New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 763687 link

Starred by 2 users
Status: Fixed
Owner:
mlippautz@chromium.org
Closed: Sep 2017
Cc:
keishi@chromium.org
█ msrchandra@chromium.org
haraken@chromium.org
lfg@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::ScriptWrappableVisitor::ScheduleIdleLazyCleanup

Project Member Reported by ClusterFuzz, Sep 10 2017 
Detailed report: https://clusterfuzz.com/testcase?key=6442702811168768

Fuzzer: afl_v8_serialized_script_value_fuzzer
Job Type: afl_chrome_asan
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  blink::ScriptWrappableVisitor::ScheduleIdleLazyCleanup
  blink::ScriptWrappableVisitor::TraceEpilogue
  v8::internal::MarkCompactCollector::MarkLiveObjects
  
Sanitizer: address (ASAN)

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6442702811168768

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.

Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.

Comment 1 by msrchandra@chromium.org, Sep 11 2017

Cc: msrchandra@chromium.org
Components: Blink
Labels: Test-Predator-Wrong-CLs
Owner: mlippautz@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "ScriptWrappableVisitor.cpp" assigning to concern owner.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/8ea9a89ffe46d09df143b1f2a45ca20c6da90697

@mlippautz -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.

Comment 2 by chrishtr@chromium.org, Sep 11 2017

Components: -Blink Blink>JavaScript>GC
Owner: ----
Status: Untriaged (was: Assigned)

Comment 3 by mlippautz@chromium.org, Sep 15 2017

Cc: keishi@chromium.org haraken@chromium.org
Labels: -Pri-1 Pri-2
Owner: mlippautz@chromium.org
Status: Assigned (was: Untriaged)
The crash is at 
 https://chromium.googlesource.com/chromium/src/+/975794ee43d7036fb94be988a9f6751db85c7a3a/third_party/WebKit/Source/platform/bindings/ScriptWrappableVisitor.cpp#100

The code in question hasn't changed for over half a year.

I guess we either don't have |CurrentThread()| or |Scheduler()|. Will investigate next week.

Comment 4 by mlippautz@chromium.org, Sep 15 2017

Components: -Blink>JavaScript>GC Blink>Bindings

Comment 5 by mlippautz@chromium.org, Sep 28 2017 

I am unable to reproduce this issue and would suggest a WontFix here.

haraken/keishi: Do you know at the top of your head whether there is a way to have CurrentThread() to return nullptr? It is probably null in some use case but I cannot find it.

Comment 6 by haraken@chromium.org, Sep 28 2017 

Is it possible that the garbage collection is triggered after the thread is shut down?
Project Member

Comment 7 by bugdroid1@chromium.org, Sep 29 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/ac81591259746749c24a6fa8eff709e319d8eee6

commit ac81591259746749c24a6fa8eff709e319d8eee6
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Fri Sep 29 06:53:38 2017

[wrapper-tracing] Don't try to schedule cleanup without a thread

Bug:  chromium:763687 
Change-Id: I06180bbdf66d837a6bafe800ce674cb8aaaf0ee9
Reviewed-on: https://chromium-review.googlesource.com/690155
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#505314}
[modify] https://crrev.com/ac81591259746749c24a6fa8eff709e319d8eee6/third_party/WebKit/Source/platform/bindings/ScriptWrappableVisitor.cpp

Comment 8 by mlippautz@chromium.org, Sep 29 2017

Status: Fixed (was: Assigned)
That's a speculative fix since I was unable to reproduce the actual issue. Let's see what CF has to say about it.
►

Sign in to add a comment