New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 824645 link

Starred by 3 users

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Abrt in content::RenderProcessImpl::RenderProcessImpl

Project Member Reported by ClusterFuzz, Mar 22 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6651148782796800

Fuzzer: mbarbella_webcomponents
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900000001
Crash State:
  content::RenderProcessImpl::RenderProcessImpl
  content::RenderProcessImpl::Create
  content::RendererMain
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=544889:544902

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6651148782796800

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Cc: brajkumar@chromium.org
Components: Blink
Labels: -Type-Bug M-67 Test-Predator-Wrong Type-Bug-Regression
Owner: eholk@chromium.org
Status: Assigned (was: Untriaged)
Predator could not provide any possible suspects.

From the below CL observing some changes related to 'render_process_impl.cc' , hence suspecting the same
https://chromium.googlesource.com/chromium/src/+log/c0e4c38cd1a4a7a123485f5f0acf69bfd820a652..b81078b3f2226ba3bc2ece390bef3c2c2110bbd3?pretty=fuller&n=10000

Suspect CL: https://chromium.googlesource.com/chromium/src/+/90f2d93c90690cc690feefdf796e947f9dc22352

eholk@ -- Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks!
Project Member

Comment 2 by ClusterFuzz, Mar 22 2018

Labels: Fuzz-Blocker ReleaseBlock-Beta
This crash occurs very frequently on linux platform and is likely preventing the fuzzer mbarbella_webcomponents from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Project Member

Comment 3 by ClusterFuzz, Mar 23 2018

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.

Comment 4 by eholk@chromium.org, Mar 23 2018

Yes, I think this is related to my change. I'm looking into it now. It should be a pretty easy fix.

Comment 5 by eholk@chromium.org, Mar 23 2018

The problem is that we can't support trap handlers in msan builds. I have a CL out now that disables this.

https://crrev.com/c/979033

Comment 6 by bokan@chromium.org, Mar 26 2018

Components: -Blink Blink>JavaScript>WebAssembly
Project Member

Comment 7 by bugdroid1@chromium.org, Mar 26 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1456f311f22d65ffd607eea5f582a7a22db82fc6

commit 1456f311f22d65ffd607eea5f582a7a22db82fc6
Author: Eric Holk <eholk@chromium.org>
Date: Mon Mar 26 20:40:23 2018

Disable Wasm trap handler in msan builds

In msan builds, V8 generates ARM code and runs it in a simulator. This means we
cannot support trap handlers in that configuration.

TBR=jam@chromium.org

Bug:  chromium:824645 
Change-Id: If0971148262297d5688efd559a1526295a869e07
Reviewed-on: https://chromium-review.googlesource.com/979033
Reviewed-by: Dominic Battré <battre@chromium.org>
Commit-Queue: Dominic Battré <battre@chromium.org>
Cr-Commit-Position: refs/heads/master@{#545869}
[modify] https://crrev.com/1456f311f22d65ffd607eea5f582a7a22db82fc6/content/renderer/render_process_impl.cc

Comment 8 by eholk@chromium.org, Mar 26 2018

Issue 824771 has been merged into this issue.
Status: Fixed (was: Assigned)
Project Member

Comment 10 by ClusterFuzz, Mar 27 2018

ClusterFuzz has detected this issue as fixed in range 545864:545869.

Detailed report: https://clusterfuzz.com/testcase?key=6651148782796800

Fuzzer: mbarbella_webcomponents
Job Type: linux_msan_chrome
Platform Id: linux

Crash Type: CHECK failure
Crash Address: 
Crash State:
  v8::V8::EnableWebAssemblyTrapHandler(use_v8_signal_handler) in render_process_im
  content::RenderProcessImpl::RenderProcessImpl
  content::RenderProcessImpl::Create
  
Sanitizer: memory (MSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=544889:544902
Fixed: https://clusterfuzz.com/revisions?job=linux_msan_chrome&range=545864:545869

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6651148782796800

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Mar 27 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Fixed)
ClusterFuzz testcase 6651148782796800 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment