as those using PipelineIntegrationTestBase::Seek()
and similar) use the (deprecated) MessageLoop::QuitWhenIdleClosure() or
RunLoop::QuitCurrentWhenIdleDeprecated().
That usage was previously incompatible with
ScopedTaskEnvironment::RunUntilIdle(), which expects its run_loop to
execute the OnQueueEmptyClosure (which is a OnceClosure). This was
causing things like media_pipeline_integration_fuzzer's ::Seek() to
crash due to the Seek completion having quit the run_loop without
running the ScopedTaskEnvironment's OnQueueEmptyClosure.

This change implements fdoray@'s suggestion (in lieu of fixing all
the related deprecated test usages for now) to just restart
ScopedTaskEnvironment::RunUntilIdle() in such cases.

BUG= 751011 ,708584
R=fdoray@chromium.org
TEST=Locally on linux, crashing fuzzer case runs to completion, and no media_unittests regression

Change-Id: Id99fe93e1eddfaa83bc90fa1ac61ce96c5ac6999
Reviewed-on: https://chromium-review.googlesource.com/604504
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Reviewed-by: Gabriel Charette <gab@chromium.org>
Reviewed-by: Francois Doray <fdoray@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493066}
[modify] https://crrev.com/7ab03b1282bf1526e3b3619253d202d9db0fd8c3/base/test/scoped_task_environment.cc

Project Member

Comment 8 by ClusterFuzz, Aug 10 2017

ClusterFuzz has detected this issue as fixed in range 493027:493099.

Detailed report: https://clusterfuzz.com/testcase?key=5380821979758592

Fuzzer: afl_media_pipeline_integration_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  !queue_empty_closure_ in scoped_task_environment.cc
  AssertOnQueueEmptyClosureIsNull
  base::test::ScopedTaskEnvironment::RunUntilIdle
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=490799:490827
Fixed: https://clusterfuzz.com/revisions?job=afl_chrome_asan&range=493027:493099

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5380821979758592

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 9 by ClusterFuzz, Aug 10 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5380821979758592 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Cc: msrchandra@chromium.org
Owner: wolenetz@chromium.org
Blocking: 750868

Sign in to add a comment