Direct-leak in blink::Node::SetLayoutObject |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4605554014814208 Fuzzer: bj_broddelwerk Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: blink::Node::SetLayoutObject blink::Document::Initialize blink::LocalDOMWindow::InstallNewDocument Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528752:528753 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4605554014814208 Additional requirements: Requires Gestures Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Mar 15 2018
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e30d522fe90b365b0d33e1c28a66b89776771c9a (DisplayPrefs: Fix mus/mash behavior). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Mar 15 2018
That CL occurred on Jan 11, quite some time back. The CL has nothing to do with blink code: https://chromium-review.googlesource.com/861288 It was also reverted here: https://chromium-review.googlesource.com/864561
,
Mar 16 2018
,
Mar 16 2018
,
Mar 16 2018
Looking at the code around https://chromium.googlesource.com/chromium/src/+/78310a6f34fa3ac5aca14d7f31960858118fc036/third_party/WebKit/Source/core/dom/Node.cpp#675 When rare data is not available, |node_layout_data| is initialized from |data_.node_layout_data_|, which is a raw pointer, and then |data_.node_layout_data_| is overwritten to the |new NodeRenderingData()| then the old pointer (if not null) leaks.
,
Mar 16 2018
ClusterFuzz has detected this issue as fixed in range 543568:543570. Detailed report: https://clusterfuzz.com/testcase?key=4605554014814208 Fuzzer: bj_broddelwerk Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: blink::Node::SetLayoutObject blink::Document::Initialize blink::LocalDOMWindow::InstallNewDocument Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528752:528753 Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=543568:543570 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4605554014814208 Additional requirements: Requires Gestures See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 16 2018
ClusterFuzz testcase 4605554014814208 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Mar 18 2018
Issue 823128 has been merged into this issue.
,
Mar 19 2018
Looks like the leak does exist, but for some unknown reason it was closed and verified, while another issue was filed? This needs 2 resolutions - one for making sure fixing the leak (or making sure it is not), and the other for fixing the flakiness of leak sanitizer report.
,
Mar 25 2018
ClusterFuzz has detected this issue as fixed in range 545694:545695. Detailed report: https://clusterfuzz.com/testcase?key=4605554014814208 Fuzzer: bj_broddelwerk Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Direct-leak Crash Address: Crash State: blink::Node::SetLayoutObject blink::Document::Initialize blink::LocalDOMWindow::InstallNewDocument Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528752:528753 Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=545694:545695 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4605554014814208 Additional requirements: Requires Gestures See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Mar 26 2018
Hmm... Skia roll fixed this? |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, Mar 15 2018Labels: Test-Predator-Auto-Components