New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 827880 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in blink::FontCache::CrashWithFontInfo

Project Member Reported by ClusterFuzz, Apr 1 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5571003674263552

Fuzzer: cdiehl_dharma
Job Type: linux_ubsan_vptr_chrome
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x053900000001
Crash State:
  blink::FontCache::CrashWithFontInfo
  blink::HarfBuzzShaper::ShapeSegment
  blink::HarfBuzzShaper::Shape
  
Sanitizer: undefined (UBSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_vptr_chrome&range=545648:545649

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5571003674263552

Additional requirements: Requires Gestures

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 1 2018

Labels: OS-Chrome
Project Member

Comment 2 by ClusterFuzz, Apr 1 2018

Labels: Fuzz-Blocker M-67 ReleaseBlock-Beta
This crash occurs very frequently on linux platform and is likely preventing the fuzzer cdiehl_dharma from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Project Member

Comment 3 by ClusterFuzz, Apr 1 2018

Components: Platform
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 4 by ClusterFuzz, Apr 1 2018

Labels: Test-Predator-Auto-Owner
Owner: lukasza@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/5e201abdaf41bb510b8033b390981866c2104170 (Move features::kSitePerProcess from //content to //chrome layer.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Cc: e...@chromium.org
Components: -Platform Blink>Fonts
Labels: Test-Predator-Wrong-CLs
Owner: kojii@chromium.org
kojii@ (or eae@), could you PTAL?  I see that you've added more debugging info in r451964 for the CHECK that is failing here:

https://codereview.chromium.org/2707763003/patch/80001/90001:
    void FontCache::crashWithFontInfo(const FontDescription* fontDescription) {
      FontCache* fontCache = FontCache::fontCache();
      SkFontMgr* fontMgr = nullptr;
      int numFamilies = std::numeric_limits<int>::min();
      if (fontCache) {
        fontMgr = fontCache->m_fontManager.get();
        if (fontMgr)
          numFamilies = fontMgr->countFamilies();
      }
    
      debug::alias(&fontDescription);
      debug::alias(&fontCache);
      debug::alias(&fontMgr);
      debug::alias(&numFamilies);
    
      CHECK(false); <- CRASH HAPPENS HERE!
    }

I am adding Test-Predator-Wrong-CLs label and removing myself as an owner, because I think the explanation from   https://crbug.com/823148#c3   applies here as well.
A friendly reminder that M67 branch is coming soon on 04/12! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M67 from a high quality trunk. Thank you.
Gentle ping to take a look into it as it is marked as beta blocker & M67 branch is coming very soon on 04/12.

Thanks..!
Friendly ping to get an update on this beta blocker issue as M67 branch is tomorrow.

Thanks..!

Comment 9 by kojii@chromium.org, Apr 11 2018

This does not repro on my local build.

When I tried "clusterfuzz repro", I think I saw this was reported by a few people in other issues, but it fails saying:

Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 libsqlite3-0-dbg : Depends: libsqlite3-0 (= 3.20.1-2) but 3.22.0-2 is to be installed

Is there any way to reproduce this other than using "clusterfuzz repro", or is there any plan to fix it to run on gLinux Rodeo?

Comment 10 by kojii@chromium.org, Apr 11 2018

FYI, another feedback on "clusterfuzz repro" here:
https://bugs.chromium.org/p/chromium/issues/detail?id=813102#c12
A friendly reminder that M67 branch is tomorrow, Thursday 04/12! Your bug is labelled as Beta ReleaseBlock, pls make sure to land the fix ASAP to trunk. This way we branch M67 from a high quality trunk. Thank you.

Comment 12 by kojii@chromium.org, Apr 12 2018

Labels: -ReleaseBlock-Beta
As in #9, I'm not able to reproduce this one, and thus removing the RBB label. If I should do something differently for such an issue, please let me know or feel free to correct.

Comment 13 by kojii@chromium.org, Apr 16 2018

Cc: kojii@chromium.org brajkumar@chromium.org
 Issue 832053  has been merged into this issue.
Project Member

Comment 14 by ClusterFuzz, Apr 17 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5077042899714048 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment