New issue
Advanced search Search tips

Issue 814966 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

ExtensionProtocolsTest shows race in content_verify_job.cc

Project Member Reported by lazyboy@chromium.org, Feb 22 2018

Issue description

While landing https://chromium-review.googlesource.com/c/chromium/src/+/917007/4, I noticed that Extensions/ExtensionProtocolsTest.VerificationSeenForFileAccessErrors/0 fails under tsan for that CL. However, that behavior is also reproducible @tott locally [1] when I tried. We need to be protecting ContentVerifyJob's member access with locks properly, it seems that ContnetVerifyJob::content_hash_reader_ access is fundamentally racey @tott (don't know why current bots complain though).

[1]
export TSAN_OPTIONS="external_symbolizer_path=third_party/llvm-build/Release+Asserts/bin/llvm-symbolizer"

I have following gn flags:
is_tsan = true
enable_nacl = false
is_debug = false
use_goma = true

ninja -C out/tsan unit_tests -j 1000 && ./out/tsan/unit_tests --gtest_filter=*ExtensionProtocolsTest.VerificationSeenForFileAccess* --gtest_repeat=5

Snip of data race logs:
 following race:
WARNING: ThreadSanitizer: data race (pid=31342)
  Read of size 8 at 0x7b2400009bf0 by main thread:
    #0 memcpy /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/tsan/../sanitizer_common/sanitizer_common_interceptors.inc:782 (unit_tests+0x22e189d)
    #1 swap<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >::__rep> buildtools/third_party/libc++/trunk/include/type_traits:4646 (unit_tests+0x5c05317)
    #2 swap buildtools/third_party/libc++/trunk/include/string:3091 (unit_tests+0x5c05317)
    #3 OnHashesReady extensions/browser/content_verify_job.cc:193 (unit_tests+0x5c05317)
    ... (snip)
    #50 main chrome/test/base/run_all_unittests.cc:30 (unit_tests+0x6f48c2d)

  Previous write of size 8 at 0x7b2400009bf0 by thread T5 (mutexes: write M892973951956187080, write M892411070721858616):
    #0 __set_long_pointer buildtools/third_party/libc++/trunk/include/string:1331 (libc++.so+0xe5f34)
    #1 __grow_by_and_replace buildtools/third_party/libc++/trunk/include/string:1970 (libc++.so+0xe5f34)
    #2 append buildtools/third_party/libc++/trunk/include/string:2223 (libc++.so+0xe5f34)
    #3 BytesRead extensions/browser/content_verify_job.cc:78 (unit_tests+0x5c05742)
    #4 OnBytesRead extensions/browser/extension_protocols.cc:718 (unit_tests+0x5c450ab)
    #5 Start content/browser/file_url_loader_factory.cc:481 (unit_tests+0x5594bf7)
    #6 CreateAndStart content/browser/file_url_loader_factory.cc:311 (unit_tests+0x5594bf7)
    ... (snip)
    #18 ThreadFunc base/threading/platform_thread_posix.cc:75 (unit_tests+0x7cfdaed)

  Location is heap block of size 144 at 0x7b2400009bd0 allocated by main thread:
    #0 operator new(unsigned long) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/tsan/rtl/tsan_new_delete.cc:57 (unit_tests+0x23405a9)
    #1 CreateJobFor extensions/browser/content_verifier.cc:126 (unit_tests+0x5c00b12)
    #2 StartVerifyJob extensions/browser/extension_protocols.cc:962 (unit_tests+0x5c4472b)
    #3 Invoke<network::ResourceRequest, mojo::InterfaceRequest<network::mojom::URLLoader>, mojo::InterfacePtr<network::mojom::URLLoaderClient>, scoped_refptr<extensions::ContentVerifier>, extensions::ExtensionResource, scoped_refptr<net::HttpResponseHeaders> > base/bind_internal.h:402 (unit_tests+0x5c44a7c)
    ... (snip)
    #37 main chrome/test/base/run_all_unittests.cc:30 (unit_tests+0x6f48c2d)

 
Project Member

Comment 1 by bugdroid1@chromium.org, Feb 24 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a1f5410eb499e10419396d7d7e7e394e567ab427

commit a1f5410eb499e10419396d7d7e7e394e567ab427
Author: Istiaque Ahmed <lazyboy@chromium.org>
Date: Sat Feb 24 02:35:30 2018

Protect ContentVerifyJob::hash_reader_ access using lock.

CVJ::OnHashesReady seems to be missing lock while accessing member
variable. Add lock to the method. OnHashesReady also calls
BytesRead which already had lock. Turn that method to private
BytesReadImpl, remove lock from it, and provide lock to the
publicly callable version (new BytesRead).
This CL also protects CVJ::time_spent_.

Bug:  814966 
Test: Internal change only. See bug for running unit_tests.
Change-Id: I632dccf2ee921d1c84392b44c3ab8e0ca52dde3e
Reviewed-on: https://chromium-review.googlesource.com/933245
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Commit-Queue: Istiaque Ahmed <lazyboy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#538970}
[modify] https://crrev.com/a1f5410eb499e10419396d7d7e7e394e567ab427/extensions/browser/content_verify_job.cc
[modify] https://crrev.com/a1f5410eb499e10419396d7d7e7e394e567ab427/extensions/browser/content_verify_job.h

Status: Fixed (was: Started)

Sign in to add a comment