New issue
Advanced search Search tips

Issue 763848 link

Starred by 1 user
Status: Fixed
Owner:
cmumford@chromium.org
Closed: Sep 2017
Cc:
pwnall@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Chrome_Android: Crash Report - crc32c::ExtendArm64

Project Member Reported by cr...@system.gserviceaccount.com, Sep 11 2017 
reporter:brajkumar@google.com

crash_analysis_section:start
crash_analysis_section:end

Magic Signature: crc32c::ExtendArm64

Crash link: https://crash.corp.google.com/browse?q=product.name%3D'Chrome_Android'%20AND%20product.version%3D'62.0.3202.12'%20AND%20custom_data.ChromeCrashProto.channel%3D'dev'%20AND%20custom_data.ChromeCrashProto.ptype%3D'browser'%20AND%20ReportID%3D'0146c064ebe33ca1'%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D'crc32c%3A%3AExtendArm64'&sql_dialect=dremelsql&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D&unnest=#3

-------------------------------------------------------------------------------
Sample Report
-------------------------------------------------------------------------------
Product name: Chrome_Android
Magic Signature : crc32c::ExtendArm64
Product Version: 62.0.3202.12
Process type: browser
Report ID: 0146c064ebe33ca1
Report Url: https://crash.corp.google.com/0146c064ebe33ca1
Report Time: 2017-09-08T05:39:31-07:00
Upload Time: 2017-09-08T05:41:31.499-07:00
Uptime: 25424 ms
CumulativeProductUptime: 0 ms
OS Name: Android
OS Version: 0.0.0 Linux 3.10.49-perf-gcb6a1aa #1 SMP PREEMPT Thu Feb 2 15:41:31 CST 2017 aarch64
CPU Architecture: arm64
CPU Info: 

-------------------------------------------------------------------------------
Crashing thread: Thread index: 26. Stack Quality: 94%. Thread id: 2671.
-------------------------------------------------------------------------------
0x0000007f683bab14 (libchrome.so - crc32c_arm64.cc: 87)	crc32c::ExtendArm64(unsigned int, unsigned char const*, unsigned long)
0x0000007f69805724 (libchrome.so - log_writer.cc: 95)	leveldb::log::Writer::EmitPhysicalRecord(leveldb::log::RecordType, char const*, unsigned long)
0x0000007f69805680 (libchrome.so - log_writer.cc: 76)	leveldb::log::Writer::AddRecord(leveldb::Slice const&)
0x0000007f69802070 (libchrome.so - db_impl.cc: 1224)	leveldb::DBImpl::Write(leveldb::WriteOptions const&, leveldb::WriteBatch*)
0x0000007f697f9f78 (libchrome.so - leveldb_database.cc: 109)	leveldb_proto::LevelDB::Save(std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > >, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > const&, std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > const&)
0x0000007f69c158ac (libchrome.so - proto_database_impl.h: 151)	void leveldb_proto::(anonymous namespace)::UpdateEntriesFromTaskRunner<ntp_snippets::SnippetProto>(leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<leveldb_proto::ProtoDatabase<ntp_snippets::SnippetProto>::KeyEntryVector, std::__ndk1::default_delete<leveldb_proto::ProtoDatabase<ntp_snippets::SnippetProto>::KeyEntryVector> >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool*)
0x0000007f69c15ad8 (libchrome.so - bind_internal.h: 149)	void base::internal::FunctorTraits<void (*)(leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool*), void>::Invoke<leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool* const&>(void (*)(leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool*), leveldb_proto::LevelDB*&&, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >&&, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >&&, bool* const&&&)
0x0000007f69c15a34 (libchrome.so - bind_internal.h: 349)	void base::internal::Invoker<base::internal::BindState<void (*)(leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool*), base::internal::UnretainedWrapper<leveldb_proto::LevelDB>, base::internal::PassedWrapper<std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > > >, base::internal::PassedWrapper<std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > > >, bool*>, void ()>::RunImpl<void (* const&)(leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool*), std::__ndk1::tuple<base::internal::UnretainedWrapper<leveldb_proto::LevelDB>, base::internal::PassedWrapper<std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > > >, base::internal::PassedWrapper<std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > > >, bool*> const&, 0ul, 1ul, 2ul, 3ul>(void (* const&&&)(leveldb_proto::LevelDB*, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > >, std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > >, bool*), std::__ndk1::tuple<base::internal::UnretainedWrapper<leveldb_proto::LevelDB>, base::internal::PassedWrapper<std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto>, std::__ndk1::allocator<std::__ndk1::pair<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, ntp_snippets::SnippetProto> > > > > >, base::internal::PassedWrapper<std::__ndk1::unique_ptr<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > >, std::__ndk1::default_delete<std::__ndk1::vector<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> >, std::__ndk1::allocator<std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > > > > > >, bool*> const&&&, std::__ndk1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>)
0x0000007f6773bbf4 (libchrome.so - callback.h: 64)	base::(anonymous namespace)::PostTaskAndReplyRelay::RunTaskAndPostReply()
0x0000007f676d46c4 (libchrome.so - callback.h: 64)	base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*)
0x0000007f6772fda0 (libchrome.so - task_tracker.cc: 335)	base::internal::TaskTracker::PerformRunTask(std::__ndk1::unique_ptr<base::internal::Task, std::__ndk1::default_delete<base::internal::Task> >, base::internal::Sequence*)
0x0000007f67730270 (libchrome.so - task_tracker_posix.cc: 22)	base::internal::TaskTrackerPosix::PerformRunTask(std::__ndk1::unique_ptr<base::internal::Task, std::__ndk1::default_delete<base::internal::Task> >, base::internal::Sequence*)
0x0000007f6772fa30 (libchrome.so - task_tracker.cc: 251)	base::internal::TaskTracker::RunNextTask(base::internal::Sequence*)
0x0000007f6772b1bc (libchrome.so - scheduler_worker.cc: 73)	base::internal::SchedulerWorker::Thread::ThreadMain()
0x0000007f6773ba38 (libchrome.so - platform_thread_posix.cc: 75)	base::(anonymous namespace)::ThreadFunc(void*)
0x0000007f9857a714 (libc.so + 0x00068714)

Comment 1 by brajkumar@chromium.org, Sep 11 2017

Components: Blink>Storage>IndexedDB
Labels: -Type-Bug -Pri-2 TE-CrashTriage M-62 Pri-1 Type-Bug-Regression
Owner: cmumford@chromium.org
Status: Assigned (was: Untriaged)
This issue is seen from M62 -62.0.3202.3, Below link gives in details of the number of instances in which the crash has occurred for associated builds:
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Android%27%20%20AND%20custom_data.ChromeCrashProto.ptype%3D%27browser%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27crc32c%3A%3AExtendArm64%27&sql_dialect=dremelsql&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D&unnest=

Note:
=====
1) This is a browser crash listed under dev build  62.0.3202.12 for android on 23 different client ID's.
2) Currently this crash is ranked as number #5 with 76 instances
3) This crash is observed only on android platform 
4) Most of the crashes are observed on Android Marshmallow with below numbers

Android Marshmallow	96.89%	156	
Android Lollipop	3.11%	5	

Used code search for the file "crc32c_arm64.cc" from above stack trace and suspecting the below change.

Suspect CL :
https://chromium.googlesource.com/external/github.com/google/crc32c.git/+/ecf28dd3352692c4160b56cba26082d5c396df1c%5E%21/src/crc32c_arm64.cc

@cmumford - Could you please take a look into this if its related to your change, if not please help in assigning it to the right owner.

Thanks!

Comment 2 by cmumford@chromium.org, Sep 11 2017

Cc: pwnall@chromium.org

Comment 3 by cmumford@chromium.org, Sep 11 2017 

All CPU's seen so far are Qualcomm Snapdragons. I've disabled ARM hw acceleration and have a pull request at https://github.com/google/crc32c/pull/5. Once the try-bots give a green light I'll merge the request and roll DEPS.
Project Member

Comment 4 by bugdroid1@chromium.org, Sep 11 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/db1e683af5e7dce69db4abf6abe7cd06c8a26991

commit db1e683af5e7dce69db4abf6abe7cd06c8a26991
Author: Chris Mumford <cmumford@chromium.org>
Date: Mon Sep 11 22:30:07 2017

Disable CRC32C H/W acceleration on ARM.

Crashing with SIGILL on Snapdragon processors.

Bug:  763848 
Change-Id: I27b52d0c062fb8b0bc94389beeee764279047bbc
Reviewed-on: https://chromium-review.googlesource.com/660993
Commit-Queue: Chris Mumford <cmumford@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501064}
[modify] https://crrev.com/db1e683af5e7dce69db4abf6abe7cd06c8a26991/third_party/crc32c/BUILD.gn

Comment 5 by cmumford@chromium.org, Sep 11 2017

Labels: Merge-Request-62
Fix is in. There may not be sufficient time for this to land in Canary before M62 is promoted to beta so requesting merge to M62 now.

Comment 6 by pwnall@chromium.org, Sep 12 2017 

Thanks to cmumford@'s analysis, our current hypothesis is that the crash occurs due to running vmull_p64 on ARM64 processors that don't have the pmull capability. As we do check for the crc32c capability, this means the crash will occur on 64-bit devices that have crc32c and don't have pmull.

I put together https://github.com/google/crc32c/pull/6, which adds the check we think is missing. We'll wait for the ARM engineer who contributed the accelerated implementation to weigh in on the patch: https://github.com/google/leveldb/pull/490#issuecomment-328670006

Assuming our hypothesis is correct, we'll tag the fix at https://github.com/google/crc32c/pull/6 as 1.0.3 and roll crc32c to get it in Chrome. I think it makes most sense to keep ARM64 acceleration disabled in M62, and let the fixed version bake in M63.

Comment 7 by cmumford@chromium.org, Sep 12 2017 

The fix (db1e683af5e7dce6) initially in 63.0.3213.0. So far no crashes:

+--------------+-------+
| Version      | Count |
+--------------+-------+
| 62.0.3202.12 |   176 |
| 62.0.3202.3  |     8 |
| 63.0.3204.0  |     1 |
| 63.0.3206.0  |     5 |
| 63.0.3207.0  |     1 |
| 63.0.3208.0  |     2 |
| 63.0.3209.0  |    10 |
| 63.0.3210.0  |    38 |
| 63.0.3212.0  |     3 |
+--------------+-------+
Project Member

Comment 8 by sheriffbot@chromium.org, Sep 12 2017

Labels: -Merge-Request-62 Hotlist-Merge-Approved Merge-Approved-62
Your change meets the bar and is auto-approved for M62. Please go ahead and merge the CL to branch 3202 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 9 by bugdroid1@chromium.org, Sep 13 2017 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/26327d27d809b1b5c2e3d762cf98e69afba3e815

commit 26327d27d809b1b5c2e3d762cf98e69afba3e815
Author: Victor Costan <pwnall@chromium.org>
Date: Wed Sep 13 00:38:26 2017

Bump third_party/crc32c to 1.0.3.

Bug:  763650 ,  763848 
Change-Id: Ideb5ab7ed300718458fe2665bf8af099bc56d272
Reviewed-on: https://chromium-review.googlesource.com/658838
Reviewed-by: Chris Mumford <cmumford@chromium.org>
Commit-Queue: Victor Costan <pwnall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#501485}
[modify] https://crrev.com/26327d27d809b1b5c2e3d762cf98e69afba3e815/DEPS
[modify] https://crrev.com/26327d27d809b1b5c2e3d762cf98e69afba3e815/third_party/crc32c/BUILD.gn
[modify] https://crrev.com/26327d27d809b1b5c2e3d762cf98e69afba3e815/third_party/crc32c/README.chromium
Project Member

Comment 10 by bugdroid1@chromium.org, Sep 13 2017

Labels: -merge-approved-62 merge-merged-3202
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6a917e83b09b25890f1ea30496073c036bc31d4e

commit 6a917e83b09b25890f1ea30496073c036bc31d4e
Author: Chris Mumford <cmumford@chromium.org>
Date: Wed Sep 13 13:44:35 2017

Disable CRC32C H/W acceleration on ARM.

Crashing with SIGILL on Snapdragon processors.

TBR=cmumford@chromium.org

(cherry picked from commit db1e683af5e7dce69db4abf6abe7cd06c8a26991)

Bug:  763848 
Change-Id: I27b52d0c062fb8b0bc94389beeee764279047bbc
Reviewed-on: https://chromium-review.googlesource.com/660993
Commit-Queue: Chris Mumford <cmumford@chromium.org>
Reviewed-by: Victor Costan <pwnall@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#501064}
Reviewed-on: https://chromium-review.googlesource.com/664361
Reviewed-by: Chris Mumford <cmumford@chromium.org>
Cr-Commit-Position: refs/branch-heads/3202@{#197}
Cr-Branched-From: fa6a5d87adff761bc16afc5498c3f5944c1daa68-refs/heads/master@{#499098}
[modify] https://crrev.com/6a917e83b09b25890f1ea30496073c036bc31d4e/third_party/crc32c/BUILD.gn

Comment 11 by pwnall@chromium.org, Sep 13 2017

Labels: -Restrict-View-EditIssue
Removing R-V-E, as the stack trace does not have any confidential information, and the there is no security vulnerability involved in the crash.

Comment 12 by aluo@chromium.org, Sep 13 2017

Labels: ReleaseBlock-Beta
This is affecting asus Z and X phones, marking as RBB

Comment 13 by pwnall@chromium.org, Sep 13 2017

Status: Fixed (was: Assigned)
The CL in comment 10 disabled the ARM64 implementation in M62, and the CL in comment 9 landed a fix for canary / dev / M63. The new crc32c library hasn't shipped before M62, so I think we're done here.
►

Sign in to add a comment