New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 763847 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in blink::UseCounter::Count

Project Member Reported by ClusterFuzz, Sep 11 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4863443873300480

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x0000000001f8
Crash State:
  blink::UseCounter::Count
  blink::MIDIPort::OpenAsynchronously
  base::debug::TaskAnnotator::RunTask
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=499930:499947

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4863443873300480

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: msrchandra@chromium.org
Components: Blink>MemoryAllocator
Labels: Test-Predator-Wrong-CLs M-63
Owner: toyoshim@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using Code Search for the file, "MIDIPort.cpp" assigning to the concern owner from GIT Blame.

Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/89f5f6f7ec8a3cf47ce58b9b9cc0f7dbdbfe9186

@toyoshim -- Could you please look into the issue, kindly re-assign if this is not related to your changes.
Thank You.
msrchandra@ is there any instruction to reproduce this on local machine to confirm my local fix?
Recent issues reported by fuzz have easy steps to reproduce it on local linux, but I guess we don't have such simple way for mac failure?
Status: Started (was: Assigned)
Solved by myself.
Just running downloaded tests with content_shell on Linux just works.

$./out/Release/content_shell --run-layout-test --dump-render-tree <downloaded test files dir>/webmidi/fuzz-94.html
#READY
DevTools listening on ws://127.0.0.1:36142/devtools/browser/f5b9bb9e-4300-4efa-8e37-5684ca51fef9
[1221:1221:0925/175651.378051:1631125926271:ERROR:gpu_info.cc(103)] No active GPU found, returning primary GPU.
CONSOLE ERROR: line 146: Uncaught TypeError: Cannot set property 'contentEditable' of null
Content-Type: text/plain
Tests MIDIPort implicit open.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".


PASS PermissionsHelper.setPermission is defined.
FAIL Unexpected error: Uncaught TypeError: Cannot set property 'contentEditable' of null
FAIL successfullyParsed should be true. Was false.

TEST COMPLETE
YUm}9OLizywP    Z0      S=llj.-?N!5*dz  |9 m{c[ ?^      jW Gu3g4j1Z*,U^u        Iz`UIr  Q!      D[5u@wY    ?yb|# z^/]{vjI EkUa9 ^% B yyk,; U[^1wV| 4       i1      ?R=OV   W       jaM@    YA      X&{8       P       !       %+7ZMQgm]:0/ry  |D      ?}Dsw0l&s1!Ze   1V|r41I tc      HJRRL]L +eNp!8,:L.Ur       `       pV5#d   )BA
#EOF
#EOF
Received signal 11 SEGV_MAPERR 0000000002b0
#0 0x7fa48d291c17 #EOF
base::debug::StackTrace::StackTrace()
#1 0x7fa48d2916ef base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fa48f396330 <unknown>
#3 0x7fa4893f0f05 blink::UseCounter::Count()
#4 0x7fa487ae5824 blink::MIDIPort::OpenAsynchronously()
#5 0x7fa48d292467 base::debug::TaskAnnotator::RunTask()
#6 0x7fa488230313 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#7 0x7fa48822ded4 blink::scheduler::TaskQueueManager::DoWork()
#8 0x7fa488232065 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#9 0x7fa48d292467 base::debug::TaskAnnotator::RunTask()
#10 0x7fa48d2c2f80 base::internal::IncomingTaskQueue::RunTask()
#11 0x7fa48d2c5417 base::MessageLoop::RunTask()
#12 0x7fa48d2c5b7a base::MessageLoop::DoWork()
#13 0x7fa48d2c7520 base::MessagePumpDefault::Run()
#14 0x7fa48d2c4eba base::MessageLoop::Run()
#15 0x7fa48d2f9496 base::RunLoop::Run()
#16 0x7fa48e6934c3 %                                                                               L
Project Member

Comment 4 by ClusterFuzz, Sep 25 2017

Labels: OS-Linux
Project Member

Comment 5 by bugdroid1@chromium.org, Sep 25 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1f06134ca7f7934b7729c779ced9b268192bcb05

commit 1f06134ca7f7934b7729c779ced9b268192bcb05
Author: Takashi Toyoshima <toyoshim@chromium.org>
Date: Mon Sep 25 14:34:47 2017

MIDIPort should do nothing after the execution context is lost

Current MIDIPort runs asynchronous processes in posted tasks,
but the task may run after the execution context is lost.

This patch adds the context check to return immediately without
doing anything.

Bug:  763847 
Change-Id: Ia731132064c9438bed7285e136ba989b8371139e
Reviewed-on: https://chromium-review.googlesource.com/681154
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Taiju Tsuiki <tzik@chromium.org>
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#504048}
[modify] https://crrev.com/1f06134ca7f7934b7729c779ced9b268192bcb05/third_party/WebKit/Source/modules/webmidi/MIDIPort.cpp

Status: Fixed (was: Started)
Project Member

Comment 7 by ClusterFuzz, Sep 26 2017

ClusterFuzz has detected this issue as fixed in range 503967:504091.

Detailed report: https://clusterfuzz.com/testcase?key=4863443873300480

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x0000000001f8
Crash State:
  blink::UseCounter::Count
  blink::MIDIPort::OpenAsynchronously
  base::debug::TaskAnnotator::RunTask
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=499930:499947
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=503967:504091

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4863443873300480

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Sep 26 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 4863443873300480 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment