New issue
Advanced search Search tips

Issue 824097 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2018
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

MSan reports uses of uninit values in message_center::NotificationList::HasPopupNotifications()

Project Member Reported by glider@chromium.org, Mar 21 2018

Issue description

See https://logs.chromium.org/v/?s=chromium%2Fbb%2Fchromium.memory%2FLinux_ChromiumOS_MSan_Tests%2F6316%2F%2B%2Frecipes%2Fsteps%2Fbrowser_tests%2F0%2Flogs%2FDownloadTest.CrxInvalid%2F0:

[ RUN      ] DownloadTest.CrxInvalid
[23658:23658:0321/020303.931622:WARNING:chrome_browser_main_chromeos.cc(618)] Running as stub user with profile dir: test-user
[23658:23658:0321/020304.268608:WARNING:user_session_manager.cc(1068)] Attempting to save user password for non enterprise user.
[23658:23658:0321/020304.641881:ERROR:network_type_pattern.cc(134)] NetworkTypePattern: wifi: Can not match empty type.
[23658:23658:0321/020304.642393:ERROR:network_type_pattern.cc(134)] NetworkTypePattern: wifi: Can not match empty type.
[23658:23658:0321/020304.642792:ERROR:network_type_pattern.cc(134)] NetworkTypePattern: wifi: Can not match empty type.
[23658:23658:0321/020304.642922:ERROR:network_type_pattern.cc(134)] NetworkTypePattern: wifi: Can not match empty type.
[23658:23658:0321/020305.007922:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.007994:ERROR:in_progress_cache_impl.cc(172)] Cache is not initialized, cannot AddOrReplaceEntry.
[23658:23658:0321/020305.008426:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.019291:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.019367:ERROR:in_progress_cache_impl.cc(172)] Cache is not initialized, cannot AddOrReplaceEntry.
[23658:23658:0321/020305.020056:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.020102:ERROR:in_progress_cache_impl.cc(172)] Cache is not initialized, cannot AddOrReplaceEntry.
[23658:23658:0321/020305.020224:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.020256:ERROR:in_progress_cache_impl.cc(172)] Cache is not initialized, cannot AddOrReplaceEntry.
[23658:23658:0321/020305.020376:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.020414:ERROR:in_progress_cache_impl.cc(172)] Cache is not initialized, cannot AddOrReplaceEntry.
[23658:23658:0321/020305.022038:ERROR:in_progress_cache_impl.cc(188)] Cache is not initialized, cannot RetrieveEntry.
[23658:23658:0321/020305.022088:ERROR:in_progress_cache_impl.cc(172)] Cache is not initialized, cannot AddOrReplaceEntry.
==23658==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x1f70fdd2 in message_center::NotificationList::HasPopupNotifications(std::__1::vector<message_center::NotificationBlocker*, std::__1::allocator<message_center::NotificationBlocker*> > const&) ./../../ui/message_center/notification_list.cc:172:41
    #1 0x1f6f67ea in message_center::MessageCenterImpl::HasPopupNotifications() const ./../../ui/message_center/message_center_impl.cc:130:27
    #2 0x2c35809c in message_center::UiController::OnMessageCenterChanged() ./../../ui/message_center/ui_controller.cc:171:49
    #3 0x1f6f7284 in message_center::MessageCenterImpl::AddNotification(std::__1::unique_ptr<message_center::Notification, std::__1::default_delete<message_center::Notification> >) ./../../ui/message_center/message_center_impl.cc:0:16
    #4 0x1fd25096 in ash::MessageCenterController::ShowClientNotification(message_center::Notification const&) ./../../ash/message_center/message_center_controller.cc:153:25
    #5 0xe13fe8a in ash::mojom::AshMessageCenterControllerStubDispatch::Accept(ash::mojom::AshMessageCenterController*, mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.cc:326:13
    #6 0x1fd264d6 in ash::mojom::AshMessageCenterControllerStub<mojo::RawPtrImplRefTraits<ash::mojom::AshMessageCenterController> >::Accept(mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.h:274:12
    #7 0x175347f0 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419:32
    #8 0x175324ca in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #9 0x1754cbd4 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880:42
    #10 0x1754a450 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604:38
    #11 0x175324ca in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #12 0x1752bcdf in mojo::Connector::ReadSingleMessage(unsigned int*) ./../../mojo/public/cpp/bindings/lib/connector.cc:443:51
    #13 0x1752e1f9 in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:472:10
    #14 0x175199eb in Run ./../../base/callback.h:124:12
    #15 0x175199eb in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:273:0
    #16 0x124e9214 in Run ./../../base/callback.h:95:12
    #17 0x124e9214 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:61:0
    #18 0x1257d9f5 in base::MessageLoop::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop.cc:391:25
    #19 0x1257f48e in DeferOrRunPendingTask ./../../base/message_loop/message_loop.cc:403:5
    #20 0x1257f48e in base::MessageLoop::DoWork() ./../../base/message_loop/message_loop.cc:447:0
    #21 0x12586eb3 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_libevent.cc:220:31
    #22 0x1264c6df in base::RunLoop::Run() ./../../base/run_loop.cc:130:14
    #23 0x1432f571 in RunThisRunLoop ./../../content/public/test/test_utils.cc:127:13
    #24 0x1432f571 in content::RunMessageLoop() ./../../content/public/test/test_utils.cc:121:0
    #25 0x14213c46 in content::DownloadTestObserver::WaitForFinished() ./../../content/public/test/download_test_observer.cc:105:5
    #26 0x137974c in DownloadTest_CrxInvalid_Test::RunTestOnMainThread() ./../../chrome/browser/download/download_browsertest.cc:2290:13
    #27 0x141dc97e in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() ./../../content/public/test/browser_test_base.cc:379:5
    #28 0x12b33436 in Run ./../../base/callback.h:124:12
    #29 0x12b33436 in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() ./../../chrome/browser/chrome_browser_main.cc:2111:0
    #30 0x12b2ef8f in ChromeBrowserMainParts::PreMainMessageLoopRun() ./../../chrome/browser/chrome_browser_main.cc:1442:18
    #31 0x71604d4 in chromeos::ChromeBrowserMainPartsChromeos::PreMainMessageLoopRun() ./../../chrome/browser/chromeos/chrome_browser_main_chromeos.cc:722:32
    #32 0xb5c7d9a in content::BrowserMainLoop::PreMainMessageLoopRun() ./../../content/browser/browser_main_loop.cc:1040:13
    #33 0xca7f720 in Run ./../../base/callback.h:124:12
    #34 0xca7f720 in content::StartupTaskRunner::RunAllTasksNow() ./../../content/browser/startup_task_runner.cc:45:0
    #35 0xb5c050c in content::BrowserMainLoop::CreateStartupTasks() ./../../content/browser/browser_main_loop.cc:953:25
    #36 0xb5d509a in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) ./../../content/browser/browser_main_runner.cc:141:17
    #37 0xb5b3f15 in content::BrowserMain(content::MainFunctionParams const&) ./../../content/browser/browser_main.cc:42:32
    #38 0x123e179d in content::RunNamedProcessTypeMain(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, content::MainFunctionParams const&, content::ContentMainDelegate*) ./../../content/app/content_main_runner.cc:423:14
    #39 0x123e42b8 in content::ContentMainRunnerImpl::Run() ./../../content/app/content_main_runner.cc:703:12
    #40 0x1bd1167b in service_manager::Main(service_manager::MainParams const&) ./../../services/service_manager/embedder/main.cc:453:29
    #41 0x123ddc37 in content::ContentMain(content::ContentMainParams const&) ./../../content/app/content_main.cc:19:10
    #42 0x141dadbd in content::BrowserTestBase::SetUp() ./../../content/public/test/browser_test_base.cc:320:3
    #43 0x129d674e in InProcessBrowserTest::SetUp() ./../../chrome/test/base/in_process_browser_test.cc:230:20
    #44 0x8597b5b in testing::Test::Run() ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10
    #45 0x859bb09 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2661:11
    #46 0x859d539 in testing::TestCase::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2779:28
    #47 0x85d3c04 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5036:43
    #48 0x85d2502 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:0:0
    #49 0x12a3f750 in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2314:46
    #50 0x12a3f750 in base::TestSuite::Run() ./../../base/test/test_suite.cc:275:0
    #51 0x124aa54f in ChromeTestSuiteRunner::RunTestSuite(int, char**) ./../../chrome/test/base/chrome_test_launcher.cc:66:38
    #52 0x1431f38f in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) ./../../content/public/test/test_launcher.cc:625:31
    #53 0x124abcb7 in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) ./../../chrome/test/base/chrome_test_launcher.cc:171:10
    #54 0x124aa32f in main ./../../chrome/test/base/browser_tests_main_chromeos.cc:21:10
    #55 0x7f27055b3f44 in __libc_start_main /build/eglibc-SvCtMH/eglibc-2.19/csu/libc-start.c:287:0
    #56 0xa10839 in _start ??:0:0
  Uninitialized value was stored to memory at
    #0 0x1f70e4b3 in set_shown_as_popup ./../../ui/message_center/public/cpp/notification.h:374:21
    #1 0x1f70e4b3 in PushNotification ./../../ui/message_center/notification_list.cc:322:0
    #2 0x1f70e4b3 in message_center::NotificationList::AddNotification(std::__1::unique_ptr<message_center::Notification, std::__1::default_delete<message_center::Notification> >) ./../../ui/message_center/notification_list.cc:84:0
    #3 0x1f6f6dd7 in message_center::MessageCenterImpl::AddNotification(std::__1::unique_ptr<message_center::Notification, std::__1::default_delete<message_center::Notification> >) ./../../ui/message_center/message_center_impl.cc:170:23
    #4 0x1fd25096 in ash::MessageCenterController::ShowClientNotification(message_center::Notification const&) ./../../ash/message_center/message_center_controller.cc:153:25
    #5 0xe13fe8a in ash::mojom::AshMessageCenterControllerStubDispatch::Accept(ash::mojom::AshMessageCenterController*, mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.cc:326:13
    #6 0x1fd264d6 in ash::mojom::AshMessageCenterControllerStub<mojo::RawPtrImplRefTraits<ash::mojom::AshMessageCenterController> >::Accept(mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.h:274:12
    #7 0x175347f0 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419:32
    #8 0x175324ca in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #9 0x1754cbd4 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880:42
    #10 0x1754a450 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604:38
    #11 0x175324ca in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #12 0x1752bcdf in mojo::Connector::ReadSingleMessage(unsigned int*) ./../../mojo/public/cpp/bindings/lib/connector.cc:443:51
    #13 0x1752e1f9 in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:472:10
    #14 0x175199eb in Run ./../../base/callback.h:124:12
    #15 0x175199eb in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:273:0
    #16 0x124e9214 in Run ./../../base/callback.h:95:12
    #17 0x124e9214 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:61:0
    #18 0x1257d9f5 in base::MessageLoop::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop.cc:391:25
    #19 0x1257f48e in DeferOrRunPendingTask ./../../base/message_loop/message_loop.cc:403:5
    #20 0x1257f48e in base::MessageLoop::DoWork() ./../../base/message_loop/message_loop.cc:447:0
    #21 0x12586eb3 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_libevent.cc:220:31
    #22 0x1264c6df in base::RunLoop::Run() ./../../base/run_loop.cc:130:14
    #23 0x1432f571 in RunThisRunLoop ./../../content/public/test/test_utils.cc:127:13
    #24 0x1432f571 in content::RunMessageLoop() ./../../content/public/test/test_utils.cc:121:0
    #25 0x14213c46 in content::DownloadTestObserver::WaitForFinished() ./../../content/public/test/download_test_observer.cc:105:5
  Uninitialized value was stored to memory at
    #0 0xa2fbbb in __msan_memcpy /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/msan/msan_interceptors.cc:1492:3
    #1 0x1c8bb7ec in message_center::Notification::Notification(message_center::Notification const&) ./../../ui/message_center/public/cpp/notification.cc:95:53
    #2 0x1fd24c6e in make_unique<message_center::Notification, const message_center::Notification &> ./../../buildtools/third_party/libc++/trunk/include/memory:3079:32
    #3 0x1fd24c6e in ash::MessageCenterController::ShowClientNotification(message_center::Notification const&) ./../../ash/message_center/message_center_controller.cc:150:0
    #4 0xe13fe8a in ash::mojom::AshMessageCenterControllerStubDispatch::Accept(ash::mojom::AshMessageCenterController*, mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.cc:326:13
    #5 0x1fd264d6 in ash::mojom::AshMessageCenterControllerStub<mojo::RawPtrImplRefTraits<ash::mojom::AshMessageCenterController> >::Accept(mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.h:274:12
    #6 0x175347f0 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:419:32
    #7 0x175324ca in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #8 0x1754cbd4 in mojo::internal::MultiplexRouter::ProcessIncomingMessage(mojo::internal::MultiplexRouter::MessageWrapper*, mojo::internal::MultiplexRouter::ClientCallBehavior, base::SequencedTaskRunner*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:880:42
    #9 0x1754a450 in mojo::internal::MultiplexRouter::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/multiplex_router.cc:604:38
    #10 0x175324ca in mojo::FilterChain::Accept(mojo::Message*) ./../../mojo/public/cpp/bindings/lib/filter_chain.cc:40:17
    #11 0x1752bcdf in mojo::Connector::ReadSingleMessage(unsigned int*) ./../../mojo/public/cpp/bindings/lib/connector.cc:443:51
    #12 0x1752e1f9 in mojo::Connector::ReadAllAvailableMessages() ./../../mojo/public/cpp/bindings/lib/connector.cc:472:10
    #13 0x175199eb in Run ./../../base/callback.h:124:12
    #14 0x175199eb in mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) ./../../mojo/public/cpp/system/simple_watcher.cc:273:0
    #15 0x124e9214 in Run ./../../base/callback.h:95:12
    #16 0x124e9214 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:61:0
    #17 0x1257d9f5 in base::MessageLoop::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop.cc:391:25
    #18 0x1257f48e in DeferOrRunPendingTask ./../../base/message_loop/message_loop.cc:403:5
    #19 0x1257f48e in base::MessageLoop::DoWork() ./../../base/message_loop/message_loop.cc:447:0
    #20 0x12586eb3 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_libevent.cc:220:31
    #21 0x1264c6df in base::RunLoop::Run() ./../../base/run_loop.cc:130:14
    #22 0x1432f571 in RunThisRunLoop ./../../content/public/test/test_utils.cc:127:13
    #23 0x1432f571 in content::RunMessageLoop() ./../../content/public/test/test_utils.cc:121:0
    #24 0x14213c46 in content::DownloadTestObserver::WaitForFinished() ./../../content/public/test/download_test_observer.cc:105:5
  Uninitialized value was created by an allocation of 'p_notification' in the stack frame of function '_ZN3ash5mojom38AshMessageCenterControllerStubDispatch6AcceptEPNS0_26AshMessageCenterControllerEPN4mojo7MessageE'
    #0 0xe13ec60 in ash::mojom::AshMessageCenterControllerStubDispatch::Accept(ash::mojom::AshMessageCenterController*, mojo::Message*) ./gen/ash/public/interfaces/ash_message_center_controller.mojom.cc:262:0
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/s/w/ir/out/Release/browser_tests+0x1f70fdd2)
Exiting

This is a report from https://ci.chromium.org/buildbot/chromium.memory/Linux%20ChromiumOS%20MSan%20Tests/6309
Previous builds were clean, so https://chromium.googlesource.com/chromium/src/+/8ce1863fca7917a12da14951cffafa0f7917a668 is likely the culprit.
 
Project Member

Comment 2 by bugdroid1@chromium.org, Mar 21 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/522e7d296fe445ccea402078944f4e653b76a98d

commit 522e7d296fe445ccea402078944f4e653b76a98d
Author: Evan Stade <estade@chromium.org>
Date: Wed Mar 21 19:20:11 2018

Inititialize fields in message_center::Notification's default ctor.

The default ctor is used for mojo. These fields are not copied over so
they need to be initialized.

Bug:  824097 
Change-Id: I2f37acfbc36790c53064d2c467989878674c6e43
Reviewed-on: https://chromium-review.googlesource.com/973541
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Commit-Queue: Evan Stade <estade@chromium.org>
Cr-Commit-Position: refs/heads/master@{#544799}
[modify] https://crrev.com/522e7d296fe445ccea402078944f4e653b76a98d/ui/message_center/public/cpp/notification.cc
[modify] https://crrev.com/522e7d296fe445ccea402078944f4e653b76a98d/ui/message_center/public/cpp/notification.h

Comment 3 by est...@chromium.org, Mar 26 2018

Status: Fixed (was: Assigned)

Sign in to add a comment