Indirect-leak in mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorder... |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=4847273096511488 Fuzzer: marty_html_twiddler Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Indirect-leak Crash Address: Crash State: blink::KeyframeEffectModelBase::EnsureKeyframeGroups blink::KeyframeEffectModelBase::SnapshotAllCompositorKeyframes blink::CSSAnimations::SnapshotCompositorKeyframes Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=523898:523900 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4847273096511488 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Mar 19 2018
The only two changes on chromium in the regressed range are tests or comments.
,
Mar 19 2018
I'll take a look first thing tomorrow.
,
Mar 20 2018
I'm unable to reproduce using: /google/data/ro/teams/clusterfuzz-tools/releases/clusterfuzz reproduce 4847273096511488 It is spitting out a different leak; New crash type: Direct-leak New crash state: FcPatternObjectInsertElt FcPatternObjectAddWithBinding FcPatternAppend Tried with --download build too and that spits out no failure. I've fired off a redo on the clusterfuzz report.
,
Mar 22 2018
After running Redo Task a few times in clusterfuzz, this has not once pointed at KeyframeEffectModelBase again. Most recently it is pointing at mojo code (it actually updated the clusterfuzz report title?!) so passing it over to mojo team to take a look. See latest report at https://clusterfuzz.com/v2/testcase-detail/4847273096511488 : ==7351==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 16 byte(s) in 1 object(s) allocated from: #0 0x556f2fcd9842 in operator new(unsigned long) third_party/llvm/compiler-rt/lib/asan/asan_new_delete.cc:92:3 #1 0x556f397471bd in make_unique<ukm::mojom::UkmRecorderInterfaceProxy, mojo::InterfaceEndpointClient *> buildtools/third_party/libc++/trunk/include/memory:3079:28 #2 0x556f397471bd in mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigureProxyIfNecessary() mojo/public/cpp/bindings/lib/interface_ptr_state.h:214 #3 0x556f397468c7 in instance mojo/public/cpp/bindings/lib/interface_ptr_state.h:113:5 #4 0x556f397468c7 in get mojo/public/cpp/bindings/interface_ptr.h:97 #5 0x556f397468c7 in operator-> mojo/public/cpp/bindings/interface_ptr.h:100 #6 0x556f397468c7 in ukm::MojoUkmRecorder::UpdateSourceURL(long, GURL const&) services/metrics/public/cpp/mojo_ukm_recorder.cc:32 #7 0x556f41c91e1d in blink::Document::UkmRecorder() third_party/WebKit/Source/core/dom/Document.cpp:5997:20 ...
,
Apr 4 2018
As per comment #5 could someone from mojo team can look in to this issue? Thanks!
,
Jun 12 2018
ClusterFuzz has detected this issue as fixed in range 566300:566302. Detailed report: https://clusterfuzz.com/testcase?key=4847273096511488 Fuzzer: marty_html_twiddler Job Type: linux_lsan_chrome_mp Platform Id: linux Crash Type: Indirect-leak Crash Address: Crash State: mojo::internal::InterfacePtrState<ukm::mojom::UkmRecorderInterface>::ConfigurePr instance get Sanitizer: address (ASAN) Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=523898:523900 Fixed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=566300:566302 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4847273096511488 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 12 2018
ClusterFuzz testcase 4847273096511488 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by ClusterFuzz
, Mar 17 2018Labels: Test-Predator-Auto-Components