New issue
Advanced search Search tips

Issue 822246 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2018
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: ----



Sign in to add a comment

SelectToSpeakTest.FocusRingMovesWithMouse in interactive_ui_tests failing

Project Member Reported by sheriff-...@appspot.gserviceaccount.com, Mar 15 2018

Issue description

Filed by sheriff-o-matic@appspot.gserviceaccount.com on behalf of rogerta@chromium.org

SelectToSpeakTest.FocusRingMovesWithMouse in interactive_ui_tests failing

Builders failed on: 
- Linux ChromiumOS MSan Tests: 
  https://build.chromium.org/p/chromium.memory/builders/Linux%20ChromiumOS%20MSan%20Tests


 
This has failed the last 9 builds as of 2018-03-15 09h42 EST:

https://uberchromegw.corp.google.com/i/chromium.memory/builders/Linux%20ChromiumOS%20MSan%20Tests

The error is a crash, and it may be related to an uninitialized value:

https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.memory%2FLinux_ChromiumOS_MSan_Tests%2F6221%2F%2B%2Frecipes%2Fsteps%2Finteractive_ui_tests%2F0%2Fstdout

[ RUN      ] ExtensionPointerLockTest.ExtensionPointerLockAccessFail
==2451==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x1728a971 in ui::ws::DisplayManager::DisplayManager(ui::ws::WindowServer*) ./../../services/ui/ws/display_manager.cc:44:7
    #1 0x172cc28d in make_unique<ui::ws::DisplayManager, ui::ws::WindowServer *> ./../../buildtools/third_party/libc++/trunk/include/memory:3079:32
    #2 0x172cc28d in ui::ws::WindowServer::WindowServer(ui::ws::WindowServerDelegate*, bool) ./../../services/ui/ws/window_server.cc:138:0
    #3 0x670f1c5 in make_unique<ui::ws::WindowServer, ui::Service *, const bool &> ./../../buildtools/third_party/libc++/trunk/include/memory:3079:32
    #4 0x670f1c5 in ui::Service::OnStart() ./../../services/ui/service.cc:261:0
    #5 0x1193b2fe in service_manager::ServiceContext::OnStart(service_manager::Identity const&, base::OnceCallback<void (mojo::InterfaceRequest<service_manager::mojom::Connector>, mojo::AssociatedInterfaceRequest<service_manager::mojom::ServiceControl>)>) ./../../services/service_manager/public/cpp/service_context.cc:130:13
    #6 0x1195a56d in service_manager::mojom::ServiceStubDispatch::AcceptWithResponder(service_manager::mojom::Service*, mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ./gen/services/service_manager/public/mojom/service.mojom.cc:483:13
    #7 0x1193cc1b in service_manager::mojom::ServiceStub<mojo::RawPtrImplRefTraits<service_manager::mojom::Service> >::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ./gen/services/service_manager/public/mojom/service.mojom.h:174:12
    #8 0x113d03be in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:394:34
    #9 0x113ce22a in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #10 0x113e8956 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880:42
    #11 0x113e61b6 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604:38
    #12 0x113ce22a in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #13 0x113c7a15 in mojo::Connector::ReadSingleMessage(unsigned int*) ./../../mojo/public/cpp/bindings/lib/connector.cc:445:51
    #14 0x113c9f4b in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:474:10
    #15 0x113b620c in Run ./../../base/callback.h:124:12
    #16 0x113b620c in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:273:0
    #17 0xfeea425 in Run ./../../base/callback.h:95:12
    #18 0xfeea425 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:61:0
    #19 0xff7d805 in base::MessageLoop::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop.cc:395:25
    #20 0xff7f29f in DeferOrRunPendingTask ./../../base/message_loop/message_loop.cc:407:5
    #21 0xff7f29f in base::MessageLoop::DoWork() ./../../base/message_loop/message_loop.cc:451:0
    #22 0xff86dd3 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_libevent.cc:220:31
    #23 0x1004d4df in base::RunLoop::Run() ./../../base/run_loop.cc:133:14
    #24 0x10127598 in base::Thread::ThreadMain() ./../../base/threading/thread.cc:338:3
    #25 0x1011d11a in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:76:13
    #26 0x7f25ed6aa183 in start_thread /build/eglibc-SvCtMH/eglibc-2.19/nptl/pthread_create.c:312:0
    #27 0x7f25e8287ffc in clone /build/eglibc-SvCtMH/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111:0
  Uninitialized value was created by a heap allocation
    #0 0x543f19 in operator new(unsigned long) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/msan/msan_new_delete.cc:45:35
    #1 0x670f164 in make_unique<ui::ws::WindowServer, ui::Service *, const bool &> ./../../buildtools/third_party/libc++/trunk/include/memory:3079:28
    #2 0x670f164 in ui::Service::OnStart() ./../../services/ui/service.cc:261:0
    #3 0x1193b2fe in service_manager::ServiceContext::OnStart(service_manager::Identity const&, base::OnceCallback<void (mojo::InterfaceRequest<service_manager::mojom::Connector>, mojo::AssociatedInterfaceRequest<service_manager::mojom::ServiceControl>)>) ./../../services/service_manager/public/cpp/service_context.cc:130:13
    #4 0x1195a56d in service_manager::mojom::ServiceStubDispatch::AcceptWithResponder(service_manager::mojom::Service*, mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ./gen/services/service_manager/public/mojom/service.mojom.cc:483:13
    #5 0x1193cc1b in service_manager::mojom::ServiceStub<mojo::RawPtrImplRefTraits<service_manager::mojom::Service> >::AcceptWithResponder(mojo::Message*, std::__1::unique_ptr<mojo::MessageReceiverWithStatus, std::__1::default_delete<mojo::MessageReceiverWithStatus> >) ./gen/services/service_manager/public/mojom/service.mojom.h:174:12
    #6 0x113d03be in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:394:34
    #7 0x113ce22a in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #8 0x113e8956 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880:42
    #9 0x113e61b6 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604:38
    #10 0x113ce22a in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #11 0x113c7a15 in mojo::Connector::ReadSingleMessage(unsigned int*) ./../../mojo/public/cpp/bindings/lib/connector.cc:445:51
    #12 0x113c9f4b in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:474:10
    #13 0x113b620c in Run ./../../base/callback.h:124:12
    #14 0x113b620c in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:273:0
    #15 0xfeea425 in Run ./../../base/callback.h:95:12
    #16 0xfeea425 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:61:0
    #17 0xff7d805 in base::MessageLoop::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop.cc:395:25
    #18 0xff7f29f in DeferOrRunPendingTask ./../../base/message_loop/message_loop.cc:407:5
    #19 0xff7f29f in base::MessageLoop::DoWork() ./../../base/message_loop/message_loop.cc:451:0
    #20 0xff86dd3 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_libevent.cc:220:31
    #21 0x1004d4df in base::RunLoop::Run() ./../../base/run_loop.cc:133:14
    #22 0x10127598 in base::Thread::ThreadMain() ./../../base/threading/thread.cc:338:3
    #23 0x1011d11a in base::(anonymous namespace)::ThreadFunc(void*) ./../../base/threading/platform_thread_posix.cc:76:13
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/s/w/ir/out/Release/interactive_ui_tests+0x1728a971)
Exiting
[1/314] ExtensionPointerLockTest.ExtensionPointerLockAccessFail (CRASHED)

Cc: crouleau@chromium.org
Labels: -Sheriff-Chromium
Owner: sky@chromium.org
Status: Assigned (was: Available)
I think all interactive tests are failing with the same error.

Scott: can you please take a look?  Seems like you touched ui::ws::WindowServer recently.  Thanks.
Most recent change to ui::ws::WindowServer:

https://chromium-review.googlesource.com/c/chromium/src/+/956496

Comment 4 by sky@chromium.org, Mar 15 2018

Status: Started (was: Assigned)
Any reason not to revert https://chromium-review.googlesource.com/c/chromium/src/+/956496 right now and get this fixed?
Project Member

Comment 6 by bugdroid1@chromium.org, Mar 15 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/15302e6a5c4462452282cd03ab81eda8854d6998

commit 15302e6a5c4462452282cd03ab81eda8854d6998
Author: Scott Violet <sky@chromium.org>
Date: Thu Mar 15 17:52:39 2018

chromeos: fix use of uninitialized value in DisplayManager

DisplayManager's constructor is called from WindowServer's
constructor. This means DisplayManager shouldn't call to WindowServer,
else we get use of unitialized values like this.

BUG= 822246 
TEST=covered by tests

Change-Id: I296911502021a135276a9db49b98927efea95618
Reviewed-on: https://chromium-review.googlesource.com/963831
Reviewed-by: Michael Wasserman <msw@chromium.org>
Commit-Queue: Scott Violet <sky@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543437}
[modify] https://crrev.com/15302e6a5c4462452282cd03ab81eda8854d6998/services/ui/ws/display_manager.cc
[modify] https://crrev.com/15302e6a5c4462452282cd03ab81eda8854d6998/services/ui/ws/display_manager.h
[modify] https://crrev.com/15302e6a5c4462452282cd03ab81eda8854d6998/services/ui/ws/window_server.cc

The last test run ran against 543399. Still waiting for more recent results.

Comment 8 by sky@chromium.org, Mar 15 2018

Status: Fixed (was: Started)

Sign in to add a comment