New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 774479 link

Starred by 2 users

Issue metadata

Status: Verified
Owner: ----
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 3
Type: Bug



Sign in to add a comment

Null-dereference READ in test_runner::MockWebSpeechRecognizer::PostRunTaskFromQueue

Project Member Reported by ClusterFuzz, Oct 13 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5295758449573888

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  test_runner::MockWebSpeechRecognizer::PostRunTaskFromQueue
  base::debug::TaskAnnotator::RunTask
  blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=454873:455044

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5295758449573888

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 13 2017

Components: Internals>Core
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: msrchandra@chromium.org pnangunoori@chromium.org
Labels: M-62 Test-Predator-Wrong-CLs
Owner: npm@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.
Using the code search for the file, “task_queue_manager.cc” assigning to concern owner from GIT blame.
Suspecting Commit#
https://chromium.googlesource.com/chromium/src/+/b727bada8f2a3225e9e99cb72bbb6141f468c2af
@npm  -- Could you please look into this issue, kindly reassign if it has nothing to do with your changes.
Thank You.

Comment 3 by npm@chromium.org, Oct 17 2017

Cc: npm@chromium.org
Owner: tzik@chromium.org
Sadly my content_shell is not compiling due to https://github.com/google/sanitizers/issues/856

But in any case looking at testcases from the same Group it seems that there is a problem in TaskAnnotator::RunTask (maybe pending_task->task can be null). Assigning to tzik@ who last touched that line. If you're not the right owner, please assign to the owner of that file.

Comment 4 by tzik@chromium.org, Oct 18 2017

Components: -Internals>Core Blink>Speech
Labels: QA-Triage-Wrong
Owner: ----
Status: Untriaged (was: Assigned)
That's likely due to null |delegate_| of MockWebSpeechRecognizer.
Labels: CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
Could someone please look into the issue.

Thank You.
Cc: sigbjo...@opera.com tkent@chromium.org
Components: -Blink>Speech Blink>Scheduling
Labels: -QA-Triage-Wrong -CF-NeedsTriage
Status: Available (was: Untriaged)
sigbjornf@, can you please take a look? since you worked on this kind of code recently?

Thanks in-advance!

Comment 7 by tkent@chromium.org, Oct 25 2017

Cc: -tkent@chromium.org -sigbjo...@opera.com
Components: -Blink>Scheduling Blink>Speech

Comment 8 by tkent@chromium.org, Oct 25 2017

Labels: -Pri-1 Pri-3
Status: Untriaged (was: Available)
Pri-3 because it's in test-only code.

Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Project Member

Comment 10 by ClusterFuzz, Nov 7 2017

Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 11 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 12 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 13 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 14 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 15 by ClusterFuzz, Nov 8 2017

Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)
If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Project Member

Comment 16 by ClusterFuzz, Nov 8 2017

Cc: smcgruer@chromium.org
Automatically adding ccs based on suspected regression changelists:

https://chromium.googlesource.com/chromium/src/+/255d25e6d389106b75c90110b4e00b022e472cc5 (Support reftest-wait in web-platform-tests by smcgruer@chromium.org)

https://chromium.googlesource.com/chromium/src/+/a9c462ea8bf9588c2a6859e7fe9fde1e4c7f7353 (TestInterfaces: support delegate clearing. by sigbjornf@opera.com)


If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Please ignore the Test-Predator-Auto-CC comment spam above, there was a bug in our script that caused it to create same comment multiple times and also didn't add ccs properly. 
Project Member

Comment 18 by ClusterFuzz, Nov 21 2017

ClusterFuzz has detected this issue as fixed in range 517889:517931.

Detailed report: https://clusterfuzz.com/testcase?key=5295758449573888

Fuzzer: inferno_twister
Job Type: mac_asan_content_shell
Platform Id: mac

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  test_runner::MockWebSpeechRecognizer::PostRunTaskFromQueue
  base::debug::TaskAnnotator::RunTask
  blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=454873:455044
Fixed: https://clusterfuzz.com/revisions?job=mac_asan_content_shell&range=517889:517931

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5295758449573888

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 19 by ClusterFuzz, Nov 21 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 5295758449573888 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment