New issue
Advanced search Search tips

Issue 791312 link

Starred by 2 users

Issue metadata

Status: Verified
Owner: ----
Closed: Nov 14
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in IPC::ChannelProxy::SendInternal

Project Member Reported by ClusterFuzz, Dec 2 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6709451292934144

Fuzzer: ochang_domfuzzer
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x03e900000001
Crash State:
  IPC::ChannelProxy::SendInternal
  IPC::SyncChannel::Send
  content::ChildThreadImpl::Send
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=518240:518474

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6709451292934144

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 2 2017

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Dec 2 2017

Cc: gab@chromium.org ccameron@chromium.org
Labels: Test-Predator-Auto-CC
Automatically adding ccs based on suspected regression changelists:

Remove YUVVideoDrawQuad::ColorSpace by ccameron@chromium.org - https://chromium.googlesource.com/chromium/src/+/2d06761bccd6a06fd114298646cec6360b5b1995

Fix IWYU for MessageLoop and RunLoop once again. by gab@chromium.org - https://chromium.googlesource.com/chromium/src/+/b164afef8071ce4b2bac006c24803fcb781a3c51

If this is incorrect, please apply the Test-Predator-Wrong-CLs label.
Cc: fdoray@chromium.org pnangunoori@chromium.org
Labels: M-65 Test-Predator-Wrong-CLs
CC'ing fdoray@ (reviewer of CL https://chromium.googlesource.com/chromium/src/+/b164afef8071ce4b2bac006c24803fcb781a3c51) as gab@ seems to be OOO.

fdoray@/ ccameron@ -- Could you please look into this issue.

Thanks in advance.
fdoray@/ ccameron@ Could you please update your observations on this issue.

Comment 5 by fdoray@chromium.org, Dec 12 2017

Cc: -gab@chromium.org -fdoray@chromium.org
https://chromium-review.googlesource.com/c/chromium/src/+/782663 adds missing includes. It is unlikely that it caused this regression.

Comment 6 by fdoray@chromium.org, Dec 12 2017

This is failing because of this CHECK:

  // See https://crbug.com/766032. This is to ensure that senders of oversized
  // messages can be caught more easily in the wild.
  CHECK_LE(message->size(), Channel::kMaximumMessageSize);
https://chromium.googlesource.com/chromium/src/+/511011cc85f63904966a1779f3391f29397f9382/ipc/ipc_channel_proxy.cc#540
Project Member

Comment 7 by ClusterFuzz, Mar 23 2018

Labels: OS-Windows OS-Mac
Project Member

Comment 8 by ClusterFuzz, Apr 20 2018

Labels: OS-Android
Cc: kkaluri@chromium.org
Labels: CF-NeedsTriage
Unable to provide possible suspect using Predator, CL and Code Search.
Could someone please look into the issue.

Thank You...
Project Member

Comment 10 by ClusterFuzz, Nov 14

ClusterFuzz has detected this issue as fixed in range 607766:607794.

Detailed report: https://clusterfuzz.com/testcase?key=6709451292934144

Fuzzer: ochang_domfuzzer
Job Type: linux_msan_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  message->size() <= Channel::kMaximumMessageSize in ipc_channel_proxy.cc
  IPC::ChannelProxy::SendInternal
  IPC::SyncChannel::Send
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=518240:518474
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_content_shell_drt&range=607766:607794

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6709451292934144

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Nov 14

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 6709451292934144 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment