New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 810595 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Oct 26
Cc:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Indirect-leak in mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigurePr

Project Member Reported by ClusterFuzz, Feb 9 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4829563117633536

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigurePr
  instance
  get
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4829563117633536

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: roc...@chromium.org brajkumar@chromium.org
Components: Internals>Mojo
Labels: M-64 Test-Predator-Wrong CF-NeedsTriage
Unable to find actual suspect through code search and also from the provided CL under regression range, hence adding appropriate label and leaving it as untriaged for further updates.

Thanks!

Comment 2 by roc...@chromium.org, Feb 12 2018

Cc: holte@chromium.org
Looks like ukm_recorder_ may be leaking on Document. Not sure if this should really matter assuming it's only a renderer shutdown leak?

+CC holte as the last person to change blink::Document::UkmRecorder().
Project Member

Comment 3 by ClusterFuzz, Feb 16 2018

ClusterFuzz has detected this issue as fixed in range 537181:537198.

Detailed report: https://clusterfuzz.com/testcase?key=4829563117633536

Fuzzer: ifratric-browserfuzzer-v3
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigurePr
  instance
  get
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=209699:209703
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=537181:537198

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4829563117633536

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 4 by ClusterFuzz, Feb 16 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 4829563117633536 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 5 by holte@chromium.org, Feb 16 2018

Since the ukm_recorder_ is held in a unique_ptr, is this a case where the Document object itself is leaked?

Comment 6 by roc...@chromium.org, Feb 21 2018

 Issue 813409  has been merged into this issue.

Comment 7 by roc...@chromium.org, Feb 21 2018

Cc: dcheng@chromium.org
Status: Untriaged (was: Verified)
Re-opening this because it's appearing again (see  issue 813409 ).

I agree with #5 that it looks like a Document leak.

Comment 8 by holte@chromium.org, Feb 23 2018

 Issue 814980  has been merged into this issue.

Comment 9 by holte@chromium.org, Feb 23 2018

Cc: hajimehoshi@chromium.org
+hajimehoshi, since one of the reasons that UKM recorder exists on Document is to help identify causes of document leaks per https://bugs.chromium.org/p/chromium/issues/detail?id=757374


Project Member

Comment 10 by ClusterFuzz, Mar 15 2018

Labels: -M-64 Fuzz-Blocker M-67 ReleaseBlock-Beta
This crash occurs very frequently on linux platform and is likely preventing the fuzzer ifratric-browserfuzzer-v3 from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Friendly ping to get an update on this issue as it is marked as beta blocker.

Thanks..!

Comment 12 Deleted

A friendly reminder that M67 branch is coming soon on 04/12! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M67 from a high quality trunk. Thank you.
 Issue 821363  has been merged into this issue.
Components: -Internals>Mojo
This is not a Mojo bug, so removing that component. The report implies that a UkmRecorderInterface endpoint is leaking. See comments #7 and #9 for more context.
Project Member

Comment 16 by ClusterFuzz, Mar 28 2018

Components: Internals>Mojo
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 17 by ClusterFuzz, Mar 28 2018

Labels: Test-Predator-Auto-Owner
Owner: scottchen@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/62d0093b891fa483449513db827aee7b36760e0c (MD Extensions: eliminate lags when clicking between errors in the error console.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Components: -Internals>Mojo
Labels: Test-Predator-Wrong-Components
A friendly reminder that M67 branch is coming soon on 04/12! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M67 from a high quality trunk. Thank you.
Gentle ping to get an update on this issue as it is marked as beta blocker fro M67 & M67 branch is coming soon on 04/12

Thanks..!

Comment 21 by holte@chromium.org, Apr 10 2018

I don't know how to fix the Document leak here, but we could potentially avoid leaking the UkmRecorderInterface object around when that happens, either by:
* By not holding onto the UkmRecorderInterface and creating new ones from connector as needed.
* By keeping a single shared UkmRecorderInterface somewhere (maybe Platform?)

Given that other objects must be being leaked here I'm not sure what severity of leaking UkmRecorderInterface is.


A friendly reminder that M67 branch is tomorrow, Thursday 04/12! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M67 from a high quality trunk. Thank you.

Comment 23 by holte@chromium.org, Apr 11 2018

Labels: -ReleaseBlock-Beta
Removing ReleaseBlock-Beta since it doesn't seem like this is severe enough to warrant it.

My understanding is that:
* This occurs when a Document leaks
* Document leaks in general are not a new issue.
* This extra object being leaked is only adding a couple bytes to that existing leak.
Cc: keishi@chromium.org yuzus@chromium.org
+yuzus, keishi who are looking at document leaks
Owner: hajimehoshi@chromium.org
Please assign this to a more applicable owner.
 Issue 835022  has been merged into this issue.
Cc: -roc...@chromium.org rockot@google.com
Labels: -CF-NeedsTriage
Status: Verified (was: Assigned)
This issue has been fixed.

Sign in to add a comment