New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 795497 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in blink::ReportFatalErrorInMainThread

Project Member Reported by ClusterFuzz, Dec 16 2017

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6221921585987584

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x03e900000001
Crash State:
  blink::ReportFatalErrorInMainThread
  v8::Function::Call
  blink::V8ScriptRunner::CallFunction
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=524055:524057

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6221921585987584

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Dec 16 2017

Components: Blink>Bindings Blink>JavaScript
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Dec 16 2017

Labels: Test-Predator-Auto-Owner
Owner: adamk@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/v8/v8/+/e520f4e53439dc8b42918895e883f849bef1152a ([api] Add an ApiCheck for Function::Call on a null handle).

If this is incorrect, please remove the owner and apply the Test-Predator-Wrong-CLs label.

Comment 3 by adamk@chromium.org, Dec 18 2017

Cc: adamk@chromium.org
 Issue 795567  has been merged into this issue.

Comment 4 by adamk@chromium.org, Dec 18 2017

Cc: mlippautz@chromium.org
Components: -Blink>JavaScript Blink>JavaScript>GC Blink>MemoryAllocator>GarbageCollection
Mergedinto: 792604
Owner: yukishiino@chromium.org
Status: Duplicate (was: Assigned)
 This is another manifestation of issue 792604. Might be a useful source of test cases for a fix for that issue.
Project Member

Comment 5 by bugdroid1@chromium.org, Dec 21 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d93d12181ad5b34dc4abd2be26bdb49080e9541a

commit d93d12181ad5b34dc4abd2be26bdb49080e9541a
Author: Yuki Shiino <yukishiino@chromium.org>
Date: Thu Dec 21 13:51:45 2017

v8binding: Fixes use of wrapper-tracing at Database class.

No one is holding a Database returned by window.openDatabase, so
it doesn't make sense that Database performs wrapper-tracing to
Database::creation_callback_ as the Database itself may be gone.

Plus, the |creation_callback| needs to be invoked only once when
the database is first opened.  So, there is no need for a Database
to have a member of |creation_callbak_|.

This patch fixes the (mis)use of wrapper-tracing at Database class.

Bug: 792604,  795497 
Change-Id: Icdcc8790302f5e603a05752cc9e29c998a35b14f
Reviewed-on: https://chromium-review.googlesource.com/839024
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#525685}
[modify] https://crrev.com/d93d12181ad5b34dc4abd2be26bdb49080e9541a/third_party/WebKit/Source/modules/webdatabase/Database.cpp
[modify] https://crrev.com/d93d12181ad5b34dc4abd2be26bdb49080e9541a/third_party/WebKit/Source/modules/webdatabase/Database.h
[modify] https://crrev.com/d93d12181ad5b34dc4abd2be26bdb49080e9541a/third_party/WebKit/Source/modules/webdatabase/DatabaseManager.cpp

Project Member

Comment 6 by ClusterFuzz, Dec 22 2017

ClusterFuzz has detected this issue as fixed in range 525684:525685.

Detailed report: https://clusterfuzz.com/testcase?key=6221921585987584

Fuzzer: ochang_domfuzzer
Job Type: linux_asan_content_shell_drt
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x03e900000001
Crash State:
  blink::ReportFatalErrorInMainThread
  v8::Function::Call
  blink::V8ScriptRunner::CallFunction
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=524055:524057
Fixed: https://clusterfuzz.com/revisions?job=linux_asan_content_shell_drt&range=525684:525685

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6221921585987584

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by bugdroid1@chromium.org, Jan 5 2018

Labels: merge-merged-3282
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0b1a09c18cb7349a3d001b2ed2ec323e27e1699c

commit 0b1a09c18cb7349a3d001b2ed2ec323e27e1699c
Author: Yuki Shiino <yukishiino@chromium.org>
Date: Fri Jan 05 12:46:11 2018

v8binding: Fixes use of wrapper-tracing at Database class.

No one is holding a Database returned by window.openDatabase, so
it doesn't make sense that Database performs wrapper-tracing to
Database::creation_callback_ as the Database itself may be gone.

Plus, the |creation_callback| needs to be invoked only once when
the database is first opened.  So, there is no need for a Database
to have a member of |creation_callbak_|.

This patch fixes the (mis)use of wrapper-tracing at Database class.

TBR=yukishiino@chromium.org

(cherry picked from commit d93d12181ad5b34dc4abd2be26bdb49080e9541a)

Bug: 792604,  795497 
Change-Id: Icdcc8790302f5e603a05752cc9e29c998a35b14f
Reviewed-on: https://chromium-review.googlesource.com/839024
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#525685}
Reviewed-on: https://chromium-review.googlesource.com/851755
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/branch-heads/3282@{#417}
Cr-Branched-From: 5fdc0fab22ce7efd32532ee989b223fa12f8171e-refs/heads/master@{#520840}
[modify] https://crrev.com/0b1a09c18cb7349a3d001b2ed2ec323e27e1699c/third_party/WebKit/Source/modules/webdatabase/Database.cpp
[modify] https://crrev.com/0b1a09c18cb7349a3d001b2ed2ec323e27e1699c/third_party/WebKit/Source/modules/webdatabase/Database.h
[modify] https://crrev.com/0b1a09c18cb7349a3d001b2ed2ec323e27e1699c/third_party/WebKit/Source/modules/webdatabase/DatabaseManager.cpp

Sign in to add a comment