Data race in gfx::GetFontRenderParams |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5423538220302336 Fuzzer: tokenfuzz_pdf_march16 Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race READ 4 Crash Address: 0x564bceea7a28 Crash State: gfx::GetFontRenderParams content::SandboxIPCHandler::HandleGetStyleForStrike content::SandboxIPCHandler::HandleRequestFromChild Sanitizer: thread (TSAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5423538220302336 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information. Note: This crash might not be reproducible with the provided testcase. That said, for the past 14 days we've been seeing this crash frequently. If you are unable to reproduce this, please try a speculative fix based on the crash stacktrace in the report. The fix can be verified by looking at the crash statistics in the report, a day after the fix is deployed. We will auto-close the bug if the crash is not seen for 14 days.
,
Mar 6 2018
Unable to find actual suspect through code search and also from the provided CL under regression range, hence adding the file owner as per the below link to get more update on this issue. https://cs.chromium.org/chromium/src/ui/gfx/OWNERS?type=cs&sq=package:chromium asvitkine@ Could you please take a look in to this issue? Thanks!
,
Mar 6 2018
The problem is this API is being used from a thread other than the UI thread. Call stack from: WARNING: ThreadSanitizer: data race (pid=18869) Read of size 4 at 0x564bceea7a28 by thread T1: #0 0x564bc89b8fa8 in gfx::GetFontRenderParams(gfx::FontRenderParamsQuery const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >*) ui/gfx/font_render_params_linux.cc:246:40 #1 0x564bc66a1ecb in content::SandboxIPCHandler::HandleGetStyleForStrike(int, base::PickleIterator, std::__1::vector<base::ScopedGeneric<int, base::internal::ScopedFDCloseTraits>, std::__1::allocator<base::ScopedGeneric<int, base::internal::ScopedFDCloseTraits> > > const&) content/browser/sandbox_ipc_linux.cc:309:40 #2 0x564bc66a1588 in content::SandboxIPCHandler::HandleRequestFromChild(int) content/browser/sandbox_ipc_linux.cc:174:5 #3 0x564bc66a11a7 in content::SandboxIPCHandler::Run() content/browser/sandbox_ipc_linux.cc:127:7 #4 0x564bc832d4b9 in base::DelegateSimpleThread::Run() base/threading/simple_thread.cc:92:13 #5 0x564bc832d207 in base::SimpleThread::ThreadMain() base/threading/simple_thread.cc:68:3 #6 0x564bc832af4e in base::(anonymous namespace)::ThreadFunc(void*) base/threading/platform_thread_posix.cc:75:13 Previous write of size 4 at 0x564bceea7a28 by main thread: [failed to restore the stack] Location is global 'gfx::(anonymous namespace)::device_scale_factor_' of size 4 at 0x564bceea7a28 (chrome+0x00000c641a28) So the error is on the callers side from content::SandboxIPCHandler::HandleGetStyleForStrike(). Assigning to jam@ for triage from content/ side.
,
Jun 21 2018
ClusterFuzz testcase 5423538220302336 is flaky and no longer crashes, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Mar 5 2018Labels: Test-Predator-Auto-Components