ash: uninitialized read in ResolutionNotificationControllerTest.* |
|||
Issue description
All of these tests fail on msan bots like this:
[ RUN ] ResolutionNotificationControllerTest.Close
==7328==WARNING: MemorySanitizer: use-of-uninitialized-value
#0 0x48e434e in ash::Shelf::IsHorizontalAlignment() const ./../../ash/shelf/shelf.cc:128:11
#1 0x4a0b7c5 in ash::WebNotificationItem::AnimationProgressed(gfx::Animation const*) ./../../ash/system/message_center/notification_tray.cc:193:25
#2 0x7a01851 in gfx::LinearAnimation::Step(base::TimeTicks) ./../../ui/gfx/animation/linear_animation.cc:78:17
#3 0x79fda6d in gfx::AnimationContainer::Run() ./../../ui/gfx/animation/animation_container.cc:91:13
#4 0x50ae81d in Run ./../../base/callback.h:125:12
#5 0x50ae81d in base::Timer::RunScheduledTask() ./../../base/timer/timer.cc:263:0
#6 0x5189521 in Run ./../../base/callback.h:96:12
#7 0x5189521 in base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask*) ./../../base/debug/task_annotator.cc:101:0
#8 0x4fa9c04 in base::MessageLoop::RunTask(base::PendingTask*) ./../../base/message_loop/message_loop.cc:319:25
#9 0x4fac99a in DeferOrRunPendingTask ./../../base/message_loop/message_loop.cc:329:5
#10 0x4fac99a in base::MessageLoop::DoDelayedWork(base::TimeTicks*) ./../../base/message_loop/message_loop.cc:413:0
#11 0x5173826 in base::MessagePumpLibevent::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_libevent.cc:220:27
#12 0x500fb6d in Run ./../../base/run_loop.cc:131:14
#13 0x500fb6d in base::RunLoop::RunUntilIdle() ./../../base/run_loop.cc:144:0
#14 0x8ee1cf5 in RunAllPendingInMessageLoop ./../../ash/test/ash_test_helper.cc:268:12
#15 0x8ee1cf5 in ash::AshTestHelper::TearDown() ./../../ash/test/ash_test_helper.cc:223:0
#16 0x8ed7871 in ash::AshTestBase::TearDown() ./../../ash/test/ash_test_base.cc:186:21
#17 0x44abf0b in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2667:11
#18 0x44ad989 in testing::TestCase::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2785:28
#19 0x44e4244 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5047:43
#20 0x44e2b32 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:0:0
#21 0x520d4d6 in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2329:46
#22 0x520d4d6 in base::TestSuite::Run() ./../../base/test/test_suite.cc:275:0
#23 0x521558e in Run ./../../base/callback.h:96:12
#24 0x521558e in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, bool, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:225:0
#25 0x5214d9e in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>) ./../../base/test/launcher/unit_test_launcher.cc:576:10
#26 0x2017e82 in main ./../../ash/test/ash_unittests.cc:14:10
#27 0x7fa09b4baf44 in __libc_start_main /build/eglibc-ripdx6/eglibc-2.19/csu/libc-start.c:287:0
#28 0x6175f9 in _start ??:0:0
Uninitialized value was created by a heap deallocation
#0 0x689e69 in operator delete(void*) /b/build/slave/linux_upload_clang/build/src/third_party/llvm/compiler-rt/lib/msan/msan_new_delete.cc:74:44
#1 0x4aedbef in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2321:5
#2 0x4aedbef in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2634:0
#3 0x4aedbef in ash::StatusAreaWidget::~StatusAreaWidget() ./../../ash/system/status_area_widget.cc:128:0
#4 0x4aeed0c in ash::StatusAreaWidget::~StatusAreaWidget() ./../../ash/system/status_area_widget.cc:125:39
#5 0x495ca8b in operator() ./../../buildtools/third_party/libc++/trunk/include/memory:2321:5
#6 0x495ca8b in reset ./../../buildtools/third_party/libc++/trunk/include/memory:2634:0
#7 0x495ca8b in ash::ShelfWidget::Shutdown() ./../../ash/shelf/shelf_widget.cc:239:0
#8 0x489521f in ash::RootWindowController::CloseChildWindows() ./../../ash/root_window_controller.cc:489:11
#9 0x4989b9a in ash::Shell::CloseAllRootWindowChildWindows() ./../../ash/shell.cc:1398:19
#10 0x497ff7c in ash::Shell::~Shell() ./../../ash/shell.cc:823:3
#11 0x4989f2c in ash::Shell::~Shell() ./../../ash/shell.cc:719:17
#12 0x8ee1cbd in ash::AshTestHelper::TearDown() ./../../ash/test/ash_test_helper.cc:219:5
#13 0x8ed7871 in ash::AshTestBase::TearDown() ./../../ash/test/ash_test_base.cc:186:21
#14 0x44abf0b in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2667:11
#15 0x44ad989 in testing::TestCase::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2785:28
#16 0x44e4244 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5047:43
#17 0x44e2b32 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:0:0
#18 0x520d4d6 in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2329:46
#19 0x520d4d6 in base::TestSuite::Run() ./../../base/test/test_suite.cc:275:0
#20 0x521558e in Run ./../../base/callback.h:96:12
#21 0x521558e in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, bool, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:225:0
#22 0x5214d9e in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>) ./../../base/test/launcher/unit_test_launcher.cc:576:10
#23 0x2017e82 in main ./../../ash/test/ash_unittests.cc:14:10
#24 0x7fa09b4baf44 in __libc_start_main /build/eglibc-ripdx6/eglibc-2.19/csu/libc-start.c:287:0
SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/s/w/ir/out/Release/ash_unittests+0x48e434e)
Exiting
,
May 10 2018
I don't think my change caused this as I pretty much just swapped one image for another. WebNotificationItem::HideAndDelete looks pretty suspect to me since it means the item can outlive |tray_|; not sure why this would have just started failing though.
,
May 10 2018
,
May 10 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/d8f72fd2090cb340d5151f985955c73734353ba3 commit d8f72fd2090cb340d5151f985955c73734353ba3 Author: Evan Stade <estade@chromium.org> Date: Thu May 10 18:31:33 2018 cros - Fix use-after-free in notification tray item Bug: 841768 Change-Id: I7b2d23223f270c129a6c38510ba51cb0eca5f287 Reviewed-on: https://chromium-review.googlesource.com/1054212 Reviewed-by: Xiyuan Xia <xiyuan@chromium.org> Commit-Queue: Evan Stade <estade@chromium.org> Cr-Commit-Position: refs/heads/master@{#557596} [modify] https://crrev.com/d8f72fd2090cb340d5151f985955c73734353ba3/ash/system/message_center/notification_tray.cc
,
May 10 2018
,
May 10 2018
|
|||
►
Sign in to add a comment |
|||
Comment 1 by ellyjo...@chromium.org
, May 10 2018Owner: est...@chromium.org