Data race in blink::BaseAudioContext::NotifyWorkletIsReady |
|||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=6541157069488128 Fuzzer: inferno_twister Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 8 Crash Address: 0x7eae200f43f8 Crash State: blink::BaseAudioContext::NotifyWorkletIsReady blink::AudioWorklet::NotifyGlobalScopeIsUpdated base::internal::Invoker<base::internal::BindState<void Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=523888:523922 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6541157069488128 Additional requirements: Requires HTTP Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
May 15 2018
Automatically adding ccs based on suspected regression changelists: Add ImageData constructor from StaticBitmapImage by zakerinasab@chromium.org - https://chromium.googlesource.com/chromium/src/+/2c863229da24ed1cb180759c9342e7a5125fd6f5 Re-enable overlays for 2d canvas by junov@chromium.org - https://chromium.googlesource.com/chromium/src/+/ec6125cd13b1850ece40029cff8c4504db7f7c43 Make ResourceResponse's non-null ctor arguments optional except for URL by hiroshige@chromium.org - https://chromium.googlesource.com/chromium/src/+/4ccc82e6053201317cc32e95515e8b8bd7749bf5 If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label.
,
May 15 2018
Data race on BaseAudioContext::audio_worklet_thread_? (BaseAudioContext::UpdateWorkletGlobalScopeOnRenderingThread() is called on a non-main thread before BaseAudioContext::NotifyWorkletIsReady() on the main thread?)
,
May 22 2018
,
May 22 2018
The simplest solution is to use lock/tryLock. BaseAudioContext::UpdateWorkletGlobalScopeOnRenderingThread() <AudioDeviceThread> - Use tryLock on audio_worklet_thread_ - If fails to acquire lock, update data in the next render call. BaseAudioContext::NotifyWorkletIsReady() <Main Thread> - Use lock on audio_worklet_thread_ - Wait until it acquires the lock.
,
May 23 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/0d867b3f41822270afa98cde6d24f39d37cab10d commit 0d867b3f41822270afa98cde6d24f39d37cab10d Author: Hongchan Choi <hongchan@chromium.org> Date: Wed May 23 23:21:24 2018 Use lock around audio_worklet_thread_ when it is accessed |audio_worklet_thread_| is constantly peeked by the rendering thread in the loop while it can be touched by the main thread when a promise from audioWorklet.addModule() gets resolved. This CL fixes the data race between these two threads. Bug: 842941 Change-Id: I404bb8963b2f25f42a2e12c20de867cb6c781032 Reviewed-on: https://chromium-review.googlesource.com/1070456 Commit-Queue: Hongchan Choi <hongchan@chromium.org> Reviewed-by: Raymond Toy <rtoy@chromium.org> Cr-Commit-Position: refs/heads/master@{#561304} [modify] https://crrev.com/0d867b3f41822270afa98cde6d24f39d37cab10d/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
,
May 24 2018
The fix has landed. Wait for the CF verification.
,
May 24 2018
ClusterFuzz has detected this issue as fixed in range 561301:561306. Detailed report: https://clusterfuzz.com/testcase?key=6541157069488128 Fuzzer: inferno_twister Job Type: linux_tsan_chrome_mp Platform Id: linux Crash Type: Data race WRITE 8 Crash Address: 0x7eae200f43f8 Crash State: blink::BaseAudioContext::NotifyWorkletIsReady blink::AudioWorklet::NotifyGlobalScopeIsUpdated base::internal::Invoker<base::internal::BindState<void Sanitizer: thread (TSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=523888:523922 Fixed: https://clusterfuzz.com/revisions?job=linux_tsan_chrome_mp&range=561301:561306 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6541157069488128 Additional requirements: Requires HTTP See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
May 24 2018
ClusterFuzz testcase 6541157069488128 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
May 24 2018
ClusterFuzz testcase 6541157069488128 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue. |
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by ClusterFuzz
, May 15 2018Labels: Test-Predator-Auto-Components