New issue
Advanced search Search tips

Issue 820276 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Mar 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Data race in pthread_mutex_destroy

Project Member Reported by ClusterFuzz, Mar 8 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6038485564391424

Fuzzer: inferno_twister
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 1
Crash Address: 0x7b4c000503b8
Crash State:
  pthread_mutex_destroy
  base::internal::LockImpl::~LockImpl
  media::AudioOutputDevice::~AudioOutputDevice
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=541800:541801

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6038485564391424

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 8 2018

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 8 2018

Labels: Test-Predator-Auto-Owner
Owner: maxmorin@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/a7c1c1850928f3560844ae85f2ea23803134e257 (Fix yet another AudioOutputDevice crash.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by bugdroid1@chromium.org, Mar 9 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b305c700239b4010b25408f40e8359d82c9709d5

commit b305c700239b4010b25408f40e8359d82c9709d5
Author: Max Morin <maxmorin@chromium.org>
Date: Fri Mar 09 09:16:23 2018

Revert "Fix yet another AudioOutputDevice crash."

This reverts commit a7c1c1850928f3560844ae85f2ea23803134e257.

Reason for revert: Clusterfuzz reports...

Original change's description:
> Fix yet another AudioOutputDevice crash.
> 
> Bug is identical to the last :/. No idea why it's much more frequent with mojo,
> possibly a race is likely to happen when destroying a frame: |callback_| is
> destroyed due to frame being destroyed, and authorization is failed for the
> same reason. With the per process message filter, authorization wouldn't fail
> due to the frame being destructed.
> 
> Bug: 819277
> Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
> Change-Id: Ic17dc96d2c83a08732b43094bac2f2c3fa7035ad
> Reviewed-on: https://chromium-review.googlesource.com/951774
> Commit-Queue: Max Morin <maxmorin@chromium.org>
> Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#541801}

TBR=dalecurtis@chromium.org,maxmorin@chromium.org

Change-Id: I9bf3d357bd09ebd1fa60b4324d204da44b23b72a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 819277, 820276 , 820341 
Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Reviewed-on: https://chromium-review.googlesource.com/957042
Reviewed-by: Max Morin <maxmorin@chromium.org>
Commit-Queue: Max Morin <maxmorin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#542065}
[modify] https://crrev.com/b305c700239b4010b25408f40e8359d82c9709d5/media/audio/audio_output_device.cc
[modify] https://crrev.com/b305c700239b4010b25408f40e8359d82c9709d5/media/audio/audio_output_device.h
[modify] https://crrev.com/b305c700239b4010b25408f40e8359d82c9709d5/media/audio/audio_output_device_unittest.cc

Project Member

Comment 4 by ClusterFuzz, Mar 10 2018

ClusterFuzz has detected this issue as fixed in range 542064:542065.

Detailed report: https://clusterfuzz.com/testcase?key=6038485564391424

Fuzzer: inferno_twister
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Data race WRITE 1
Crash Address: 0x7b4c000503b8
Crash State:
  pthread_mutex_destroy
  base::internal::LockImpl::~LockImpl
  media::AudioOutputDevice::~AudioOutputDevice
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=541800:541801
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=542064:542065

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6038485564391424

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 5 by ClusterFuzz, Mar 10 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6038485564391424 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment