New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 760412 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug



Sign in to add a comment

CHECK failure: pool. Error: This caller requires a sequenced context (i.e. the current task nee

Project Member Reported by ClusterFuzz, Aug 30 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6620083282771968

Fuzzer: libFuzzer_webcrypto_rsa_import_key_spki_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  pool. Error: This caller requires a sequenced context (i.e. the current task nee
  base::SequencedTaskRunnerHandle::Get
  mojo::internal::GetTaskRunnerToUseFromUserProvidedTaskRunner
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=498121:498180

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6620083282771968

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, Aug 30 2017

Labels: OS-Mac
Cc: msrchandra@chromium.org
Labels: Test-Predator-Wrong-CLs M-62
Owner: gab@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "sequenced_task_runner_handle.cc" assigning to the concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/f22c9807f7c040510a7de490be613b6f803cc62b

@gab -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
Project Member

Comment 3 by ClusterFuzz, Sep 10 2017

Labels: ReleaseBlock-Stable ClusterFuzz-Top-Crash
Testcase 6620083282771968 is a top crash on ClusterFuzz for linux platform. Please prioritize fixing this crash.

Marking this crash as a stable release blocker. If this is incorrect, remove the ReleaseBlock label.

Comment 4 by gab@chromium.org, Sep 11 2017

Owner: eroman@chromium.org
The issue is that LLVMFuzzerTestOneInput() -> webcrypto::ImportRsaKeyFromDerFuzzData() eventually lands in mojo which requires SequencedTaskRunnerHandle::IsSet().

This can be fixed I think by adding a mere base::MessageLoop in LLVMFuzzerTestOneInput() and potentially calling RunLoop().Run() after the crypto call.

Comment 5 by gab@chromium.org, Sep 11 2017

Cc: gab@chromium.org
 Issue 760410  has been merged into this issue.

Comment 6 by eroman@chromium.org, Sep 12 2017

Components: Blink>WebCrypto
Status: Started (was: Assigned)
Project Member

Comment 8 by bugdroid1@chromium.org, Sep 12 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/9457c5ef45a382c72ae3d28374c2ce844979dcc6

commit 9457c5ef45a382c72ae3d28374c2ce844979dcc6
Author: Eric Roman <eroman@chromium.org>
Date: Tue Sep 12 21:53:16 2017

Fix a CHECK failure when running components/webcrypto fuzzer tests.

Bug:  760412 
Change-Id: I636562f761b0574369b40b64c0e9f180a1eed1e5
Reviewed-on: https://chromium-review.googlesource.com/663675
Reviewed-by: Ryan Sleevi <rsleevi@chromium.org>
Commit-Queue: Eric Roman <eroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501415}
[modify] https://crrev.com/9457c5ef45a382c72ae3d28374c2ce844979dcc6/components/webcrypto/fuzzer_support.cc

Comment 9 by eroman@chromium.org, Sep 12 2017

Status: Fixed (was: Started)
Labels: Merge-TBD
[Auto-generated comment by a script] We noticed that this issue is targeted for M-62; it appears the fix may have landed after branch point, meaning a merge might be required. Please confirm if a merge is required here - if so add Merge-Request-62 label, otherwise remove Merge-TBD label. Thanks.
Labels: -Pri-1 -Merge-TBD -ReleaseBlock-Stable -M-62 Pri-2
This crash was specific to the fuzz testing setup, and not something that adversely affects production code.
Project Member

Comment 12 by ClusterFuzz, Sep 13 2017

ClusterFuzz has detected this issue as fixed in range 501393:501473.

Detailed report: https://clusterfuzz.com/testcase?key=6620083282771968

Fuzzer: libFuzzer_webcrypto_rsa_import_key_spki_fuzzer
Job Type: libfuzzer_chrome_asan
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  pool. Error: This caller requires a sequenced context (i.e. the current task nee
  base::SequencedTaskRunnerHandle::Get
  mojo::internal::GetTaskRunnerToUseFromUserProvidedTaskRunner
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=498121:498180
Fixed: https://clusterfuzz.com/revisions?job=libfuzzer_chrome_asan&range=501393:501473

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6620083282771968

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 13 by ClusterFuzz, Sep 13 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 5925543584464896 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment