New issue
Advanced search Search tips

Issue 776813 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in blink::PerformanceEntry::PerformanceEntry

Project Member Reported by ClusterFuzz, Oct 20 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5351512934187008

Fuzzer: attekett_surku_fuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 8
Crash Address: 0x7ff053420090
Crash State:
  blink::PerformanceEntry::PerformanceEntry
  blink::PerformanceResourceTiming::PerformanceResourceTiming
  blink::PerformanceBase::AddResourceTiming
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=507774:507837

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5351512934187008

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Oct 20 2017

Components: Blink
Labels: Test-Predator-AutoComponents
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Oct 20 2017

Labels: Test-Predator-AutoOwner
Owner: maxlg@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/7fb55819ecaa95bde564db20cec8063d18c669c1 (Sort performance-entry-list by index in addition to starttime).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Comment 3 by maxlg@chromium.org, Oct 20 2017

It's likely caused by the race condition for the variable max_index when multiple threads are creating PerformanceEntries at the same time. I will fix it. Thanks!
Components: -Blink Blink>PerformanceAPIs
Project Member

Comment 5 by bugdroid1@chromium.org, Oct 27 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e3b99c66b90b9dbc5370c6a41469b84912196b7d

commit e3b99c66b90b9dbc5370c6a41469b84912196b7d
Author: Liquan (Max) Gu <maxlg@chromium.org>
Date: Fri Oct 27 21:08:03 2017

[PerformanceEntry] Resolve race condition in indexing

ClusterFuzz has detected a data race in blink::PerformanceEntry::PerformanceEntry(crbug/776813).

By observation, the original design has race condition when multiple threads create PerformanceEntry at the same time, with max_index being a shared variable.

The new impl use atomic int which applies an atomic lock to the shared variable, to avoid the race condition.

Bug:  776813 
Change-Id: Ibd251a020ddbb6c9e4496b0e5d197ed19b40658f
Reviewed-on: https://chromium-review.googlesource.com/730773
Commit-Queue: Liquan Gu <maxlg@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: Timothy Dresser <tdresser@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#512281}
[modify] https://crrev.com/e3b99c66b90b9dbc5370c6a41469b84912196b7d/third_party/WebKit/Source/core/DEPS
[modify] https://crrev.com/e3b99c66b90b9dbc5370c6a41469b84912196b7d/third_party/WebKit/Source/core/timing/PerformanceEntry.cpp
[modify] https://crrev.com/e3b99c66b90b9dbc5370c6a41469b84912196b7d/third_party/WebKit/Source/core/timing/PerformanceEntry.h

Project Member

Comment 6 by ClusterFuzz, Oct 28 2017

ClusterFuzz has detected this issue as fixed in range 512266:512297.

Detailed report: https://clusterfuzz.com/testcase?key=5351512934187008

Fuzzer: attekett_surku_fuzzer
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 8
Crash Address: 0x7ff053420090
Crash State:
  blink::PerformanceEntry::PerformanceEntry
  blink::PerformanceResourceTiming::PerformanceResourceTiming
  blink::PerformanceBase::AddResourceTiming
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=507774:507837
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=512266:512297

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5351512934187008

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Oct 28 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5351512934187008 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: -Test-Predator-AutoComponents Test-Predator-Auto-Components
Labels: -Test-Predator-AutoOwner Test-Predator-Auto-Owner

Sign in to add a comment