New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 824160 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
OoO until Feb 4th
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Direct-leak in blink::AutoplayUmaHelper::OnAutoplayInitiated

Project Member Reported by ClusterFuzz, Mar 21 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5175023955083264

Fuzzer: inferno_twister
Job Type: linux_lsan_chrome_mp
Platform Id: linux

Crash Type: Direct-leak
Crash Address: 
Crash State:
  blink::AutoplayUmaHelper::OnAutoplayInitiated
  blink::AutoplayPolicy::RequestPlay
  blink::HTMLMediaElement::Play
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_lsan_chrome_mp&range=532808:532809

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5175023955083264

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Mar 21 2018

Components: Blink>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Mar 21 2018

Labels: Test-Predator-Auto-Owner
Owner: raphael....@intel.com
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/5e4bfc34f885d3b4954b71a92366023f972a2d3a (bindings: Drop Nullable<T> in favor of WTF::Optional<T>).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Components: Blink>Bindings
Status: Started (was: Assigned)
Cc: haraken@chromium.org jbroman@chromium.org yukishiino@chromium.org
This is the first time I actually have access to any ClusterFuzz report, and I'd appreciate some help here.

I'm unable to reproduce the bug here, either with my regular builds or with the prebuilt binary from ClusterFuzz. I also tried using "clusterfuzz-2.4.0.pex reproduce -b download -i 10 5175023955083264" and the crash could not be reproduced in any run.

Can any of you reproduce the leak reported here? Am I doing something wrong?
Hmm, this doesn't reproduce on my environment.

Possible pitfalls are:
- Use the specific "GN CONFIG (ARGS.GN)".  Regular builds wouldn't crash.
- Set environment variables.  ASAN_OPTIONS in this case.
- Set command-line arguments.  The followings in this case.

--ignore-gpu-blacklist --allow-file-access-from-files --disable-gesture-requirement-for-media-playback --disable-click-to-play --disable-hang-monitor --dns-prefetch-disable --disable-default-apps --disable-component-update --safebrowsing-disable-auto-update --metrics-recording-only --disable-gpu-watchdog --disable-metrics --disable-popup-blocking --disable-prompt-on-repost --enable-experimental-extension-apis --enable-extension-apps --js-flags="--expose-gc --verify-heap" --new-window --no-default-browser-check --no-first-run --no-process-singleton-dialog --enable-shadow-dom --enable-media-stream --use-gl=swiftshader --use-fake-device-for-media-stream --use-fake-ui-for-media-stream --no-sandbox --disable-in-process-stack-traces --enable-logging=stderr

"clusterfuzz-2.4.0.pex reproduce -b download -i 10 5175023955083264" should take care of fetching the binary built and run by ClusterFuzz (so with the right GN arguments) and then running it with the appropriate ASAN_OPTIONS and command-line arguments, shouldn't it?
Yes, I think you're right.  And I cannot repro, too.

I ran ClusterFuzz to check if this is reproducible or not.
----
[2018-03-22 13:33:57 UTC] yukishiino@chromium.org: Redo task(s): minimize, progression
[2018-03-22 13:36:17 UTC] clusterfuzz-linux-high-end-r0z1: Minimize task started.
[2018-03-22 13:42:51 UTC] clusterfuzz-linux-high-end-r0z1: Minimize task errored out: Unable to reproduce crash.
[2018-03-22 13:43:27 UTC] clusterfuzz-linux-6qd4: Minimize task started.
[2018-03-22 13:52:25 UTC] clusterfuzz-linux-6qd4: Minimize task errored out: Unable to reproduce crash reliably, skipping minimization (crashed 3/10).
----

It seems like that it doesn't repro reliably.  I'm not sure if this is an actionable issue or not.

Cc: mlamouri@chromium.org
I looked at the issue and I'm not sure what's wrong. `sources_` is a set that gets simple values. The UMAHelper object is created by the AutoplayPolicy which is created by the HTMLMediaElement. The entire chain is a fairly trivial 1:1 relationship. Given that the call comes from bindings, it's not even as if HTMLMediaElement should be deleted.
Hmm, in this case what's the protocol here? Just close the bug as WontFix?
I'm fine with WontFix.
Status: WontFix (was: Started)
Alright, thanks for the help, everyone.

Sign in to add a comment