New issue
Advanced search Search tips

Issue 823022 link

Starred by 3 users

Issue metadata

Status: Verified
Owner: ----
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug



Sign in to add a comment

Indirect-leak in mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorder...

Project Member Reported by ClusterFuzz, Mar 17 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4847273096511488

Fuzzer: marty_html_twiddler
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  blink::KeyframeEffectModelBase::EnsureKeyframeGroups
  blink::KeyframeEffectModelBase::SnapshotAllCompositorKeyframes
  blink::CSSAnimations::SnapshotCompositorKeyframes
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=523898:523900

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4847273096511488

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 17 2018

Components: Blink>Animation
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 2 by sunxd@chromium.org, Mar 19 2018

Cc: flackr@chromium.org smcgruer@chromium.org
Status: Available (was: Untriaged)
The only two changes on chromium in the regressed range are tests or comments.
Cc: -smcgruer@chromium.org
Owner: smcgruer@chromium.org
Status: Assigned (was: Available)
I'll take a look first thing tomorrow.
I'm unable to reproduce using:

/google/data/ro/teams/clusterfuzz-tools/releases/clusterfuzz reproduce 4847273096511488

It is spitting out a different leak;

New crash type: Direct-leak
New crash state:
  FcPatternObjectInsertElt
  FcPatternObjectAddWithBinding
  FcPatternAppend

Tried with --download build too and that spits out no failure.

I've fired off a redo on the clusterfuzz report.
Cc: smcgruer@chromium.org
Components: -Blink>Animation Internals>Mojo
Owner: ----
Status: Untriaged (was: Assigned)
Summary: Indirect-leak in mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorder... (was: Indirect-leak in blink::KeyframeEffectModelBase::EnsureKeyframeGroups)
After running Redo Task a few times in clusterfuzz, this has not once pointed at KeyframeEffectModelBase again.

Most recently it is pointing at mojo code (it actually updated the clusterfuzz report title?!) so passing it over to mojo team to take a look.

See latest report at https://clusterfuzz.com/v2/testcase-detail/4847273096511488 :

==7351==ERROR: LeakSanitizer: detected memory leaks
Indirect leak of 16 byte(s) in 1 object(s) allocated from:
#0 0x556f2fcd9842 in operator new(unsigned long) third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:92:3
#1 0x556f397471bd in make_unique<ukm::mojom::UkmRecorderInterfaceProxy, mojo::InterfaceEndpointClient *> buildtools/third_party/libc++/trunk/include/memory:3079:28
#2 0x556f397471bd in mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigureProxyIfNecessary() mojo/public/cpp/bindings/lib/interface_ptr_state.h:214
#3 0x556f397468c7 in instance mojo/public/cpp/bindings/lib/interface_ptr_state.h:113:5
#4 0x556f397468c7 in get mojo/public/cpp/bindings/interface_ptr.h:97
#5 0x556f397468c7 in operator-> mojo/public/cpp/bindings/interface_ptr.h:100
#6 0x556f397468c7 in ukm::MojoUkmRecorder::UpdateSourceURL(long, GURL const&) services/metrics/public/cpp/mojo_ukm_recorder.cc:32
#7 0x556f41c91e1d in blink::Document::UkmRecorder() third_party/WebKit/Source/core/dom/Document.cpp:5997:20
...

Labels: M-66 CF-NeedsTriage
As per comment #5 could someone from mojo team can look in to this issue?

Thanks!
Project Member

Comment 7 by ClusterFuzz, Jun 12 2018

ClusterFuzz has detected this issue as fixed in range 566300:566302.

Detailed report: https://clusterfuzz.com/testcase?key=4847273096511488

Fuzzer: marty_html_twiddler
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Indirect-leak
Crash Address: 
Crash State:
  mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigurePr
  instance
  get
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=523898:523900
Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=566300:566302

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4847273096511488

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 8 by ClusterFuzz, Jun 12 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Untriaged)
ClusterFuzz testcase 4847273096511488 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment