New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 829067 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Apr 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Null-dereference READ in content::ResourceDispatcherHostImpl::PickMoreInterestingLoadInfos

Project Member Reported by ClusterFuzz, Apr 4 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5324905865019392

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  content::ResourceDispatcherHostImpl::PickMoreInterestingLoadInfos
  content::ResourceDispatcherHostImpl::UpdateLoadStateOnUI
  void base::internal::FunctorTraits<void
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=546649:546656

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5324905865019392

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, Apr 4 2018

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Cc: brajkumar@chromium.org mmenke@chromium.org csharrison@chromium.org
Labels: -Type-Bug M-67 Test-Predator-Wrong Type-Bug-Regression
Unable to find actual suspect through code search and also observing no related changes under regression range, hence adding appropriate label and requesting someone from network team to look in to this issue.

Thanks!

Labels: CF-NeedsTriage
Owner: csharrison@chromium.org
Status: Assigned (was: Untriaged)
I'll take a look.
Components: Internals>Network
This crash was not reproducible either locally or using the downloaded build using the reproducer. My cmd line flag was:
/google/data/ro/teams/clusterfuzz-tools/releases/clusterfuzz reproduce 5324905865019392 --disable-xvfb

(with separately --build download)

I'll re-do the clusterfuzz task.
Project Member

Comment 6 by ClusterFuzz, Apr 25 2018

ClusterFuzz has detected this issue as fixed in range 553139:553151.

Detailed report: https://clusterfuzz.com/testcase?key=5324905865019392

Fuzzer: lcamtuf_cross_fuzz
Job Type: linux_tsan_chrome_mp
Platform Id: linux

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  content::ResourceDispatcherHostImpl::PickMoreInterestingLoadInfos
  content::ResourceDispatcherHostImpl::UpdateLoadStateOnUI
  void base::internal::FunctorTraits<void
  
Sanitizer: thread (TSAN)

Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=546471:546478
Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=553139:553151

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5324905865019392

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 7 by ClusterFuzz, Apr 25 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5324905865019392 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Fix range also doesn't make much sense :/

Sign in to add a comment