New issue
Advanced search Search tips

Issue 822247 link

Starred by 3 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in blink::Node::SetLayoutObject

Project Member Reported by ClusterFuzz, Mar 15 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4605554014814208

Fuzzer: bj_broddelwerk
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::Node::SetLayoutObject
  blink::Document::Initialize
  blink::LocalDOMWindow::InstallNewDocument
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528752:528753

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4605554014814208

Additional requirements: Requires Gestures

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 15 2018

Components: Blink>DOM Blink>Internals
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 15 2018

Labels: Test-Predator-Auto-Owner
Owner: steve...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e30d522fe90b365b0d33e1c28a66b89776771c9a (DisplayPrefs: Fix mus/mash behavior).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: steve...@chromium.org
Labels: Test-Predator-Wrong-CLs
Owner: ----
Status: Untriaged (was: Assigned)
That CL occurred on Jan 11, quite some time back.
The CL has nothing to do with blink code: https://chromium-review.googlesource.com/861288
It was also reverted here: https://chromium-review.googlesource.com/864561

Comment 4 by rakina@chromium.org, Mar 16 2018

Status: Available (was: Untriaged)

Comment 5 by rakina@chromium.org, Mar 16 2018

Components: -Blink>DOM Blink>Layout

Comment 6 by kochi@chromium.org, Mar 16 2018

Looking at the code around
https://chromium.googlesource.com/chromium/src/+/78310a6f34fa3ac5aca14d7f31960858118fc036/third_party/WebKit/Source/core/dom/Node.cpp#675

When rare data is not available, |node_layout_data| is initialized
from |data_.node_layout_data_|, which is a raw pointer,
and then |data_.node_layout_data_| is overwritten to the
|new NodeRenderingData()| then the old pointer (if not null) leaks.

Project Member

Comment 7 by ClusterFuzz, Mar 16 2018

ClusterFuzz has detected this issue as fixed in range 543568:543570.

Detailed report: https://clusterfuzz.com/testcase?key=4605554014814208

Fuzzer: bj_broddelwerk
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::Node::SetLayoutObject
  blink::Document::Initialize
  blink::LocalDOMWindow::InstallNewDocument
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528752:528753
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=543568:543570

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4605554014814208

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Mar 16 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Available)
ClusterFuzz testcase 4605554014814208 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Comment 9 by rakina@chromium.org, Mar 18 2018

 Issue 823128  has been merged into this issue.

Comment 10 by kochi@chromium.org, Mar 19 2018

Labels: ClusterFuzz-Wrong
Status: Available (was: Verified)
Looks like the leak does exist, but for some unknown reason it was
closed and verified, while another issue was filed?

This needs 2 resolutions - one for making sure fixing the leak (or making sure
it is not), and the other for fixing the flakiness of leak sanitizer report.
Project Member

Comment 11 by ClusterFuzz, Mar 25 2018

ClusterFuzz has detected this issue as fixed in range 545694:545695.

Detailed report: https://clusterfuzz.com/testcase?key=4605554014814208

Fuzzer: bj_broddelwerk
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::Node::SetLayoutObject
  blink::Document::Initialize
  blink::LocalDOMWindow::InstallNewDocument
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=528752:528753
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=545694:545695

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4605554014814208

Additional requirements: Requires Gestures

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.

Comment 12 by kochi@chromium.org, Mar 26 2018

Hmm... Skia roll fixed this?

Sign in to add a comment