Null-dereference READ in blink::UseCounter::Count |
|||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4863443873300480 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x0000000001f8 Crash State: blink::UseCounter::Count blink::MIDIPort::OpenAsynchronously base::debug::TaskAnnotator::RunTask Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=499930:499947 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4863443873300480 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Sep 25 2017
msrchandra@ is there any instruction to reproduce this on local machine to confirm my local fix? Recent issues reported by fuzz have easy steps to reproduce it on local linux, but I guess we don't have such simple way for mac failure?
,
Sep 25 2017
Solved by myself.
Just running downloaded tests with content_shell on Linux just works.
$./out/Release/content_shell --run-layout-test --dump-render-tree <downloaded test files dir>/webmidi/fuzz-94.html
#READY
DevTools listening on ws://127.0.0.1:36142/devtools/browser/f5b9bb9e-4300-4efa-8e37-5684ca51fef9
[1221:1221:0925/175651.378051:1631125926271:ERROR:gpu_info.cc(103)] No active GPU found, returning primary GPU.
CONSOLE ERROR: line 146: Uncaught TypeError: Cannot set property 'contentEditable' of null
Content-Type: text/plain
Tests MIDIPort implicit open.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
PASS PermissionsHelper.setPermission is defined.
FAIL Unexpected error: Uncaught TypeError: Cannot set property 'contentEditable' of null
FAIL successfullyParsed should be true. Was false.
TEST COMPLETE
YUm}9OLizywP Z0 S=llj.-?N!5*dz |9 m{c[ ?^ jW Gu3g4j1Z*,U^u Iz`UIr Q! D[5u@wY ?yb|# z^/]{vjI EkUa9 ^% B yyk,; U[^1wV| 4 i1 ?R=OV W jaM@ YA X&{8 P ! %+7ZMQgm]:0/ry |D ?}Dsw0l&s1!Ze 1V|r41I tc HJRRL]L +eNp!8,:L.Ur ` pV5#d )BA
#EOF
#EOF
Received signal 11 SEGV_MAPERR 0000000002b0
#0 0x7fa48d291c17 #EOF
base::debug::StackTrace::StackTrace()
#1 0x7fa48d2916ef base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fa48f396330 <unknown>
#3 0x7fa4893f0f05 blink::UseCounter::Count()
#4 0x7fa487ae5824 blink::MIDIPort::OpenAsynchronously()
#5 0x7fa48d292467 base::debug::TaskAnnotator::RunTask()
#6 0x7fa488230313 blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue()
#7 0x7fa48822ded4 blink::scheduler::TaskQueueManager::DoWork()
#8 0x7fa488232065 _ZN4base8internal7InvokerINS0_9BindStateIMN5blink9scheduler16TaskQueueManagerEFvbEJNS_7WeakPtrIS5_EEbEEEFvvEE3RunEPNS0_13BindStateBaseE
#9 0x7fa48d292467 base::debug::TaskAnnotator::RunTask()
#10 0x7fa48d2c2f80 base::internal::IncomingTaskQueue::RunTask()
#11 0x7fa48d2c5417 base::MessageLoop::RunTask()
#12 0x7fa48d2c5b7a base::MessageLoop::DoWork()
#13 0x7fa48d2c7520 base::MessagePumpDefault::Run()
#14 0x7fa48d2c4eba base::MessageLoop::Run()
#15 0x7fa48d2f9496 base::RunLoop::Run()
#16 0x7fa48e6934c3 % L
,
Sep 25 2017
,
Sep 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/1f06134ca7f7934b7729c779ced9b268192bcb05 commit 1f06134ca7f7934b7729c779ced9b268192bcb05 Author: Takashi Toyoshima <toyoshim@chromium.org> Date: Mon Sep 25 14:34:47 2017 MIDIPort should do nothing after the execution context is lost Current MIDIPort runs asynchronous processes in posted tasks, but the task may run after the execution context is lost. This patch adds the context check to return immediately without doing anything. Bug: 763847 Change-Id: Ia731132064c9438bed7285e136ba989b8371139e Reviewed-on: https://chromium-review.googlesource.com/681154 Reviewed-by: Kentaro Hara <haraken@chromium.org> Reviewed-by: Taiju Tsuiki <tzik@chromium.org> Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org> Cr-Commit-Position: refs/heads/master@{#504048} [modify] https://crrev.com/1f06134ca7f7934b7729c779ced9b268192bcb05/third_party/WebKit/Source/modules/webmidi/MIDIPort.cpp
,
Sep 26 2017
,
Sep 26 2017
ClusterFuzz has detected this issue as fixed in range 503967:504091. Detailed report: https://clusterfuzz.com/testcase?key=4863443873300480 Fuzzer: inferno_twister Job Type: mac_asan_content_shell Platform Id: mac Crash Type: Null-dereference READ Crash Address: 0x0000000001f8 Crash State: blink::UseCounter::Count blink::MIDIPort::OpenAsynchronously base::debug::TaskAnnotator::RunTask Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=499930:499947 Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=503967:504091 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4863443873300480 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 26 2017
ClusterFuzz testcase 4863443873300480 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by msrchandra@chromium.org
, Sep 11 2017Components: Blink>MemoryAllocator
Labels: Test-Predator-Wrong-CLs M-63
Owner: toyoshim@chromium.org
Status: Assigned (was: Untriaged)