New issue
Advanced search Search tips

Issue 805024 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows
Pri: 1
Type: Bug

Blocking:
issue 771643



Sign in to add a comment

CHECK failure: false. Can't find cached display item: "LayoutDetailsMarker DIV id='details-mark

Project Member Reported by ClusterFuzz, Jan 23 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5653323146592256

Fuzzer: inferno_layout_test_fuzzer
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. Can't find cached display item: "LayoutDetailsMarker DIV id='details-mark
  blink::PaintController::FindOutOfOrderCachedItemForward
  blink::PaintController::UseCachedDrawingIfPossible
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=526088:526118

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5653323146592256

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Jan 23 2018

Components: Blink>Paint
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 23 2018

Labels: Test-Predator-Auto-Owner
Owner: wangxianzhu@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/1de7bf475012870fbc4cb27aac5f2206444f5fe3 ([SPv175+] Cache fragmented display items and paint chunks).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Labels: -Pri-1 Pri-3
Lowering priority because this is not a critical error and it happens with specific flag only.
Project Member

Comment 4 by ClusterFuzz, Jan 27 2018

Labels: OS-Windows
Blocking: 771643
Labels: -Pri-3 Pri-1
Pri=1 to fix the check failure text. This crashes with different crash state since check failure message changes with every crash, see related link in report. Please fix that check failure message so that hundreds of crashes are not created.
Project Member

Comment 7 by bugdroid1@chromium.org, Apr 4 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8bc8a7968d90763c45cf7db09c45058afe2540f4

commit 8bc8a7968d90763c45cf7db09c45058afe2540f4
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Apr 04 01:26:52 2018

[PE] Change CHECK to LOG(WARNING) in PaintController::FindOutOfOrderCachedItemForward

The situation doesn't cause corrupted rendering but just slightly
affects performance. It's fine not to DCHECK given that the situation
is rare.

Bug:  805024 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Change-Id: Iac8cd617d5df51da2516fc6a9df1308a0daaedd0
Reviewed-on: https://chromium-review.googlesource.com/990074
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Reviewed-by: Philip Rogers <pdr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547923}
[modify] https://crrev.com/8bc8a7968d90763c45cf7db09c45058afe2540f4/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp

Project Member

Comment 8 by bugdroid1@chromium.org, Apr 4 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/11e669ec3dce78c67aa7cf8665bce20f66174362

commit 11e669ec3dce78c67aa7cf8665bce20f66174362
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Apr 04 04:35:29 2018

Revert "[PE] Change CHECK to LOG(WARNING) in PaintController::FindOutOfOrderCachedItemForward"

This reverts commit 8bc8a7968d90763c45cf7db09c45058afe2540f4.

Reason for revert: It broke some tests on waterfall bots.
 
Original change's description:
> [PE] Change CHECK to LOG(WARNING) in PaintController::FindOutOfOrderCachedItemForward
> 
> The situation doesn't cause corrupted rendering but just slightly
> affects performance. It's fine not to DCHECK given that the situation
> is rare.
> 
> Bug:  805024 
> Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> Change-Id: Iac8cd617d5df51da2516fc6a9df1308a0daaedd0
> Reviewed-on: https://chromium-review.googlesource.com/990074
> Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> Reviewed-by: Philip Rogers <pdr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#547923}

TBR=wangxianzhu@chromium.org,pdr@chromium.org

Change-Id: If8c1dcd5e7d2f89ba688eadec9d3d047df777055
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  805024 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Reviewed-on: https://chromium-review.googlesource.com/994338
Reviewed-by: Xianzhu Wang <wangxianzhu@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#547980}
[modify] https://crrev.com/11e669ec3dce78c67aa7cf8665bce20f66174362/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp

Project Member

Comment 9 by bugdroid1@chromium.org, Apr 4 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b2515c5c61fd709708b1f867421506e84c53d367

commit b2515c5c61fd709708b1f867421506e84c53d367
Author: Xianzhu Wang <wangxianzhu@chromium.org>
Date: Wed Apr 04 20:15:10 2018

Reland "[PE] Change CHECK to LOG(WARNING) in PaintController::FindOutOfOrderCachedItemForward"

This is a reland of 8bc8a7968d90763c45cf7db09c45058afe2540f4

Updated unit tests, and add comments to
DisplayItemClient::SetDisplayItemsUncached()
and PaintController::ClientCacheIsValid() (also made private).

Original change's description:
> [PE] Change CHECK to LOG(WARNING) in PaintController::FindOutOfOrderCachedItemForward
>
> The situation doesn't cause corrupted rendering but just slightly
> affects performance. It's fine not to DCHECK given that the situation
> is rare.
>
> Bug:  805024 
> Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
> Change-Id: Iac8cd617d5df51da2516fc6a9df1308a0daaedd0
> Reviewed-on: https://chromium-review.googlesource.com/990074
> Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
> Reviewed-by: Philip Rogers <pdr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#547923}

Bug:  805024 
Change-Id: Ibcd443972c41b03cf03ea946da3c499987ad3b59
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_layout_tests_slimming_paint_v2
Reviewed-on: https://chromium-review.googlesource.com/994339
Reviewed-by: Philip Rogers <pdr@chromium.org>
Commit-Queue: Xianzhu Wang <wangxianzhu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#548177}
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/core/paint/PaintControllerPaintTest.cpp
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/core/paint/PaintControllerPaintTest.h
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/platform/graphics/paint/DisplayItemClient.h
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/platform/graphics/paint/PaintController.h
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/platform/graphics/paint/PaintControllerTest.cpp
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/platform/graphics/paint/PaintControllerTest.h
[modify] https://crrev.com/b2515c5c61fd709708b1f867421506e84c53d367/third_party/WebKit/Source/platform/graphics/paint/PaintRecordBuilderTest.cpp

Project Member

Comment 10 by ClusterFuzz, Apr 5 2018

ClusterFuzz has detected this issue as fixed in range 548174:548180.

Detailed report: https://clusterfuzz.com/testcase?key=5653323146592256

Fuzzer: inferno_layout_test_fuzzer
Job Type: linux_ubsan_vptr_content_shell_drt
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  false. Can't find cached display item: "LayoutDetailsMarker DIV id='details-mark
  blink::PaintController::FindOutOfOrderCachedItemForward
  blink::PaintController::UseCachedDrawingIfPossible
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=526088:526118
Fixed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_content_shell_drt&range=548174:548180

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5653323146592256

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Apr 5 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5653323146592256 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment