New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 754996 link

Starred by 5 users

Issue metadata

Status: Verified
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

CHECK failure: false. failed to open UTS46 data with error: 4 in url_canon_icu.cc

Project Member Reported by ClusterFuzz, Aug 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5262037797306368

Fuzzer: libFuzzer_template_url_parser_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. failed to open UTS46 data with error: 4 in url_canon_icu.cc
  url::UIDNAWrapper::UIDNAWrapper
  base::LazyInstanceTraitsBase<url::UIDNAWrapper>::New
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5262037797306368

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. If the fix resolved the issue, please close the bug by marking as Fixed.
 

Comment 1 by sdy@chromium.org, Aug 14 2017

Owner: ellyjo...@chromium.org
Status: Assigned (was: Untriaged)
[MacTriage] Elly, any ideas? It looks like you added this check in r335958.
This bug happens every so often, usually because whoever is running clusterfuzz does not have the ICU data files available when running the test. That CHECK is there so that it always crashes this way, instead of crashing later on when a function tries to use ICU's conversion functions. We should probably add a descriptive message on that CHECK().
Project Member

Comment 3 by ClusterFuzz, Oct 1 2017

Labels: OS-Linux
Owner: ----
Status: WontFix (was: Assigned)
I'm not going to work on this issue.
Cc: kkaluri@chromium.org ellyjo...@chromium.org
 Issue 774858  has been merged into this issue.
Project Member

Comment 6 by ClusterFuzz, Oct 18 2017

Labels: Needs-Feedback
ClusterFuzz testcase 4511095913185280 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.
Project Member

Comment 7 by ClusterFuzz, Oct 31 2017

Components: Internals>Core
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
 Issue 780827  has been merged into this issue.
Cc: msrchandra@chromium.org pnangunoori@chromium.org
 Issue 781588  has been merged into this issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
 Issue 793661  has been merged into this issue.
 Issue 794418  has been merged into this issue.
 Issue 795240  has been merged into this issue.
Cc: metzman@chromium.org
Owner: js...@chromium.org
Status: Assigned (was: WontFix)
This is crashing couple of fuzzers on startup with corpus.

To reproduce,
gn gen //out/coverage --args='use_goma=true goma_dir="/build/goma" is_clang=true use_libfuzzer=true is_component_build=false pdf_enable_xfa=true proprietary_codecs=true ffmpeg_branding="ChromeOS"' 
gclient runhooks
python ./tools/clang/scripts/update.py
ninja -C out/libfuzzer -j300 payment_method_manifest_fuzzer

sync corpus locally
mkdir /tmp/b
cd /tmp/b
gsutil -m rsync -r gs://clusterfuzz-corpus/libfuzzer/payment_method_manifest_fuzzer .

then run fuzz target
out/libfuzzer/payment_method_manifest_fuzzer /tmp/b
let it run for 2-3 min, you will see crash

[0117/094527.995524:FATAL:url_canon_icu.cc(104)] Check failed: false. failed to open UTS46 data with error: 4. If you see this error message in a test environment your test environment likely lacks the required data tables for libicu. See  https://crbug.com/778929 .


Comment 15 by js...@chromium.org, Jan 17 2018

struct IcuEnvironment {
  IcuEnvironment() {
    base::i18n::InitializeICU();
  }
};

And, each fuzzing binary need to have

IcuEnvironment* env = new IcuEnvironment();



affected fuzz targets.
https://clusterfuzz.com/v2/crash-stats?block=day&days=7&end=421170&group=fuzzer_name&number=count&q=UTS46&sort=total_count

payment_method_manifest_fuzzer
csv_reader_fuzzer

Thanks Jungshik for fixing these. Also, i think InitializeICU should go in a CHECK, right so that if it fails, fuzz target fail.

Comment 17 by js...@chromium.org, Jan 17 2018

Status: Started (was: Assigned)
Thank you. I added CHECK(). 

https://chromium-review.googlesource.com/c/chromium/src/+/871350

is a CL. 

Comment 18 by js...@chromium.org, Jan 17 2018

Labels: -Needs-Feedback -Unreproducible
Issue 790991 has been merged into this issue.
Project Member

Comment 20 by bugdroid1@chromium.org, Jan 30 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c5698b5c9d00bc9f9e9960995f6def95c714a41d

commit c5698b5c9d00bc9f9e9960995f6def95c714a41d
Author: Jungshik Shin <jshin@chromium.org>
Date: Tue Jan 30 16:03:58 2018

Initialize ICU to load ICU data file for fuzzing

A couple of fuzzers that rely on url/ didn't initialize
ICU. Because url/ depends on ICU for IDN handling, this
results in an assertion failure when ICU's IDN class is
initialized.

Initialize ICU in a test enivornment for the following fuzzers:
  payment_method_manifest_parser_fuzzer
  csv_reader_fuzzer

In addition, print a human readable error message instead of a numeric
error code.

Bug:  754996 
Test: The two fuzzers above do not fail the assertion about UIDNA.
Change-Id: I942d339d1ef1d71dd5c9c4e79a774f2c2980555d
Reviewed-on: https://chromium-review.googlesource.com/871350
Reviewed-by: Mike West <mkwst@chromium.org>
Reviewed-by: Rouslan Solomakhin <rouslan@chromium.org>
Reviewed-by: Jay Civelli <jcivelli@chromium.org>
Reviewed-by: Vasilii Sukhanov <vasilii@chromium.org>
Reviewed-by: Abhishek Arya <inferno@chromium.org>
Commit-Queue: Abhishek Arya <inferno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#532894}
[modify] https://crrev.com/c5698b5c9d00bc9f9e9960995f6def95c714a41d/components/password_manager/core/browser/BUILD.gn
[modify] https://crrev.com/c5698b5c9d00bc9f9e9960995f6def95c714a41d/components/password_manager/core/browser/import/password_csv_reader_fuzzer.cc
[modify] https://crrev.com/c5698b5c9d00bc9f9e9960995f6def95c714a41d/components/payments/content/utility/BUILD.gn
[modify] https://crrev.com/c5698b5c9d00bc9f9e9960995f6def95c714a41d/components/payments/content/utility/payment_method_manifest_parser_fuzzer.cc
[modify] https://crrev.com/c5698b5c9d00bc9f9e9960995f6def95c714a41d/url/url_canon_icu.cc

Project Member

Comment 21 by ClusterFuzz, Jan 31 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6176052610334720 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Cc: vasilvv@chromium.org palmer@chromium.org
 Issue 880016  has been merged into this issue.

Sign in to add a comment