New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 843044 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: May 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Null-dereference READ in ObtainAndSetContextProvider

Project Member Reported by ClusterFuzz, May 15 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=6203526469124096

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  ObtainAndSetContextProvider
  ?RunOnce@?$Invoker@U?$BindState@P6AXV?$OnceCallback@$$A6AX_NPEAVContextProvider@
  base::internal::ReplyAdapter<struct std::pair<class media::GpuVideoAcceleratorFa
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=558537:558542

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6203526469124096

Issue filed automatically.

See https://github.com/google/clusterfuzz-tools for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 15 2018

Components: Internals>Media
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, May 15 2018

Labels: Test-Predator-Auto-Owner
Owner: lethalantidote@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/e09b316de4c2101695a8e2541dc907ff7e692d45 (Updates VideoFrameResourceProvider to allow for null context_provider.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 3 by ClusterFuzz, May 15 2018

Labels: M-68 Fuzz-Blocker ReleaseBlock-Beta
This crash occurs very frequently on windows platform and is likely preventing the fuzzer inferno_layout_test_unmodified from making much progress. Fixing this will allow more bugs to be found.

Marking this bug as a blocker for next Beta release.

If this is incorrect, please add ClusterFuzz-Wrong label and remove the ReleaseBlock-Beta label.
Status: Started (was: Assigned)
 Issue 833114  has been merged into this issue.
Cc: lethalantidote@chromium.org
 Issue 842893  has been merged into this issue.
Cc: brajkumar@chromium.org
 Issue 842437  has been merged into this issue.
Cc: liber...@chromium.org
 Issue 829245  has been merged into this issue.
Project Member

Comment 9 by ClusterFuzz, May 16 2018

Labels: OS-Chrome OS-Mac OS-Linux
Project Member

Comment 10 by ClusterFuzz, May 16 2018

ClusterFuzz has detected this issue as fixed in range 558906:558913.

Detailed report: https://clusterfuzz.com/testcase?key=6203526469124096

Fuzzer: inferno_layout_test_unmodified
Job Type: windows_asan_chrome_no_sandbox
Platform Id: windows

Crash Type: Null-dereference READ
Crash Address: 0x000000000000
Crash State:
  ObtainAndSetContextProvider
  ?RunOnce@?$Invoker@U?$BindState@P6AXV?$OnceCallback@$$A6AX_NPEAVContextProvider@
  base::internal::ReplyAdapter<struct std::pair<class media::GpuVideoAcceleratorFa
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=558537:558542
Fixed: https://clusterfuzz.com/revisions?job=windows_asan_chrome_no_sandbox&range=558906:558913

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=6203526469124096

See https://github.com/google/clusterfuzz-tools for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, May 16 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6203526469124096 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Project Member

Comment 12 by ClusterFuzz, May 16 2018

Labels: ClusterFuzz-Verified
Status: Verified (was: Started)
ClusterFuzz testcase 6203526469124096 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
Labels: ClusterFuzz-Wrong
Status: Started (was: Verified)
Project Member

Comment 14 by bugdroid1@chromium.org, May 16 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7d8b02c596be83e21f864496072257221e7269a3

commit 7d8b02c596be83e21f864496072257221e7269a3
Author: CJ DiMeglio <lethalantidote@chromium.org>
Date: Wed May 16 19:59:50 2018

Adds check for gpu factories.

GPU factories may be null when we ask for it so we should handle it.
If GPU factories is null, we should fall back to software compositing.

Bug:  843044 
Change-Id: I611c19ed1d253c509fca6cb0cf6a69642d9080b9
Reviewed-on: https://chromium-review.googlesource.com/1060615
Reviewed-by: Frank Liberato <liberato@chromium.org>
Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Commit-Position: refs/heads/master@{#559244}
[modify] https://crrev.com/7d8b02c596be83e21f864496072257221e7269a3/content/renderer/media/media_factory.cc

Project Member

Comment 15 by bugdroid1@chromium.org, May 16 2018

Labels: merge-merged-3432
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6166b3d1d75b610ffffce28e032b95a3b2281004

commit 6166b3d1d75b610ffffce28e032b95a3b2281004
Author: CJ DiMeglio <lethalantidote@chromium.org>
Date: Wed May 16 20:02:51 2018

Adds check for gpu factories.

GPU factories may be null when we ask for it so we should handle it.
If GPU factories is null, we should fall back to software compositing.

Bug:  843044 
Change-Id: I611c19ed1d253c509fca6cb0cf6a69642d9080b9
Reviewed-on: https://chromium-review.googlesource.com/1060615
Reviewed-by: Frank Liberato <liberato@chromium.org>
Commit-Queue: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#559244}(cherry picked from commit 7d8b02c596be83e21f864496072257221e7269a3)
Reviewed-on: https://chromium-review.googlesource.com/1062289
Reviewed-by: CJ DiMeglio <lethalantidote@chromium.org>
Cr-Commit-Position: refs/branch-heads/3432@{#4}
Cr-Branched-From: e4b3b7b5a403e7f006958187cd67a0d7d6d9306c-refs/heads/master@{#558914}
[modify] https://crrev.com/6166b3d1d75b610ffffce28e032b95a3b2281004/content/renderer/media/media_factory.cc

Status: Fixed (was: Started)

Sign in to add a comment