New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 821240 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Direct-leak in blink::MessagePort::Entangle

Project Member Reported by ClusterFuzz, Mar 13 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6079283123191808

Fuzzer: attekett_dom_fuzzer
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::MessagePort::Entangle
  blink::MessagePort::close
  Call
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=542464:542465

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6079283123191808

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: brajkumar@chromium.org
Components: Blink>Messaging
Labels: -Type-Bug -Pri-2 M-65 Test-Predator-Wrong Pri-1 Type-Bug-Regression
Owner: mek@chromium.org
Status: Assigned (was: Untriaged)
Predator and CL could not provide any possible suspects.

Using Code Search for the file, "MessagePort.cpp" and observed some recent changes for the below file.

Suspect CL: https://chromium.googlesource.com/chromium/src/+/6dc8a881789007e9305415c9875a90a3fd023962%5E%21/third_party/WebKit/Source/core/dom/MessagePort.cpp

mek@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!

Comment 2 by mek@chromium.org, Mar 13 2018

Not sure I understand the supposed leak. Am I reading the report correctly that this is complaining that the mojo::Connector created by make_unique in Entangle is somehow leaked? Not sure how that would be possible, given that it is owned by a std::unique_ptr. The only way that could leak would be if the MessagePort that owns it is also leaked, but it doesn't seem to be complaining about that?

Any idea what I'm missing here?
Some of our leak detection tools don't see Oilpan objects very well, so sometimes leaks are detected via the non-Oilpan objects that are owned that way.

I think we also have issues with leak detection not doing a GC on workers before checking, so sometimes we have memory that would be collected on the next major GC. The stack trace makes me suspect that's what's happening here, but I haven't dug into this one deeply.

Comment 4 by mek@chromium.org, Mar 13 2018

Yeah, definitely looks like this is a case of MessagePort not getting GC'ed even though it should be able to be GC'ed. Clearly close() was called on the port (since it's in the allocation trace), so closed_ would be true, and thus IsEntangled() would be false, and HasPendingActivity would also be false.

So the bug (if anything) seems to be in how GC'ed object are accounted for in these leak detections.
Project Member

Comment 5 by ClusterFuzz, Mar 15 2018

Components: Platform
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
 Issue 823038  has been merged into this issue.

Comment 7 by mek@chromium.org, Mar 19 2018

Status: WontFix (was: Assigned)
Marking as won't-fix since to the best of my knowledge there is no memory leak here, and this is just a bug in the leak detection code...
Project Member

Comment 8 by ClusterFuzz, Mar 26 2018

Labels: Needs-Feedback
ClusterFuzz testcase 5256490332717056 is still reproducing on tip-of-tree build (trunk).

If this testcase was not reproducible locally or unworkable, ignore this notification and we will file another bug soon with hopefully a better and workable testcase.

Otherwise, if this is not intended to be fixed (e.g. this is an intentional crash), please add ClusterFuzz-Ignore label to prevent future bug filing with similar crash stacktrace.

Sign in to add a comment